Identity theft victims could lead us to accept more security-improving friction

Far too many individuals who have never been victims of identity theft and financial crimes don’t understand how devastating those are to victims.

“There are many victim services organizations that assist violent crime victims and the understanding of the trauma and the victim experience is not questioned (which is very appropriate and as it should be),” Eva Velasquez, president and CEO of the Identity Theft Resource Center (ITRC), told Help Net Security.

After all, we all know what it feels like to experience physical pain, so if we encounter a victim of a physical assault that is traumatized, we can generally understand why they are upset. Unfortunately, victims of non-violent crimes are often not afforded that same level of understanding.

“Victims who contacted the ITRC have shared with me that their support network (friends, family, co-workers) simply dismiss their feelings and often tell them they are overacting or that their reaction is unreasonable,” she explained.

“The most ineffective response anyone can have is to dismiss or downplay a victim’s reactions. When a system that is supposed to protect you demonstrably breaks down, you are left feeling vulnerable and helpless; and there are long-term downstream effects, including loss of trust in the system, institutions, and oneself.”

And while it’s true that victimization can sometimes be traced back to behavior on the victim’s part, that is not a reason to call them stupid, she noted. “Who amongst us hasn’t made a mistake? We are all human and no one is perfect. Victim blaming is shameful and needs to stop.”

The Identity Theft Resource Center

The Identity Theft Resource Center is a US-based non-profit organization established to support and assist victims of identity theft in resolving their cases, and to broaden public education about and awareness of identity theft, data breaches, cybersecurity, scams/fraud and privacy issues.

The ITRC attempts to share a different narrative through their research report series The Aftermath, their discussions with thought leaders and decision makers and through their participation on a national level with other victim service providers.

Communicating to the public, decision makers and funders just how devastating financial and identity crimes are to victims has been one of Velasquez’s biggest challenges since becoming CEO of ITRC in 2013.

“Additionally, as any non-profit will attest to, fundraising is always top of mind,” she added. “As a non-profit organization, we must be good stewards of the donations, grants and other funding sources, while ensuring that we use the most cost-effective processes. However, in this space we must be as dynamic and up-to-date as possible on technology trends. Finding the balance between achieving our mission and being as current on the latest technology, cybersecurity and privacy issues has also proven to be challenging.”

Attitudes toward security are changing

Velasquez believes that identity theft incidents are a direct consequence of our historical societal preference for convenience over security and the industry’s unwillingness to acknowledge that this conversation has changed.

“While it remains true that we as consumers still want the convenience of conducting many transactions online, including ones where we have to conduct an initial authentication, consumer tolerance of friction has changed,” she said.

“This is wholeheartedly true for victims. People who have had their identity or identity credentials misused are not just tolerant of friction, they welcome it! They have a hard-learned understanding that if authenticating is easy for them, it will be just as easy for a thief. And because identity theft is affecting millions of people every year, this is a large and growing segment of our population.”

She therefore advised security leaders to start thinking about friction differently and take incremental steps to determine the friction level that their particular consumer base can tolerate.

Another indication that attitudes are changing and consumers care about protecting themselves and their identities is the steady number of visitors to ITRC’s website and callers to its toll-free information hotline.

“When I first became CEO of ITRC six years ago, our call center received about 70% of its call volume from victims of identity theft and 30% from people who were not victims, requesting assistance or information on the issue. These callers had some sort of exposure to the issue and wanted more understanding based on their situation: information to learn more, risk minimization techniques or they were calling to verify if an email/text/call they received was a scam. They may have been a victim of another crime (like a car burglary, purse/wallet theft, or mail theft) and wanted information on their level of exposure and risk of identity theft and advice on steps they could take to prevent it,” she noted.

“Fast forward to our current metrics – the stats have flipped. While we are very active in our victim remediation services, more and more people are proactively reaching out to us BEFORE they become victims of identity theft. If that doesn’t demonstrate increased consumer awareness and desire for information, I don’t know what does.”

Help is available

Consumers are also becoming more aware of the privacy implications of their actions, she believes – partly because they are learning about the dangers and partly because of external events that have caused them to reflect on how their own actions are contributing to the privacy landscape.

The organization’s hands-on privacy workshops are sought after and the public continues to ask them for more information about data breaches/abuses and how to minimize their risks.

ITRC’s goal is to help as many victims and consumers as they can, in as many ways they can. The ideal is to help every victim that needs them.

“Does every victim need us? No, some have other resources they can turn to and I am grateful for that. But there are an extraordinary number of folks that have no other resources available to them. I want to ensure those people never feel alone or that they have to figure this out for themselves. We have a plan for them and we want everyone to know and share the message,” she concluded.