Johannesburg, 15 Nov 2004
Despite millions of cases of identity theft every year, American consumers continue to surrender too much personal information over the phone or Web, according to the 2004 Identity Management Survey.
The survey, commissioned by EDS and the International Association of Privacy Professionals (IAPP), and conducted by the Ponemon Institute, found consumers are not practising all security precautions to protect themselves despite repeated warnings of identity theft.
"While consumers have learned not to divulge information such as their Social Security number and debit card number over the phone or on the Web, our survey indicates that they are still na"ive and share significant amounts of information from the contents of their wallet - putting them at greater risk for identity theft and phishing," said Peter Reid, portfolio strategist for EDS Security and Privacy Services.
Key survey findings show that more than 70% of consumers will share information, such as their name, address, postal code, phone number, account number or give the answer to a security question to an unsolicited call or e-mail. Other findings in the survey include:
a. A majority of consumers (61%) do not want to be forced to change passwords, a common procedure mandated to enhance security.
b. Over half of respondents (57%) do not want their accounts locked down after three failed attempts to provide identification verification information.
c. Two-thirds of consumers (66%) believe it is worse to endure the inconvenience of being denied access due to a systems glitch than it is to be given access without proving their identity.
Reid, who released the overall survey results in a white paper, Privacy and Identity Management Survey, during the IAPP Conference on 29 October in New Orleans, said consumers continue to repeat the mistakes that resulted in nearly 10 million identity theft victims in the US last year as reported by the Federal Trade Commission.
The Identity Management Survey was conducted to evaluate consumer sentiment about sharing personal information, different methods organisations currently use to verify identity and what remedial action consumers expect organisations to take following a security breach.
"These findings are a clear indication that consumers are not willing to spend time with identification verification processes that serve to protect their personal information and their identity," said Reid. "However, the survey results also indicate that consumers want identification methods to be just as secure as they are convenient and that, perhaps, is one of the reasons why consumers are now more open to alternative identification verification methods."
The survey also gauged consumer interest toward innovative methods of identification verification, such as biometrics and a single secure and private identification credential. Results suggest that a majority of consumers are open to alternative methods of identification management solutions:
a. More than 69% are open to the idea of using biometrics for identity management. Only 12% said no to biometrics, while 19% are unsure.
b. 88% of respondents who are willing to accept biometric identification methods are in favour of this technology because it is convenient and does not require them to remember passwords.
c. 85% chose fingerprints and 84% chose voice recognition as preferred methods of biometric identification for convenience and speed.
d. More than 75% of respondents believe that one secure and private identification credential, issued by a trusted organisation, would make it much more convenient to prove their identity to various organisations.
"This survey confirms the fact that, in spite of issues like identity theft, consumers value convenience over privacy, presaging a real need for technologies and techniques that offer superior privacy protection while enhancing the customer experience," said Trevor Hughes, executive director, IAPP. "Clearly, the development and adoption of technologies such as biometrics and identity management solutions are vital to meeting our responsibilities to the consumer."
According to the Identity Management Survey, 77% of consumers expect organisations to have strong identification safeguards in place. The top five organisations that consumers expect to have the strongest identification and authentication safeguards are law enforcement (94%), credit card companies (94%), hospitals and clinics (91%), banks (89%) and airlines (84%).
"Several times a day, many consumers are asked to share their personal information in order to establish a relationship with a company or to purchase a product online," said Dr Larry Ponemon, chairman and founder of Ponemon Institute. "This is the first study that attempts to understand the concerns consumers have about sharing information and what they expect organisations to do to protect their information. I believe organisations will find the results interesting and valuable as they define their identity management strategies for the future."
While consumers may be divulging important personal information and demand convenient security, they clearly value the protection of their personal information. Survey findings indicate 85% of consumers believe their access should be denied if their identity cannot be verified. In addition, 84% want to be notified when an organisation determines that an unauthorised person has been given access to their information.
"As a leading identity management solutions services provider, EDS has a responsibility to its customers to understand the evolving privacy and identity management consumer demands," said Gail Magnuson, global offering manager, EDS Security and Privacy Services, and co-author of the Privacy and Identity Management Survey white paper. "EDS chose to sponsor this major market survey to assist our clients in the development of identity management solutions that fit the needs of their customers."
The Ponemon Institute administered the large scale, Web-based national study between 7 and 30 September 2004. The survey was sent to more than 7 300 individuals, 18 years of age and older, with a response rate of 1 197.
Share