I guess there are different kinds of identity theft. Some is very opportunistic and targeted, where someone has access to the information, gets the information, and then impersonates that person to commit a fraud. In that case the thief and the fraudster are the same.
When we're talking about data breaches, where hackers go in and get into databases and collect information, that information goes into black-market marketplaces and is sold. There are academic studies that have looked at the black market and what a credit card account identity is worth—what an identity, something that has your social insurance number and your mother's maiden name, is worth. So you can get data on that from these black markets, and that's the gap between the theft and the fraud. The fraudsters go and—