A story on News.com has the US Congress trying to pass a law that offers victims of identity theft the “right” to sue for restitution. As anyone who has or knows someone who’s had their identity stolen, there’s a lot of expense and effort involved in putting your credit score back together once it’s been trashed.

Unfortunately, the law as currently written is (at least to my mind) horribly flawed, in three very important ways. It counts as an excercise in misdirected effort.

The first problem is that the law addresses the problem of identity theft in a backwards manner. It presumes that thieves can be deterred by passing more punishment. The problem here is that it assumes the criminal has been found, and the vast majority of identity thieves are very hard to track down. Just as one example, recent IRS statistics place between 10 and 12 million duplicated (or worse) Social Security numbers in the tax system due to fraudulent SSNs used by people ineligible to work in the United States. Each of these is a serious enough problem to start with (try applying for college loans and finding out you’re an 18 year old with a 25 year credit/work history), but becomes worse when bank accounts and credit cards start to get involved.

The second problem is that even if you do find the criminal, and convince the authorities to prosecute, you’re then having to go back to the court a second time to get restitution. The way the law is worded, it’s not something that the judge can simply order; you have to sue the criminal in civil court. By the time you can get a civil judgement, there is likely no money left to have it paid from. It will all be gone, spent on the defendant’s lawyer in the criminal case or otherwise vanished/confiscated by the authorities, or even repossessed by credit companies trying to make back the money the criminal will never pay them.

The final problem is that this law doesn’t address the real root problem of identity theft, which is the credit companies themselves. A couple decades ago, credit was harder to come by. People started with a gas card or store card, a bank account, perhaps an ATM / Debit card, and worked their way up. Now, the credit agencies are offering credit cards to everyone and their dog, the sooner the better, and with much less requirement of proof of identity and ability to handle money. It goes without saying that the less verification the credit card agencies do, the more fraud slips by them until it’s too late. Ultimately, if the law held the credit agencies (rather than the merchants who don’t get paid and the consumers who currently suffer increased interest rates and fees) responsible, you’d see fraud go down significantly as they started to pay attention to who they were giving credit cards and credit lines to.

I’d be very interested in a real law that could crack down on identity fraud, but I don’t think this law does anything at all.