Identity Theft: Expected Costs
15 July 2008
A friend recently told me about LifeLock, a company that, for a fee, says it will protect you against identity theft. It does this by persistently renewing fraud alerts with the credit bureaus (which means, according to the FTC, that “potential creditors must use what the law calls ‘reasonable policies and procedures’ to verify your identity before they issue credit in your name”), monitoring your credit reports, removing your name from pre-approved credit card lists, watching for your credit card number on websites that peddle stolen cards, and offering up to USD $1,000,000 if you lose money to credit fraud anyway.
Is LifeLock Worth It?
Except for the monetary guarantee, LifeLock doesn’t do anything you couldn’t do on your own, and the company charges $10 per month for its services. If you want this sort of protection and you have more money than time, LifeLock may be a good deal. If you have more time than money, it’s probably a bad deal.
But there’s another way of looking at this. You might ask how much money you stand to lose if you don’t take any precautionary measures, by your own efforts or through a service like LifeLock.
The FTC estimated that there were 8.3 million American victims of identity theft in 2005, the latest year for which survey data are available. That works out to about 3.7% of the adult population. However, the typical victim didn’t suffer any consequences — his or her credit card company or bank soaked up the cost. A smaller group that fell victim to the most serious type of identity theft, new account fraud, had to pay a median of $40 and spend ten hours clearing their names. This smaller group made up 0.8% of the survey respondents.
If the survey was representative of the American population as a whole, it is possible to calculate the risk of identity theft, in dollars, to the typical person. The calculation is as follows:
Expected monetary loss per person, per year = risk * (money loss + monetary time cost)
We already know the risk (0.8%) and monetary loss ($40) components of the formula, so we just need an estimate of the monetary time cost. Median income in the united states is different for men and women, but if we take the mean of the two figures and transform it into an hourly wage, a rough estimate of the value of the typical person’s time is $25 per hour. And if it takes ten hours to deal with the consequences of identity theft, the monetary time cost is $250. Okay, on to the final calculation:
Expected monetary loss per person, per year = 0.008 * (40 + 250) = $2.32
The Bottom Line
If LifeLock were to set its fees to $2.32 per year, or about 20 cents per month, it would be a pretty good deal. Otherwise, you might be better off taking your chances.
Read more about economics of security,identity theft
Pingback by Phishing: Expected Costs | Defending The Kingdom: Security and Privacy in Your Digital Life — 24 August 2008 @ 8:43 pm
[…] In the previous post, I calculated the cost, in statistical terms, of identity theft for the typical person. This post will explore the risk of getting phished. […]