Over the last few days there have been a lot of headlines about how the US has cracked the biggest ID theft ring ever. Frankly it’s a load. Biggest? Perhaps. ID theft? Only by the worst definition. The suspects in question are alleged to have stolen 40 million credit card numbers by breaking into retailer’s networks. (Most notably the much maligned TJ Maxx). The problem is that the US government defines stealing a credit card number as identity theft. This is the most inclusive definition but it’s also the worst. If someone steals your credit card number you simply cancel the card and are not held responsible for the fraudulent charges. No one can wreck your credit score or open a line of credit in your name. (For that they usually need your social security number.)  Including credit card numbers in ID theft numbers artificially inflates them and makes for great scare tactics from companies like lifelock, but doesn’t actually measure the real risk to your credit score. Some organizations that have no vested interest in scaring you (like the privacy rights clearinghouse), but most simply use the largest and scariest number possible. It’s time for this tactic to stop. Stealing someone’s credit card number is not the same as stealing their identity, and if reliable crime statistics are important, then we need to stop equating the two.