Here's a rare note of optimism in the ever-gloomy world of IT security: A new study by Javelin Research finds that losses due to identity theft have dropped from 2005 to 2006 by 11.5 percent. Fewer Americans have been hit, too: down to 8.4 million American adults in 2006, from 8.9 million in 2005 and 10.1 million in 2003. There have been fewer fake account openings, too.

Still, with 2006 losses pegged at $49.3 billion, identity theft remains a massive problem. The worst hit, it seems, are young adults--college students and young twenty-somethings who haven't learned to use security software or shred documents.

This looks like a credible study: It's based on 5,000 telephone interviews. Yes, the study was co-sponsored by financial institutions--Wells Fargo, Visa, CheckFree--and data protection and screening by organizations like theirs is one of the reasons Javelin says losses are down. But the real reason isn't that financial security technology has become invincible, but that more people are learning to take basic precautions. Security breaches are as or more likely to be caused by bad habits than weak technology.