The New York Times has a story on the web "With Personal Data in Hand, Thieves File Early and Often" by reporter Lizette Alverez for Sunday's paper. It describes an "epidemic" of tax identity theft. Thieves file fraudulent tax returns and receive a legitimate taxpayer's refund before he or she does, often on a hard-to-trace prepaid card. Losses are in the billions, losses are increasing and legitimate taxpayers are waiting a long time to get their refund. It's a very good story that explains how the crime works, how it disproportionately harms retirees and how, -- despite massive efforts by agencies from the IRS to the post office -- it's a growing mess. Unfortunately, the reform promoted by some policymakers quoted in the story -- increasing criminal penalties -- has never worked to stop identity theft. Bad guys don't have to carry guns and they rarely get caught, so the crime is booming. Sure, it doesn't hurt to increase penalties, but it is not enough. We need to protect personal data better. Relying on increasing penalties is a feel-good solution that won't work on its own. But the credit bureaus and other powerful special interests have resisted legislation to protect personal information better and spent heavily to convince policymakers that "blaming bad guys" is more important than fixing their own sloppy practices. The credit bureaus, of course, are wrong.