There is too much talk about identity (ID) theft and not enough about ID fraud, according to David Porter, Head of Security and Risk at specialist IT consultancy, Detica. For the true magnitude of ID fraud to be understood, it must be realised that the theft of an ID is just a means to commit fraud.

“Identity theft is an enabler, a means of ultimately perpetrating a range of criminal activities ranging from fraud and money laundering, to drug trafficking and illegal immigration,” says Porter. “If people were more aware of this, then we might stand a better chance of tackling identity theft and therefore stopping the fraud from ever happening.”

Porter believes a major issue is the lack of priority given to ID fraud: “Current Government proposals for ID cards are meant to tackle crimes such as illegal immigration, global terrorism and benefit fraud. However, fraud, including identity fraud, comes bottom on most people's crime prevention agendas, even though it is the fastest growing area of white-collar crime.”

Analyst house, Aberdeen Group, estimates that, in global terms, ID fraud will cost governments, businesses and individuals around $221 billion by the end of 2003, tripling to an incredible $2 trillion by the end of 2005. UK figures tell a similar story: according to the National Criminal Intelligence Squad, the British economy suffers a loss of £1.3 billion per year as a result of identity fraud.

As the impact on victims is significant, the task of raising people's awareness of this crime and how it can be used to perpetrate highly effective fraud is extremely important. The knock-on effects of ID fraud are not limited to financial loss - it can take victims up to 300 hours of effort to regain their credibility with banks and credit reference agencies.

Porter insists that prevention measures need careful forethought: “ID cards are being touted as the best solution for checking an individual’s identity on the spot. However, authentication is essential to guarantee the information on the card is correct. Although the cards themselves cost relatively little, the registration and authentication infrastructure behind them needs to be highly sophisticated in order to eliminate any weak spots. But this can be expensive.”

Porter believes there are three methods of authenticating an individual: “Firstly through something only that individual would know, such as a secret PIN password. Secondly, through something they have like a key, token or smart card. Finally, through something they are, a biometric, such a fingerprint, voiceprint or digital signature. Ideally, we’d like to see at least two of the three on each form of identification. We don’t live in an ideal world though, so traditional user ID or password combinations will probably be used for the foreseeable future, weakening our defences against ID fraud.”

Detica is also urging organisations to look more widely, beyond ID cards, when examining the issue of identity legislation. Behavioural profiling, based on transaction data, is a complementary and often overlooked method of identifying people and potentially fraudulent activities.

Porter notes: “It’s particularly useful when a fraudster has got around preventative mechanisms and is successfully using a false identity. Behavioural profiling exploits the fact that fraudsters tend to behave in a structured way, with relatively regular patterns. They don’t normally act in a random or chaotic manner which helps us to identify them using appropriate analytical techniques.”