"Identity theft" (or identity fraud) refers to fraud effectuated by stealing personal identifying data, such as a credit card number or a social security number, often by means of computer hacking or by emails in which the sender impersonates an individual, firm, or agency that has a legitimate need for the identifying data. Identity theft has become extremely common and is estimated to be defrauding Americans of a total of more than $50 billion a year. This is an understatement of the social costs of identity theft because victims often must spend hundreds of hours restoring their credit. Maximum punishments are severe, but the garden-variety identity theft is not heavily punished relative to potential gains. For example, an identity thief who steals $1 million and has no previous criminal record is (if prosecuted for violating federal fraud law) likely to receive a prison sentence of less than five years, except that as a result of the recently enacted Identity Theft Penalty Enhancement Act another two years will be tacked on.
The economic theory of punishment teaches that, at least as a first approximation, the expected cost of the fine or other punishment for crime should just exceed the expected gain to the criminal from committing the crime, in order to make it worthless to him. If we are not completely confident about what the gain from the crime is likely to be (or if we think some crimes, like breaking into an unoccupied vacation house in a snowstorm, should not be deterred, we may want to base the sentence on the victim's loss instead of the perpetrator's gain. In the usual case of identity theft, the loss to the victim will exceed the gain to the thief, because the time costs to the victim are not recouped in any form by the thief. Oddly to a noneconomist, those costs, together with the costs of efforts by potential victims of identity theft to avoid becoming actual victims and the costs incurred by the identity thieves themselves to accomplish their thefts, are the real social costs of identity theft. The mere transfer of wealth from victim to thief does not reduce the social product, but merely rearranges it.
The word "expected" which I used in the preceding paragraph is intended to distinguish between a certain value and a probabilistic one. The expected value of a 100 percent probability of incurring a cost of $100 is $100, but so is the expected value of a 1 percent probability of incurring a cost of $10,000 ($100 = .01 X $10,000). If the probability of apprehending and punishing an identity thief is very low, the punishment will have to be jacked up very high in order to deter. Suppose an identity thief who sends out 100,000 "phishing" emails (impersonating persons or firms who would have a legitimate need for access to the recipient's personal identifying information) anticipates a $10,000 profit. If the probability that he will be caught and punished for his fraud is 1 percent, then a fine slightly in excess of $1 million would be necessary to deter him. Probably he could not pay such a fine, and so a prison sentence would have to be substituted, designed to impose the equivalent disutility on him.
My guess is that very few identity thiefs are caught, and also that many of them make a lot more than $10,000 per fraud, given such techniques as phishing that enable a fraudulent solicitation to be disseminated essentially without cost to an immense number of potential victims; if even a minute percentage of the recipients are hooked, the identity thief can make a killing. If this analysis is correct, the optimal punishment for identity theft is extremely heavy; it might well be life in prison.
Any proposal for punishment that strict would encounter a variety of objections--all superficial. The first is that punishment should be proportional to the gravity of the crime, in the sense of the cost that the crime imposes on the victim. By this criterion, bank robbery is a more serious crime than identity theft (and in fact is punished much more severely) because it frightens and sometimes endangers the bank's employees (only sometimes, because most bank robberies nowadays are "robbery by note"--the robber gives the teller a note saying that he is armed, but he isn't). But bank robbery is actually a sucker's crime; almost all bank robbers are caught because of a combination of surveillance cameras and the money packs that tellers are instructed to give robbers, which explode after a few minutes, covering the robber with indelible ink. Moreover, it is only because crimes that create a risk of physical injury are treated as categorically more serious than white-collar crimes that bank robbery is deemed a more serious offense than identity theft. Probably identity theft is a greater social problem (the average bank robbe's take per robbery is only $7,000), and, even if it is not, almost certainly it should be punished more severely because the probability of apprehension and punishment is much lower than in the case of bank robbery.
Nor would we have to worry, as we do with many crimes, that making the punishment for a particular crime very severe may increase the incidence of a more severe crime--may in other words impair "marginal deterrence." That is the policy of imposing heavier punishments for more serious crimes not because the punishment must fit the crime in a retributive (eye for an eye) sense, but in order to deter the substitution of more serious crimes for less serious ones. Were robbery punished as heavily as murder, robbers would have a greater incentive to murder their victims because that would reduce the probability of punishment (by eliminating witnesses) without increasing its severity. It is difficult to imagining identity thieves substituting more serious crimes for identity theft.
A further argument against severe punishment is that identity theft is easily prevented by potential victims, and it is less costly to society for them to take their own precautions than for the taxpayer to pay for more prisons. There are two fallacies here. The first is the assumption that increasing the length of prison sentences increases the number of prisoners. That depends on the responsiveness of potential criminals to a higher expected cost of punishment. If it is high, then an increase in punishment may reduce the number of prisoners by increasing deterrence by a greater percentage than the added length of the sentence. (Below I argue that it is likely to be high in the case of identity theft.)
The second fallacy is to disregard the heavy aggregate costs of self-protection against identity theft. Everyone who has a credit card or social security number or other personal identifying information (which is to say everyone), and in addition has some financial resources, is a potential victim of identity theft. Among this large group of people, all who are cautious will take some steps to prevent identity theft, as will the custodians of their personal identifying information. These costs, which would be avoided if identity theft could be stamped out, must be compared with the costs of increasing the punishment of identity thieves. Those costs might be slight if the threat of heavier punishment had such a strong deterrent effect that the threat had rarely to be carried out.
A reason to expect a more than average responsiveness of crime to punishment in the case of identity theft is that identity thieves tend to be educated people, or at least to have pretty good technical skills. Educated people tend to have low discount rates because education entails deferral of earning. And people with low discount rates are more responsive to increased prison terms, which involve adding years at the end of the existing term. A person with a very high discount rate might not be deterred when his expected sentence for committing some crime increased from 20 years to 25 years, but a person with a low discount rate might consider that extra five years a significant present cost (that is, after discounting to present value--the lower the discount rate, the higher the present value of a future stream of costs or earnings). Moreover, an educated person is likely to have superior legitimate alternatives to crime than an uneducated person; and the closer a substitute a legitimate earning opportunity is for earnings for crime, the less the expected earnings from crime need be reduced by increased punishment in order to induce the substitution. This is the other side of my earlier point about marginal deterrence.