Stolen identity - Cover Story - preventing identity theft

HR Magazine, Dec, 2002 by Susan J. Wells

When employees suffer from identity theft, employers also pay a price--especially if their treatment of employee records was part of the problem

The trouble started when a laboratory employee at Ligand Pharmaceuticals Inc. in San Diego came across a box in a storage closet; inside she found the personnel records of 38 former employees of Glycomed Inc., a company that Ligand had acquired in 1995.

Using the information from those files--including names, addresses, Social Security numbers (SSNs), birth dates and other data--the lab worker and her acquaintances fraudulently rented three apartments, opened 20 cellular telephone accounts and set up more than 25 credit card accounts--which they used to purchase $100,000 in goods.

The worker was eventually caught, convicted and sentenced--but not soon enough for 14 of the 38 victims, who sued Ligand for negligence, claiming the crime would never have taken place if the company had taken better care of their personnel records.

Ligand settled out of court, and while lawyers declined to discuss the settlement, recent news reports claim the company paid out a "significant six-figure amount." A Ligand spokesperson did not return phone calls seeking comment.

The case is "a classic example of what can go wrong when employers don't know what's happening with all the information they possess," says Margaret Byrne, a partner at Bacalski, Byrne, Koska & Ottoson (BBK&O), the San Diego law firm that handled the case for the plaintiffs.

Ironically, Ligand had a strict policy safeguarding data pertaining to current employees, but Byrne contends the firm didn't apply that same standard of protection to the files it received through its acquisition of Glycomed.

The events at Ligand highlight the dramatic risks employers can face from identity theft in the workplace. But they only begin to scratch the surface of showing how devastating identity theft can be to employees and employers alike--or how common such theft is becoming.

A Fast-Moving Trend

Four years ago, identity theft wasn't even designated a crime; today, it's a felony under the federal Identity Theft and Assumption Deterrence Act of 1998 and ranks as the nation's top consumer fraud complaint, according to the Federal Trade Commission (FTC) in Washington, D.C. In 2001, the FTC's Identity Theft Data Clearinghouse-a help desk, databank and law-enforcement aid-received roughly 85,000 complaints of identity theft, bearing out all other categories.

The rapid growth of identity theft is perhaps best illustrated by the rising number of individuals who call the clearinghouse seeking to lodge complaints or gather information. In its first month of operation, November 1999, the clearinghouse received 445 calls per week. Today, on average, more than 3,000 calls pour into the clearinghouse each week, which projects to more than 150,000 per year.

While these numbers are instructive, they aren't complete: There are no comprehensive statistics on the prevalence of identity theft--no one single source captures the full picture-so the true frequency of the crime is likely higher than the numbers reflect.

What is clear, however, is that employers are involved. The No. 1 underlying source of identity fraud is theft of employer records, according to a September 2002 report by TransUnion, one of the nation's three credit bureaus.

And the number of identity theft cases that have their roots inside businesses is rising, says Beth Givens, founder and director of the Privacy Rights Clearinghouse (PRC), a nonprofit privacy-advocacy group based in San Diego.

The bait drawing such crime to the workplace includes personnel files, benefits data, and payroll and tax records--all of which typically reside in the HR department and can be a goldmine for identity thieves. And as employers increasingly store personnel files electronically, the theft of that information is likely to increase. (See "Keeping Your Network Safe" on page 42.)

"HR is a big target," says BBK&O's Byrne. "When someone steals a wallet, they get one name, one SSN. When they steal personnel files, they get away with 10, maybe 100 names and numbers."

A Drain on More Than Wallets

In addition to crippling financial effects and the potential for serious criminal abuse, identity theft can be devastating to a victim's daily life--and a drain on employee productivity and morale as well.

On average, victims of identify theft and fraud spend 175 hours researching and tracking the crime, 23 months correcting credit reports and $800 in out-of-pocket expenses to restore their financial standing, according to a joint study of victims' experiences by the PRC and the California Public Interest Research Group.

Tracey Thomas, a software engineer in California, estimates she missed about 300 hours of work after an emergency-room receptionist took her name, birth date and SSN from her insurance information, then used it to rent an apartment and open fraudulent credit accounts.

"It's unfathomable--the amount of personal time and effort it takes," Thomas says. "If somebody breaks into your house, you can change the locks. But if someone takes your identity, there simply is no quick fix."