Online and Terrestrial Identity Theft: A Comparison of Victims and Examination of Reporting Decisions Across Modalities

Abstract

The current study examines whether identity theft that occurs online differs from terrestrial identity theft, and the correlates of reporting across modalities. Findings from two samples (online n = 1,087; terrestrial n = 371) from the 2016, 2018, and 2021 waves of the National Crime Victimization Survey’s Identity Theft Supplement indicate that terrestrial identity theft led to greater levels of distress and financial losses than online identity theft, and was more often reported to police. Multivariate findings indicate that distress levels and knowledge of the person who committed the offense were positively associated with odds of reporting online identity theft, but not terrestrial identity theft. The article highlights the importance of acknowledging the modality of identity theft, and offers suggestions for policy.

Keywords

crime reporting cybercrime fraud identity theft reporting victim decision making victimization

Identity theft refers to the misuse of another’s identifying information for a range of criminal purposes, including accessing financial accounts, creating new accounts, or for other fraudulent purposes, such as attaining employment or government benefits (Harrell, 2023; Hu et al., 2023). According to Harrell (2023), approximately 9% of Americans aged 16 and older have experienced some form of identity theft, resulting in more than $16 billion USD in losses. Beyond this, identity theft also results in several nonfinancial consequences, such as feelings of distress, depression, and anxiety (G. Golladay & Holtfreter, 2017; Randa & Reyns, 2020).

Harrell (2023) notes that only approximately 7% of identity theft experiences were reported to police in 2021, and that the majority of victims of identity theft instead sought to address their experiences in some other way, such as contacting a credit organization or bank. This is significant, as the victim’s decision to report their experiences to police is often the catalyst to any subsequent criminal justice involvement (Gottfredson & Gottfredson, 1987). Additionally, reporting of one’s experiences to law enforcement is often a prerequisite for reimbursement claims and removal of fraudulent charges (Federal Trade Commission, n.d.).

While works examining identity theft more generally (Hu et al., 2023; Reyns & Henson, 2016), as well as works examining identity theft reporting decisions (Betz-Hamilton, 2023; K. A. Golladay, 2017; van de Weijer et al., 2020) have proliferated in recent years, two noteworthy oversights exist in the literature. First, works have failed to examine the extent to which identity theft occurs online or via terrestrial means, and how these experiences might differ across modalities. While a range of studies have disaggregated between various outcomes of identity theft (e.g., misuse of existing credit accounts, creation of new accounts; Burnes et al., 2020, it remains an open empirical question whether those who are victims of online forms of identity theft—such as the compromise of another’s identity via malware or accessing their computer—are similar in terms of individual characteristics or offense characteristics to victims of terrestrially identity theft, such as the compromise of one’s identity by stealing physical documents from one’s home or trash (Milne, 2003). Research suggests that other crimes which can take place across modalities have important differences. For instance, Nobles et al. (2014) suggest that online and offline stalking experiences vary significantly in terms of contact with the person who committed the offense and consequences suffered. Further, research suggests that offline bullying experiences vary significantly from cyberbullying bullying (Graf et al., 2022; Ybarra et al., 2012). Correspondingly, it is possible that the failure to disaggregate between modalities of identity theft may cloud understandings of lived experiences of victims, and may result in policies that are ineffective or fail to reach populations most affected by these experiences.

Second, while works have examined how identity theft reporting behaviors vary by type of identity theft outcome (Reyns & Randa, 2017), how modality of identity theft shapes reporting to law enforcement remains an open empirical question. It may be that the prevalence and correlates of reporting varies across modalities, due to differences in victim perceptions of the seriousness of the offense, knowledge of the person who committed the offense, or characteristics of the victimization experience itself (Gottfredson & Gottfredson, 1987). For instance, victims of online identity theft perceive the experience as less distressing, given the lack of physical convergence between those who commit the offense and the victims’ identifying information, resulting in decreased odds of reporting. Conversely, it may be that terrestrial identity theft is perceived as more serious due to the physical convergence between victims’ information and those who commit the offense, and is thus more likely to be reported (Cohen & Felson, 1979). Failure to consider how this convergence shapes reporting may lead to ineffective policies that potentially result in persistent underreporting of identity theft leading to recurrent victimization, heightened levels of distress, and undermined efforts to recover from victimization (Federal Trade Commission, n.d.). Further, understandings of how physical convergence implicit within terrestrial identity theft influences victimization seriousness will allow for deeper understandings of how physical convergence and lifestyle routines influences victimization consequences (Cohen et al., 1981).

The current study employs two samples of victims of identity theft drawn from the 2016, 2018, and 2021 waves of the National Crime Victimization Survey’s Identity Theft Supplement (NCVS-ITS; online n = 1,087; terrestrial n = 371). First, the study aims to examine how these modalities of identity theft vary in terms of victim and offense characteristics. Second, the study tests Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making to examine the correlates of reporting decisions among victims of identity theft across samples. To do so, the study employs measures of the victim’s knowledge of the perpetrator as well as indicators of the seriousness of the incident derived from previous works examining Gottfredson and Gottfredson’s (1987) theory employing NCVS-ITS data (see Reyns & Randa, 2017).

Identity Theft: Characteristics and Consequences

Prior work examining the correlates of identity theft victimization offer several insights into the nature of this common and costly crime. For instance, Burnes et al. (2020) analysis of risk and protective factors of different forms of identity theft (e.g., existing financial account-based fraud; new account-based fraud) found that certain behaviors such as online shopping were associated with elevated with risk of identity theft, while certain protective behaviors such as changing passwords and shredding documents were protective—findings echoed by other works (Maher, 2024; Reyns, 2013; Reyns & Henson, 2016). Importantly, this study did not disaggregate between online and terrestrial modalities of identity theft, leaving whether these findings are similar across modalities unclear (see also Reyns & Henson, 2016). Holt and Turner’s (2012) study examined risks of online identity theft specifically, finding that protective software programs increase one’s resilience to identity theft. More recently, Williams’ (2016) analysis examined online identity theft specifically, finding a curvilinear association between social status and identity theft victimization risk that ran counter to earlier works. Despite the interest in examining online identity theft, these actions can nonetheless be perpetrated offline (Irvin-Erickson, 2024; Milne, 2003).

Literature examining post-victimization experiences offers several insights into the characteristics and consequences of identity theft victimization. First, Randa and Reyns (2020) examined the nonfinancial consequences of identity theft, finding that race, education, prior victimization, time taken to resolve identity theft, and out-of-pocket losses all influenced feelings of distress. G. Golladay and Holtfreter (2017) disaggregated between physical and emotional consequences of identity theft, finding the number of identity theft victimization experiences, income, and marital status, differentially influenced these outcomes. Importantly, these works did not delineate between online and terrestrial forms of identity theft, leaving clouded understandings of whether these factors similarly influence these outcomes following identity theft victimization. While these works have disaggregated between different identity theft outcomes such as whether one’s identity was misused to create new accounts or misuse existing credit/debit accounts, they have failed to consider whether variations exist across these dimensions in terms of modality of perpetration. Given prior works noting that other cybercrimes differ from their terrestrial counterparts (Graf et al., 2022; Nobles et al., 2014; Ybarra et al., 2012), it may be that identity theft too varies across these dimensions. While these works have disaggregated between different identity theft outcomes such as whether one’s identity was misused to create new accounts or misuse existing credit/debit accounts, they have failed to consider whether variations exist across these dimensions in terms of modality of perpetration. Given prior works noting that other cybercrimes differ from their terrestrial counterparts (Graf et al., 2022; Nobles et al., 2014; Ybarra et al., 2012), it may be that identity theft too varies across these dimensions.

Victim Reporting Behaviors

A victim’s decision to report their experiences to law enforcement often serves as a crucial first step for any subsequent criminal justice efforts (Randa & Reyns, 2020). Despite this, works have noted that a substantial portion of victims often do not report their experiences to law enforcement (K. A. Golladay, 2017; Harrell, 2023), particularly as it relates to identity theft.

Reporting decisions of identity theft victims

Harrell (2023) notes that across all victims, including both those whose identities were stolen online and terrestrially, only 7% of identity theft victims nationally reported their experiences to police in 2021. K. A. Golladay’s (2017) analysis of the 2012 NCVS-ITS found that approximately 18% of victims of identity theft reported their experiences to law enforcement, while van de Weijer et al.’s (2020) findings from a Dutch sample indicate that 26.3% of victims of identity theft reported their experiences to police. Reyns and Randa’s (2017) study of the 2012 NCVS-ITS disaggregated between types of identity theft outcomes experienced, finding that 6% of victims of credit-based fraud reported their experiences, relative to 12% of victims of bank fraud, and 33% of victims whose identity theft led to the creation of new accounts.

In explaining the limited reporting of identity theft, Harrell (2023) notes that a majority of victims forego reporting to law enforcement due to having handled the incident in some other way, such as by themselves or with the aid of a financial institution. Conversely, the identity of the person who committed the offense may play a role in reporting decisions. Specifically, Reyns and Randa (2017) note that 6.1% indicated they did not know the person who committed the offense. In this sense, limited reporting of identity theft may be tied to the lack of information available to victims given the “invisible” nature of these offenses (Bejan, 2022). This underreporting may stem from a range of factors, including not knowing that identity theft could be reported or perceptions that reporting would be fruitless (Graham et al., 2020). Importantly, these works did not disaggregate between online and terrestrial identity theft, leaving unclear whether these findings vary across modalities. Given the potential for identity theft to be perpetrated both online and off, it is possible that certain patterns of victimization are concentrated across modalities.

Several factors have been found to be associated with the decision to report identity theft to law enforcement. K. A. Golladay (2017) found that while persons identifying as a race other than White more likely to report identity theft relative to their peers, other sociodemographic factors were not associated with odds of reporting to police. In their study, van de Weijer et al. (2020) found that income and education were negatively associated with odds of reporting identity theft, and that those who had been previously victimized had lower odds of reporting. Reyns and Randa (2017) found that suffering an out-of-pocket loss was associated with greater odds of reporting credit- or bank-based identity theft, but was not associated with odds of reporting identity theft resulting in the creation of new accounts.

Reyns and Randa’s (2017) examination of identity theft reporting tested Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making. Gottfredson and Gottfredson (1987) note that three factors influence one’s decision to invoke criminal justice actors: (a) the seriousness of the offense, (b) if person who committed the offense had a prior criminal record, and (c) relationship between the victim and the person who committed the offense. To test this theory, Reyns and Randa (2017) considered several indicators of seriousness, including emotional distress, physical distress, the total amount taken, and total out-of-pocket losses. They found that knowledge of the person who committed the offense’s identity was associated with reporting of identity theft, and factors reflecting the seriousness of the offense were associated with reporting. Importantly, the works discussed above—as well as the body of literature examining identity theft reporting more generally—do not delineate between identity theft modalities, such as whether the victimization occurred online or terrestrially. In this sense, it may be that offline victimization is more often reported due to variations in the perceived seriousness of the offense, or differences in the victimization consequences relative to online identity theft. Specifically, it may be that terrestrial identity theft is perceived as more serious due to the physical convergence (Cohen & Felson, 1979), or result in greater losses to victims who can suffer repeated misuse of their identities as a consequence of terrestrial identity theft.

Current Study

The current study examines (a) the characteristics of online and terrestrial identity theft victimization experiences, as well as (b) reporting decisions among victims of identity theft across modalities. The study seeks to determine whether the characteristics of identity theft experiences are consistent in terms of victim characteristics, victimization experiences, and consequences of victimization. Further, the study examines whether Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making explains reporting across identity theft modalities. Accordingly, the study offers the following hypotheses:

H₁: Terrestrial identity theft will be reported less and have greater consequences than online identity theft.

H_2a: Factors relating to the seriousness of the offense, such as levels of distress experienced and amount lost, will be positively associated with odds of reporting online and terrestrial identity theft.

H_2b: Knowing the identity of the person who committed the offense will be negatively associated with odds of reporting online and terrestrial identity theft.

Additionally, the study seeks to examine whether the correlates of identity theft reporting are consistent across online and terrestrial modalities. Accordingly, the following research question is examined:

RQ₁: Do the coefficients of correlates for reporting identity theft vary between online and terrestrial victimization?

Method

Participants

To examine the differences in online and terrestrial identity theft and the correlates of reporting across modalities, the current study uses data from the 2016 (total N = 96,130), 2018 (total N = 102,418), and 2021 (total N = 93,308) waves of the NCVS-ITS, the most recent waves of the identity theft supplement. The identity theft supplement is administered to core NCVS recipients aged 16 and older, to examine a range of themes relating to identity theft, including the prevalence of victimization, the consequences associated with these experiences, and victim reporting behaviors (NCVS-ITS, 2018a, 2018b, 2021). Given the supplemental nature of the NCVS-ITS, data are cross-sectional.

To determine the nature of online and terrestrial identity theft and to examine the correlates of reporting across modalities, the study derives two samples: (a) online identity theft victims and (b) terrestrial identity theft victims. Persons identified as victims of identity theft were stratified by the nature through which their identities were compromised in their most recent identity theft victimization experience. Once identified as victims of identity theft, subjects were asked how they believed their identity had been compromised in their most recent identity theft victimization experience. Within the 2016 wave of the NCVS-ITS, the following means of identity compromise were captured: (a) I lost it and someone found it, (b) It was stolen from my wallet or checkbook, (c) It was stolen from a place where I stored it (home, office, car), (d) Someone stole it from my postal mail, (e) Someone stole it from my garbage, (f) It was stolen during an online purchase/transaction, (g) Someone stole it during an in-person purchase/transaction (including through the use of a skimmer or card reader), (h) Someone hacked into my computer, (i) I responded to a scam email/phone call, (j) Stolen from personnel files at place of employment, (k) Stolen from an office/company that had my personal information in its files, and (l) Obtained in some other way. The 2018 NCVS-ITS removed the response option Someone stole it from my garbage and added Someone with access used without permission. Response options were otherwise identical to the 2016 NCVS-ITS.¹ In the 2021 NCVS-ITS, the options were similar to those within the 2018 wave, however response options it was stolen from my postal mail and someone with access used it without my permission were not captured.

Those who reported that in their most recent identity theft experience that their identity had been compromised by (a) having physical lost their identifying information, (b) having information stolen from a wallet or checkbook, (c) having information stolen from a place where it was stored were considered as identity theft that was terrestrial in nature, given that all of these experiences occurred in-person and without the aid of Internet-capable technologies. Conversely, those who reported that their identity had been compromised through (a) an online purchase or transaction, (b) through an in-person transaction via card skimmer,² or (c) through a responding to a scam email or phone call consistent with phishing or vishing attacks were identified as online identity theft.³ Importantly, the method used to delineate between these samples relies on victims’ assessments of how they think their identities were compromised.⁴ Accordingly, the exact nature of how victims’ identities were compromised may vary from their perception, a theme discussed in the limitations section below.⁵ Given that relatively few victims of identity theft were able to identify the means by which their identities were stolen, three waves were combined to ensure adequate sample sizes (online n = 1,087; terrestrial n = 371). In so doing, the study will examine how these samples differ in terms of victims, victimization characteristics, and consequences, as well as whether the correlates of reporting identity theft to police are consistent across modalities.

Measures

Dependent variable

The dependent variable of the current study is whether subjects reported to police. Specifically, respondents were asked Did you contact any law enforcement agencies, such as the local police, a sheriff or a federal law enforcement agency, to report (the most recent/the) misuse or attempted misuse of your personal information? Responses were coded dichotomously (0 = Did not report to law enforcement; 1 = Reported to law enforcement).

Independent variables

Several independent variables are included within the study as operationalizations of Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making. Primarily, to reflect the seriousness of the offense, five measures were considered, based upon prior literature testing Gottfredson and Gottfredson’s (1987) theory using data from the NCVS-ITS (see Reynolds, 2022; Reyns & Randa, 2017). First and in line with Reyns and Randa’s (2017) analysis, distress reflects subjects’ feelings following identity theft (0 = Not at all distressing; 1 = Mildly distressing; 2 = Moderately distressing; 3 = Severely distressing).

Second, seriousness of the event was gauged by whether subjects had felt any emotional symptoms associated with their victimization. Respondents were asked to identify whether they had experience any of eight symptoms of emotional distress: (a) worry or anxiety, (b) anger, (c) sadness or depression, (d) feelings of vulnerability, (e) feelings of having been violated, (f) an inability to trust others, (g) feeling unsafe, or (h) some other form of emotional distress not reflected in the above. While each item was coded dichotomously within the NCVS-ITS, an aggregated measure of the foregoing items was created as a means of assessing the breadth of emotional distress symptoms experienced by summing the scores from each item (0 = No emotional distress; 8 = All 8 forms of emotional distress). Third, the study considers whether subjects had experienced any physical symptoms in the wake of identity theft. Respondents were asked whether they had experienced: (a) headaches, (b) trouble sleeping, (c) changes to eating or drinking habits, (d) upset stomach, (e) fatigue, (f) high blood pressure, (g) muscle tension or back pain, or (h) some other form of physical distress. A single item was created through summing the foregoing eight items (0 = No physical symptoms; 8 = All 8 forms of physical distress).⁶ Finally, an indicator of prior victimization was considered (0 = No; 1 = Yes).

Additionally, two measures gauging the financial severity of identity theft were included. First, total taken reflects the total amount of money taken by the individual who committed the offense. Responses were measured continuously. Further, Total losses reflects the actual out-of-pocket losses incurred by victims as a consequence of identity theft. Responses were coded continuously.

In addition, a measure reflecting the subjects’ relationship to the person who compromised the victim’s identity was included. Specifically, respondents were asked Do you know, or have you learned, anything at all about (the most recent/the) person or person(s) who misused or attempted to misuse your personal information? Responses were coded dichotomously (0 = No; 1 = Yes).

Four items were included to reflect characteristics of the victimization experience based upon prior literature (Reyns & Randa, 2017). First, an indicator of whether subjects had resolved identity theft experiences was considered (0 = No; 1 = Yes). Second, the amount of time one’s identity was misused was considered, with responses coded ordinally: (a) One day or less (1–24 hours); (b) More than a day, but less than a week (25 hours–6 days); (c) At least a week, but less than one month (7–30 days); (d) One month to less than three months; (e) Three months to less than six months; (f) Six months to less than a year; (g) One year or more. Third, Contact bank is included (0 = No; 1 = Yes). Finally, Contact bureau is included (0 = No; 1 = Yes).

Control variables: Individual characteristics

Several control variables rooted in individual characteristics are considered based on prior works (K. Golladay & Holtfreter, 2017; Reyns & Henson, 2016). First, Age was measured in years, while Education was measured through an ordinal scale (0 = less than high school; 1 = high school; 2 = Some college (including associate degree); 3 = Bachelor’s degree; 4 = Master’s degree; 5 = Professional degree; 6 = Doctorate degree). Income was measured through a series of categories grouped in $9,999 and $24,999 intervals, ranging from incomes of $0 to $9,999 annually to annual incomes in excess of $75,000 USD. Marital status was measured through a single item (0 = Not married; 1 = Married), as was Race (0 = White; 1 = Person of color) and Sex (0 = Female; 1 = Male).

Procedure

To examine whether victims and victimization characteristics for online and terrestrial identity theft fundamentally differ, bivariate statistics comparing these factors across samples were examined. Second, multivariate models were estimated to examine whether Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making is applicable across online and terrestrial modalities of identity theft. Given that the dependent variable is binary, logistic regression was determined as the appropriate multivariate technique. Analyses were conducted via complete case analysis, consistent with prior analyses of the NCVS-ITS (Reyns & Randa, 2017),⁷ as well as findings suggesting alternative techniques for addressing missingness may be inappropriate.⁸ Prior to conducting analyses, data were tested for multicollinearity by examination of variance inflation factor (VIF) values. No mean VIF value exceeded 1.33 within the study. To facilitate comparison of effects across models, the same series of predictor variables were thus employed to assess reporting of online and terrestrial identity theft. Coefficient comparisons were estimated to examine effects across samples. These are described below.

Results

Univariate and Bivariate Findings

Univariate statistics and differences across samples are in Table 1. First and most notably, 10.40% of persons who experienced an online form of identity theft contacted law enforcement following victimization (n = 113), relative to nearly 46% of those who experienced terrestrial identity theft (n = 169). Findings from balancing tests across samples indicate that the difference in reporting across samples varies to a statistically significant degree ( $χ^{2}$ = 219.14; p < .001).

Table 1.

Descriptive Statistics and Balancing Test Across Samples.

Variable	Model 1: online identity theft (n = 1,087)			Model 2: terrestrial identity theft (n = 371)			Balancing tests
Variable	n (%)	Mean (SD)	Min.; max.	n (%)	Mean (SD)	Min.; max.	t (χ²)
Dependent variable
Reported to police	113 (10.40)			169 (45.55)			(219.14***)
Independent variables
Offense seriousness
Distress		2.25 (0.47)	0; 3		2.40 (0.56)	0; 3	5.93***
Emotional symptoms		3.06 (2.18)	0; 8		3.58 (2.33)	0; 8	3.94***
Physical symptoms		0.46 (1.24)	0; 7		0.99 (1.81)	0; 7	6.26***
Total taken		920.01 (1,978.62)	2; 20,000		1,798.04 (3,552.43)	2; 20,000	5.93***
Total out-of-pocket losses		173.53 (931.62)	0; 10;000		634.53 (1,678.05)	0; 10,000	6.57***
Prior victimization	278 (25.57)			70 (18.87)			(6.85**)
Knowledge of person who compromised identity
Know who compromised identity	105 (9.66)			151 (40.70)			(184.11***)
Offense characteristics
Resolved identity theft	981 (90.25)			311 (83.83)			(11.30**)
Time identity misused		0.88 (1.09)	0; 6		1.08 (1.44)	0; 6	2.82**
Contact bank	1,054 (96.96)			343 (92.45)			(14.04***)
Contact Bureau	100 (9.20)			57 (15.36)			(10.94***)
Control variables
Age		50.25 (16.22)	17		47.82 (17.50)	16	2.43*
Education		2.38 (1.26)	0		2.17 (1.37)	0	−2.79**
Income		4.60 (1.74)	0		4.07 (1.98)	0	−4.86***
Marial status (1 = married)	616 (56.67)			154 (41.51)			(25.51***)
Race (1 = person of color)	154 (14.17)			93 (25.07)			(23.35***)
Sex (1 = male)	415 (38.18)			131 (35.31)			−0.97
Year
2016	461 (42.41)			161 (43.40)			−0.17
2018	385 (35.42)			127 (34.23)
2021	241 (22.17)			83 (22.37)

Note. SD = standard deviance; Min. = minimum observed value; Max. = maximum observed value. t-tests are two-tailed.

p < .05. **p < .01. ***p < .001.

Levels of distress significantly varied across samples (t = 5.93; p < .001). Further, the presence of emotional symptoms varied significantly across samples (t = 3.94; p < .001), as did symptoms of physical distress (t = 6.26; p < .001). Beyond this, victims of online identity theft had approximately $920 taken on average, relative to $1,798 among victims of terrestrial identity theft (t = 5.93; p < .001). Victims of online identity theft suffered approximately $173 in out-of-pocket losses, relative to approximately $634 among terrestrial identity theft victims (t = 6.57; p < .001). More than one in four victims of online identity theft had a prior victimization experience, relative to approximately 19% of victims of terrestrial identity theft ( $χ^{2}$ = 6.85; p < .01), and approximately 10% of victims of online identity theft knew the person in some way, relative to more than 40% of victims of terrestrial identity theft ( $χ^{2}$ = 184.11; p < .001).

Roughly 90% of victims of online identity theft were able to resolve their experiences, relative to 83.83% of victims of terrestrial identity theft ( $χ^{2}$ = 11.30; p < .01). More than 95% of victims of online identity theft indicated that they contacted a financial institution following victimization, relative to roughly 92% of terrestrial identity theft victims ( $χ^{2}$ = 14.04; p < .001). Roughly 9% of victims of online identity theft reported contacting a credit bureau following their experiences, relative to roughly 15% of victims of terrestrial identity theft ( $χ^{2}$ = 10.94; p < .001).

Multivariate Findings

To address the remaining hypotheses, stratified logistic regression analyses were estimated, considering online and terrestrial identity theft, respectively. Model 1 of Table 2 examines the correlates of online identity theft relating to H_2a and H_2b (n = 1,087; $χ_{(19)}^{2}$ = 111.54; p < .001). Concerning the seriousness of the offense, findings indicate that distress is positively associated with odds of reporting identity theft to police (Odds Ratio [OR] = 1.69; p < .05), as was the breadth of emotional distress symptoms experienced (OR = 1.15; p < .05). Those who knew the person who compromised their identity to some degree had 86% greater odds of reporting their online identity theft experiences relative to those who did not (OR = 1.86; p < .05). Beyond this, having contacted a credit bureau following online identity theft was associated with greater odds of reporting than those who had not contacted a credit bureau (OR = 3.07; p < .001). None of the individual characteristics were significantly associated with odds of reporting identity theft. Overall, these findings lend mixed support to H_2a but not H_2b, and suggest that while the seriousness of the offense was positively associated with reporting, those with knowledge of the person who stole their identity had greater odds of reporting.

Table 2.

Logistic Regression Analyses for Online and Terrestrial Identity Theft (n = 1,087; 371).

Variable	Model 1: online identity theft (n = 1,087)		Model 2: terrestrial identity theft (n = 371)
Variable	OR	95% CI for OR	OR	95% CI for OR
Offense seriousness
Distress	1.69*	[1.06, 2.69]	1.33	[0.85, 2.07]
Emotional symptoms	1.15*	[1.02, 1.30]	0.99	[0.88, 1.11]
Physical symptoms	1.06	[0.90, 1.25]	0.96	[0.82, 1.12]
Total taken	1.00	[1.00, 1.00]	1.00*	[1.00, 1.00]
Total out-of-pocket losses	1.00**	[1.00, 1.00]	1.00	[1.00, 1.00]
Prior victimization	1.04	[0.63, 1.71]	0.68	[0.37, 1.25]
Knowledge of person who compromised identity
Know who compromised identity	1.86*	[1.00, 3.47]	1.27	[0.78, 2.09]
Offense characteristics
Resolved identity theft	0.72	[0.38, 1.36]	0.71	[0.36, 1.41]
Time identity misused	0.99	[0.82, 1.19]	0.74**	[0.61, 0.89]
Contact bank	1.56	[0.46, 5.31]	2.11	[0.84, 5.28]
Contact bureau	3.07***	[1.76, 5.36]	3.93***	[1.96, 7.88]
Control variables
Age	1.00	[0.99, 1.01]	0.99	[0.98, 1.01]
Education	1.16	[0.97, 1.39]	1.00	[0.83, 1.21]
Income	0.93	[0.81, 1.07]	1.09	[0.95, 1.24]
Marial status	1.24	[0.77, 2.00]	1.20	[0.74, 1.96]
Race	1.16	[0.65, 2.06]	1.09	[0.63, 1.88]
Sex	1.45	[0.93, 2.25]	0.67	[0.42, 1.09]
Year
2018	1.57	[0.98, 2.52]	0.95	[0.57, 1.59]
2021	0.74	[0.39, 1.39]	0.54	[0.29, 1.02]
Constant	0.01***		0.33
Model χ²	111.54***		63.36***
Nagelkerke R²	.20		.21

Note. OR = odds ratios; CI = confidence intervals.

p < .05. **p < .01. ***p < .001.

To address H_2a and H_2b, model 2 of Table 2 provides multivariate findings relating to reporting of terrestrial identity theft (n = 371; $χ_{(19)}^{2}$ = 63.36; p < .001). In contrast to model 1, levels of distress were not significantly associated with odds of reporting terrestrial identity theft to police. Further in contrast to findings from model 1, knowledge of the person who stole the victim’s identity was not associated with odds of reporting terrestrial identity theft to police. Concerning offense characteristics, whether one had resolved their identity theft experiences was not associated with odds of reporting. Additionally, findings indicate that a one-unit increase in the amount of time one’s identity had been compromised was associated with a 26% reduction in odds of reporting terrestrial identity theft (OR = 0.74; p < .01). Contacting a credit bureau was associated with greater odds of reporting terrestrial identity theft to police (OR = 3.93; p < .001). Taken together, findings run counter to H_2a and H_2b.

To examine RQ₁, Coefficient comparison tests of models I and II were undertaken. Findings suggested that associations between the time one’s identity was misused before discovery and contacting police significantly varied across samples. This finding is unsurprising, given that time to discover identity theft was significantly associated with reporting as it related to terrestrial identity theft, but not online identity theft. Further, the association between one’s sex and contacting police significantly varied across modalities of identity theft. Again, this conforms with expectations given that the directionality of these associations varies across models, albeit lacking statistical significance. Taken together, these findings support RQ₁, and suggest that the correlates of identity theft differ across modalities.

Discussion

Interpretation of Findings

The current study examined whether modality of identity theft victimization varies in terms of victim characteristics, post-victimization consequences, and a range of other factors, to determine if these offenses are distinct phenomena. Further, the study sought to extend earlier works examining identity theft victim’s decisions to report their experiences to law enforcement, to determine whether theories of criminal justice decision making apply across these contexts. Described in the following section are key findings, and interpretations based on prior literature.

First, relating to H₁, findings indicate that terrestrial identity theft is reported to law enforcement far more frequently than online identity theft. It may be that online identity theft is reported less frequently due to the “invisible” nature of these offenses, which occur online and are not characterized by convergence of victims with the person who takes their information (Bejan, 2022). Conversely, terrestrial identity theft often involves a contemporaneous act characterized the physical convergence of individuals and the victims’ information, such as taking from one’s trash, mail, or wallet (Milne, 2003). In this sense, variations in reporting across modalities may be attributable to the convergence required in terrestrial identity theft compared to the imperceptible nature of identity theft online. Alternatively, it may be that victims of online identity theft perceive police as ineffective in responding to these crimes given the online context, thus limiting reporting. Graham et al. (2020) suggest that victims report online victimization less frequently than crimes taking placed offline due to a belief that police are incapable of effectively responding to these domains. Further, Cross (2020) found that victims of online fraud underreport their experiences, due to a belief that these experiences fall outside of police jurisdiction (Cross, 2020). Further relating to H₁, findings indicated that victims of terrestrial identity theft suffered greater levels of emotional and physical distress, had their identities misused for longer on average, and suffered worse out-of-pocket losses than online identity theft victims. Collectively, these findings indicate that terrestrial identity theft may be more serious than online victimization (Gottfredson & Gottfredson, 1987). These findings are in line with prior literature examining perceptions of severity across domains (Fissell & Lee, 2023). It is possible that terrestrial identity theft is more serious on average due to the physical convergence required to access the victim’s information. That is, it may be that those who physically retain these credentials are able to engage in recurrent misuse of the victims’ identity over a longer period. Similarly, victims may feel greater levels of distress due to having physically lost their documents, a distress not felt in online victimization, where physical credentials themselves never leave the possession of the victim. Future work which is likely qualitative in nature is needed to disentangle the role that the loss of physical credentials plays in explaining severity of victimization.

Relating to H_2a and H_2b, multivariate findings indicate weak and mixed support for Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making for identity theft. While indicators of severity were positively associated with odds of reporting in line with H_2a, knowledge of who committed the offense was associated with greater odds reporting in online contexts, counter to H_2b. It may be that in online contexts, victims who do not know who compromised their identity are apprehensive to report to police, given the perception that police will be unable to respond without this information. In this sense, reporting online victimization without a known or suspected individual who committed the offense may be perceived as too futile to be beneficial for victims, and is thus foregone. As such, findings indicate that in emerging online contexts, other factors outside of those identified by Gottfredson and Gottfredson (1987) may be more useful to understand victims’ decision making. The online landscape has changed drastically since the theory was first introduced. Further work is needed to determine the applicability of this theory in online contexts and to identify what other factors influence victim decision making online.

Relating to H_2a, findings indicate that seriousness of the offense was not associated with reporting decisions for victims of terrestrial identity theft. This finding runs counter to Gottfredson and Gottfredson’s (1987) theory of decision making as well as prior works examining this theory using these data (Reyns & Randa, 2017). This suggests that the factors which influence reporting are inconsistent across modalities, and that other indicators of seriousness may influence reporting for victims of terrestrial identity theft. For instance, it may be that other factors not considered here—such as contemporaneous terrestrial victimization—influence perceptions of seriousness and thus reporting decisions. For example, persons whose personal information is stolen as part of a burglary or robbery may perceive their experience as more serious than those whose identity was stolen due to having lost their belongings. Accordingly, it may be fruitful to examine the role of contemporaneous victimization as an indicator of seriousness for terrestrial identity theft.

Concerning H_2b, findings indicated that knowledge of the person who compromised their identity was not associated with reporting of terrestrial identity theft. It may be that terrestrial identity theft committed by someone known to the victim was often done by a loved one, or romantic partner and that reporting was avoided because of the relationship. Literature examining reporting behavior in other contexts suggests that victims often avoid reporting due to fear of sanctioning. Indeed, Spencer et al.’s (2020) analysis of sexual assault reporting among college students found that survivors of these experiences were less likely to report acquaintances, friends, or romantic partners, a finding echoed elsewhere (Novisky & Peralta, 2015, potentially due to fear of retaliation or desires to help the individual avoid sanctioning. It may be that similar to sexual assault, victims of identity theft forego reporting to avoid retaliation or protect the individual, particularly when the individual who commits the offense is a loved one.

Despite this, it may be that the time-ordering of these items is undermined given the nature of the data. Specifically, the item from which the variable Know who compromised identity is based asks victims whether they know the identity of the individual, or have learned anything about that individual since their victimization. Given this, it may be equally likely that victims knew the individual prior to victimization and decided not to report, or that they learned their identity only after reporting due to debriefing from police.

An unanticipated finding within the current study was the negative association observed between the amount of time that one’s identity had been compromised and their odds of reporting terrestrial identity theft. It may be that victims believed that reporting would only be fruitful if undertaken immediately following the compromise of one’s identity, and that as longer periods of time had passed, the perception of apprehending the person who committed the offense decreases, thus reducing the likelihood of reporting. As such, public perceptions of police effectiveness may be sensitive to time elapsed. Future work may examine the interaction between time passed since the discovery of one’s victimization and one’s belief in the effectiveness of police response, to examine whether these themes influence reporting.

Research and Policy Implications

Several implications for future research and policy may be derived from the findings. First, given the importance of delineating between identity theft modality found within the current study, future research should disaggregate between online and terrestrial identity theft experiences to determine whether other factors aside from reporting decisions vary across modality. For instance, it may be that the correlates of risk vary across modality of identity theft. Alternatively, it may be that these experiences carry different consequences, both financially and non-financially.

Second, given that Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making failed to explain reporting behaviors for terrestrial identity theft, future works should seek to identify what factors not considered in this theory influence the reporting, if not the seriousness of the offense or the knowledge of the person who compromised one’s identity. It may be that a range of factors influence reporting beyond those considered by Gottfredson and Gottfredson (1987), such as the types of documentation taken, contemporaneous victimization experiences, the presence of information which may aid police investigations, or the need to file a police report for fraudulent charges to be removed from one’s account (Federal Trade Commission, n.d.).

Implications for policy may also be gleaned from the findings. Stakeholders seeking to prevent identity theft should acknowledge that victims differ across identity theft modalities. Given this, policies which fail to consider the multifaceted nature of identity theft and the varied characteristics of victims may fail to effectively reach and aid victims across groups or provide effective prevention strategies. Identity theft prevention and insurance providers may seek to provide more tailored prevention strategies for each group. For instance, it is likely that shredding documents prevents terrestrial identity theft to a much greater degree than online identity theft. Tailored policies aiming to reduce risk of terrestrial identity theft could emphasize this strategy.

Limitations

The current study has several limitations. First, only a minority of identity theft victims were able to identify how their identity had been compromised. It is possible that findings are biased by the small sample sizes employed herein. Future works alternative sources of data should be conducted to determine the robustness of these findings (Pridemore et al., 2018). Relatedly, given the nature of the data, those who experienced both modalities of identity theft over the reference period could not be identified. Specifically, respondents were asked to identify how their identity was stolen only in their most recent experience over the reference period (NCVS-ITS, 2021). It may be that victims who experienced both terrestrial and online identity theft are unique with regard to their levels of distress felt, losses suffered, or willingness to report their experiences to the police. Accordingly, future analyses should allow for clearer determination of victims who have experienced both online and terrestrial identity theft.

An additional limitation is the limited ability to measure Gottfredson and Gottfredson’s (1987) theory using the present data. Specifically, no measures of prior criminal record were captured within the NCVS-ITS, and only one measure of knowledge of the perpetrator’s identity were included in the survey. Accordingly findings are limited in that they fail to fully test the theory. Nonetheless, the study employed similar measures to earlier tests of this theory using NCVS-ITS data (see Reyns & Randa, 2017). Consequently, future work should use alternative sources of data to determine the robustness of these findings (Pridemore et al., 2018).

Additionally, measures fail to offer insights which may be important to understanding the decision-making process of identity theft victims. For instance, the variable Resolved identity theft does not identify how respondents resolved their experiences. It may be important to understand whether victims were able to resolve their identity theft with police aid or on their own, given that those who were able to resolve their experiences without police assistance may not perceive subsequent reporting to police as beneficial. Finally, it may be that identities were not compromised in the way which victims believed. As such, it may be prudent to validate victim’s perceptions of identity compromise through supplemental data to determine not only if modality of identity theft influences reporting, but also what influences a victim’s accuracy in determining how their identities had been compromised.

Conclusion

The current study makes two contributions. First, the study provides initial insights into whether identity theft, a cyber-enabled crime (Wall, 2007), fundamentally differs across online and terrestrial modalities in terms of victim characteristics and victimization experiences. Second, the study examines identity theft reporting decisions across online and terrestrial modalities to determine whether Gottfredson and Gottfredson’s (1987) theory of criminal justice decision making is applicable across modalities. Findings indicate that online and terrestrial identity theft fundamentally differ across many factors. Future work should acknowledge the modality of identity theft when examining risk factors and decision making.

Footnotes

Declaration of Conflicting Interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The author(s) received no financial support for the research, authorship, and/or publication of this article.

ORCID iD

Cooper A. Maher

Notes

Author Biography

Cooper A. Maher is a PhD student in the School of Criminal Justice at the University of Cincinnati. His research interests center upon fear of crime, cybercrime, victimization trends, and victim decision making.

References

Ali

Surendran

Thomas

(2017). The effects of cyber threats on customer’s behaviour in e-banking services. International Journal of e-Education, e-Business, e-Management and e-Learning, 7(1), 70–78. https://doi.org/10.17706/ijeeee.2017.7.1.70-78

Bejan

(2022). Cybersecurity and cybercrime: Challenges of an invisible space. Perspectives of Law and Public Administration, 11(1), 5–10.

Betz-Hamilton

(2023). Reporting behaviors of familiar identity theft victims: An empirical test of Black’s theory of law. Journal of Financial Crime, 30(4), 1055–1065. https://doi.org/10.1108/JFC-04-2022-0085

Burnes

DeLiema

Langton

(2020). Risk and protective factors of identity theft victimization in the United States. Preventive Medicine Reports, 17, 101058. https://doi.org/10.1016/j.pmedr.2020.101058

Butkovic

Mrdovic

Uludag

Tanovic

(2019). Geographic profiling for serial cybercrime investigation. Digital Investigation, 28, 176–182. https://doi.org/10.1016/j.diin.2018.12.001

Cohen

L. E.

Felson

(1979). Social change and crime rate trends: A routine activity approach. American Sociological Review, 44(1), 588–608.

Cohen

L. E.

Kluegel

J. R.

Land

K. C.

(1981). Social inequality and predatory criminal victimization: An exposition and test of a formal theory. American Sociological Review, 46(5), 505–524. https://doi.org/10.2307/2094935

Cross

(2020). ‘Oh we can’t actually do anything about that’: The problematic nature of jurisdiction for online fraud victims. Criminology & Criminal Justice, 20(3), 358–375. https://doi.org/10.1177/1748895819835910

Federal Trade Commission. (n.d.). Identity theft. https://consumer.ftc.gov/features/identity-theft

10.

Fissel

E. R.

Lee

J. R.

(2023). The cybercrime illusion: Examining the impact of cybercrime misbeliefs on perceptions of cybercrime seriousness. Journal of Criminology. Advance online publication. https://doi.org/26338076231174639

11.

Golladay

K. A.

(2017). Reporting behaviors of identity theft victims: An empirical test of Black’s theory of law. Journal of Financial Crime, 24(1), 101–117. https://doi.org/10.1108/JFC-01-2016-0010

12.

Golladay

Holtfreter

(2017). The consequences of identity theft victimization: An examination of emotional and physical health outcomes. Victims & Offenders, 12(5), 741–760. https://doi.org/10.1080/15564886.2016.1177766

13.

Gottfredson

M. R.

Gottfredson

D. M.

(1987). Decision making in criminal justice: Toward the rational exercise of discretion (Vol. 3). Springer Science & Business Media.

14.

Graf

Yanagida

Runions

Spiel

(2022). Why did you do that? Differential types of aggression in offline and in cyberbullying. Computers in Human Behavior. Advance online publication. https://doi.org/10.1016/j.chb.2021.107107

15.

Graham

Kulig

T. C.

Cullen

F. T.

(2020). Willingness to report crime to the police: Traditional crime, cybercrime, and procedural justice. Policing: An International Journal, 43(1), 1–16. https://doi.org/10.1108/PIJPSM-07-2019-0115

16.

Harrell

(2023). Victims of identity theft, 2021: Summary. US Department of Justice. https://bjs.ojp.gov/document/vit21.pdf

17.

Holt

T. J.

Turner

M. G.

(2012). Examining risks and protective factors of on-line identity theft. Deviant Behavior, 33(4), 308–323. https://doi.org/10.1080/01639625.2011.584050

18.

Lee

J. S.

Lovrich

N. P.

(2023). Do commonly recommended preventive actions deter identity theft victimization? Findings from NCVS identity theft surveys. Journal of Crime and Justice, 46(2), 172–193. https://doi.org/10.1080/0735648X.2022.2103015

19.

Irvin-Erickson

(2024). Identity fraud victimization: A critical review of the literature of the past two decades. Crime Science, 13(1), 3. https://doi.org/10.1186/s40163-024-00202-0

20.

Little

R. J.

(1988). A test of missing completely at random for multivariate data with missing values. Journal of the American statistical Association, 83(404), 1198–1202.

21.

Maher

C. A.

(2024). Examining the association between citizenship and ethnicity on identity theft risk: Findings from the National Crime Victimization Survey. American Journal of Criminal Justice. Advance online publication. https://doi.org/10.1007/s12103-024-09759-7

22.

Milne

G. R.

(2003). How well do consumers protect themselves from identity theft? Journal of Consumer Affairs, 37(2), 388–402. https://doi.org/10.1111/j.1745-6606.2003.tb00459.x

23.

National Crime Victimization Survey: Identity Theft Supplement, [United States]. (2018a). Identification No. 36829.

24.

National Crime Victimization Survey: Identity Theft Supplement, [United States]. (2018b). Identification No. 37923.

25.

National Crime Victimization Survey: Identity Theft Supplement, [United States]. (2021). Identification No. 38501.

26.

Nobles

M. R.

Reyns

B. W.

Fox

K. A.

Fisher

B. S.

(2014). Protection against pursuit: A conceptual and empirical comparison of cyberstalking and stalking victimization among a national sample. Justice Quarterly, 31(6), 986–1014. https://doi.org/10.1080/07418825.2012.723030

27.

Novisky

M. A.

Peralta

R. L.

(2015). When women tell: Intimate partner violence and the factors related to police notification. Violence Against Women, 21(1), 65–86. https://doi.org/10.1177/1077801214564078

28.

Pridemore

W. A.

Makel

M. C.

Plucker

J. A.

(2018). Replication in criminology and the social sciences. Annual Review of Criminology, 1, 19–38. https://doi.org/10.1146/annurev-criminol-032317-091849

29.

Randa

Reyns

B. W.

(2020). The physical and emotional toll of identity theft victimization: A situational and demographic analysis of the National Crime Victimization Survey. Deviant Behavior, 41(10), 1290–1304. https://doi.org/10.1080/01639625.2019.1612980

30.

Reynolds

(2022). Identity theft victims’ understandings of incidents and their reporting decisions [Doctoral dissertation]. University of Guelph.

31.

Reyns

B. W.

(2013). Online routines and identity theft victimization: Further expanding routine activity theory beyond direct-contact offenses. Journal of Research in Crime and Delinquency, 50(2), 216–238. https://doi.org/10.1177/0022427811425539

32.

Reyns

B. W.

Fisher

B. S.

Bossler

A. M.

Holt

T. J.

(2019). Opportunity and self-control: Do they predict multiple forms of online victimization? American Journal of Criminal Justice, 44(1), 63–82. https://doi.org/10.1007/s12103-018-9447-5

33.

Reyns

B. W.

Henson

(2016). The thief with a thousand faces and the victim with none: Identifying determinants for online identity theft victimization with routine activity theory. International Journal of Offender Therapy and Comparative Criminology, 60(10), 1119–1139.

34.

Spencer

Stith

Durtschi

Toews

(2020). Factors related to college students’ decisions to report sexual assault. Journal of Interpersonal Violence, 35(21–22), 4666–4685. https://doi.org/10.1177/0886260517717490

35.

van de Weijer

Leukfeldt

Van der Zee

(2020). Reporting cybercrime victimization: Determinants, motives, and previous experiences. Policing: An International Journal, 43(1), 17–34. https://doi.org/10.1108/PIJPSM-07-2019-0122

36.

Wall

(2007). Cybercrime: The transformation of crime in the information age. Polity.

37.

Williams

M. L.

(2016). Guardians upon high: An application of routine activities theory to online identity theft in Europe at the country and individual level. British Journal of Criminology, 56(1), 21–48. https://doi.org/10.1093/bjc/azv011

38.

Ybarra

Mitchell

Espelage

(2012). Comparisons of bully and unwanted sexual experiences online and offline among a national sample of youth. In Ö. Özdemr (Ed.), Complementary Pediatrics (pp. 203–216). InTech.