Report 2001-103 Summary - September 2001
Department of Motor Vehicles:
Although Unable to Measure the Extent of Identity Fraud and the Effect of Recent Reforms, It Should Improve Its Technology, Procedures, and Staffing Further
Our review of the Department of Motor Vehicles (Motor Vehicles) to determine whether it has adequate procedures and resources to detect or prevent the issuance of fraudulent documents revealed that:
- Motor Vehicles lacks the technology to use the computer-mapped finger images it collects to verify the identity of all applicants for driver licenses and ID cards.
- Motor Vehicles cannot accurately quantify the effect of new procedures aimed at detecting or reducing fraud.
- Motor Vehicles can implement further procedures such as requiring two employees to verify photos it retrieves for existing customers obtaining a temporary license, driver license, or ID card.
- Motor Vehicles can better help employees prevent fraud by standardizing its fraudulent document detection training course.
- Motor Vehicles' Investigations and Audits Division, responsible for investigating fraud, lacks adequate policies, procedures, and resources.
RESULTS IN BRIEF
By issuing driver licenses and identification cards (ID cards)-California's basic identification documents-the Department of Motor Vehicles (Motor Vehicles) enables residents to establish who they are for the purposes of driving, getting jobs, and making basic financial transactions such as purchasing goods and opening lines of credit. In the past year, Motor Vehicles issued about 8 million driver licenses and ID cards, with an unknown number of them going to people who managed to outwit the issuing system and obtain fraudulent driver licenses or ID cards. Some Motor Vehicles customers commit identity theft by taking over someone else's personal information and "becoming" that person on a driver license or ID card.
Although hard to quantify, the public cost of identity theft and other forms of driver license and ID card fraud can be considerable. Responding to national concerns about increased identity theft, Motor Vehicles recently implemented reforms that strengthen its safeguards against fraud. These reforms are reasonable and may reduce fraud, but further changes are required to better secure the process by which California residents and workers obtain their basic identification documents.
A major weakness in Motor Vehicles' ability to crack down on identity fraud is that it cannot use the computer-mapped finger images (finger images) it collects to verify the identity of all applicants for driver licenses and ID cards. Widely accepted by the public and by law enforcement communities as a reliable means of human recognition, current finger-imaging technology allows a highly accurate electronic comparison of the person at the counter with all other persons in a database system. Unfortunately, Motor Vehicles does not obtain the benefits of such technology. Although it has collected finger images for roughly 20 years, image quality may be poor, and Motor Vehicles lacks the up-to-date hardware and software needed to make this human-recognition method effective and useful.
Last year, when Motor Vehicles sought funds to upgrade its finger-imaging technology, the Legislature denied the request, despite its past support for cutting down on identity theft and other similar crimes. Although the legislative record is unclear on why the request was denied, according to the Legislative Analyst's Office Analysis of the 2001-02 Budget Bill, Motor Vehicles did not sufficiently develop its request, address employee oversight issues, or consider the potential impacts on privacy and efficiency. In light of the reforms Motor Vehicles has recently implemented and the need to further strengthen processes for issuing driver licenses and ID cards, the Legislature may again have to consider whether it believes finger imaging is a more effective means of combating fraud. If the Legislature does approve funding to allow Motor Vehicles to upgrade its system, Motor Vehicles should work with the Legislature to craft laws that address privacy concerns by restricting the uses of and access to finger-imaging data.
To try to prevent issuing fraudulent driver licenses and ID cards, Motor Vehicles has begun verifying Social Security numbers with the federal Social Security Administration, retrieving renewal customers' most recent photographs from the Motor Vehicles database, and requiring two employees to verify birth-date and legal-presence documents that customers present to obtain original licenses. However, Motor Vehicles cannot accurately quantify the effect of its new procedures for three reasons. First, Motor Vehicles has inadequate methods of tracking potential fraud. Second, changes in the way Motor Vehicles categorizes and investigates fraud make it difficult to compare the number of potential fraud cases identified before and after the new procedures were in place. Third, the effect reforms have on deterring attempts to obtain fraudulent driver licenses or ID cards is impossible to measure.
Although increased controls should help prevent fraud, Motor Vehicles could improve on its recent reforms. For example, a second employee does not verify the photo retrieved for an existing customer obtaining a temporary license, driver license, or ID card. Motor Vehicles believes that this poses minimal risk because there is no evidence of employees helping someone assume an identity through fraudulent photo verification. Although Motor Vehicles does not have any data to support this position, it states that it will consider having its Driver License Fraud Analysis Unit (Fraud Analysis) select a sample of new photos of customers requesting duplicate or renewal driver licenses and compare them to prior photos to determine whether it is the same person.
Our review of Motor Vehicles' procedures for issuing driver licenses and ID cards suggests additional internal controls that would reduce fraud. We found, for instance, that Motor Vehicles needs to ensure employees enter bar-code numbers for all requests supported by paper applications and then send the applications to headquarters for microfilming. Bar-code numbers allow Motor Vehicles to electronically track the microfilm location of the application. Employees must consistently follow these procedures to facilitate a new electronic process Motor Vehicles is working on to reconcile paper applications with computer requests for driver licenses and ID cards. Also, Motor Vehicles has yet to evaluate or implement most of the recommendations of its Anti-Fraud Task Force (task force). Finally, since the new fraud prevention procedures have increased the average waiting times of customers with appointments by 1.5 minutes and customers without appointments by 9.3 minutes, Motor Vehicles needs to continue its efforts to improve customer service and mitigate this effect.
Another way Motor Vehicles helps its employees prevent fraud is by offering a training course in fraudulent document detection. However, a lack of uniformity among the trainers' presentations and not enough hands-on experience with original documents are examples of the shortcomings of this training. Course developers state that they need increased funding for trainer education and course materials.
Motor Vehicles' investigation of potential fraud also has room for improvement. Its Investigations and Audits Division (Investigations), responsible for preventing and investigating fraud, lacks adequate policies, procedures, and resources. We found the following weaknesses in Investigations' various branches:
- The Field Investigations Branch (Field Investigations) lacks procedures for managing and resolving complaints, so staff use varying methods to record a complaint's open and close dates in its case management database. Additionally, the database does not account for any time that other units, such as Fraud Analysis, may have held the cases. As a result, Motor Vehicles is unable to accurately determine how long its cases remain open and what its true staffing needs are.
- A flawed database prevents staff in Field Investigations' 30 offices from sharing information such as current fraud trends.
- Fraud Analysis, which analyzes finger images, photos, and fraudulent documents, lacks sufficient staff to handle an increased workload caused by Motor Vehicles' new fraud prevention procedures and consumer fraud hotline.
- Because it has not precisely defined the role of the Special Investigations Branch (Special Investigations) in investigating employee misconduct, Motor Vehicles cannot ensure that it investigates all questionable employee activities or that it imposes consistent disciplinary action against employees participating in these activities.
If current reforms to the process for issuing driver licenses and ID cards prove insufficient, the Legislature should reconsider funding an upgrade of Motor Vehicles' finger-imaging technology. If it provides the funds, the Legislature should consider protecting against unauthorized dissemination of finger images by allowing only those entities it believes have a legitimate interest in protecting the public, such as state and local law enforcement agencies, to access Motor Vehicles' finger-imaging data. The Legislature should also consider imposing criminal sanctions for unauthorized use of the data. Further, if the Legislature approves the use of finger imaging, it should consider directing Motor Vehicles to establish controls that protect the privacy of California citizens.
To further improve its existing controls and reduce the time customers must wait in field offices, Motor Vehicles should take these actions:
- Establish mechanisms to track the effectiveness of its recent and future reforms.
- Instruct Fraud Analysis to conduct a study to determine the benefits of comparing the new photo of an existing customer obtaining a temporary license, driver license, or ID card with photos contained in the Motor Vehicles database.
- Continue to work on its plan to electronically reconcile system transactions against applications sent for microfilming at headquarters to ensure that an application supports each transaction. Further, field office managers should ensure that field representatives enter bar-code numbers for all paper applications before sending them to headquarters.
- Establish deadlines for staff to address all of the task force recommendations and conduct a timely evaluation of the merits of each recommendation.
- Continue to communicate with trainers and supervisors regarding Motor Vehicles' commitment to standardization and uniformity in its fraudulent document detection training. Determine if Investigations needs additional funding to improve its training program.
- Complete a staffing analysis to assess the impact of recent reforms on Motor Vehicles' ability to carry out its procedures.
- Establish complaint management procedures that include, at a minimum, logging in a complaint on receipt, promptly sending out an acknowledgment letter to the complainant, prioritizing and assigning complaints, and deadlines for completing the investigation and reporting the results.
- Evaluate the staffing needs of its branches and units.
- Establish a clear policy that identifies Special Investigations' role in investigating employee misconduct; defines such misconduct; and clarifies how employees, managers, and regional administrators should report employee misconduct.?
Motor Vehicles agrees with all of the recommendations contained in our report. In fact, it has already begun implementing some of our recommendations.