What Is Identity Theft? 

Identity theft isn’t someone stealing your wallet.

The wallet is only one way in. Identity theft is someone using the facts that prove you are you, such as your name, your Social Security number, your date of birth, or your login, to get something in your name. A credit card. A loan. A tax refund. A job. Medical care. Sometimes even a clean record after an arrest.

Note that in most cases, nothing is taken from your hands. Your card is still in your pocket. Your passport is still in the drawer. The thief only needs a copy of the information, and copies can be made without you ever knowing.

This is what makes identity theft so hard to notice. There is no broken lock. The first sign is often a bill you never ran up, a letter from the IRS, or a call from a debt collector, sometimes months after the theft happened.

In this post, we will see what identity theft is, what makes up your identity, how identity theft happens, the main types with real examples, the signs that your identity has been stolen, how to avoid identity theft, and what to do if it has already happened to you.

No technical background is needed to understand this. We have written it for the common person, with basic technical details added along the way for cybersecurity enthusiasts.

What is identity theft?

The US Federal Trade Commission (FTC) gives a simple identity theft definition: it is when someone uses your personal or financial information without your permission.

So, the meaning of identity theft has two parts. First, someone gets your information. Second, they use it while pretending to be you. Both parts matter.

You will also hear the term identity fraud. Many people use both terms for the same thing, and that is fine for everyday use. If you want the small difference, here it is.

• Identity theft is the taking of your information.
• Identity fraud is the use of it to get money, goods, or services.

Basically, identity theft is the act of stealing the key. Identity fraud is using the key to open a door.

Identity theft takes the key. Identity fraud uses it.

What makes up your identity?

To a bank, a phone company, or a government office, “you” is not your face. “You” is a small set of facts that you give to prove who you are.

Here are the pieces an identity thief looks for.

• Your Social Security number (SSN): the most valuable piece in the US, because so many organizations use it to confirm who you are. It never expires and is very hard to change.
• Your name, date of birth, and address: easy to find on their own, but powerful when combined with the SSN.
• Your card and bank account numbers: used to spend your money directly.
• Your logins: the email address and password for your email, bank, shopping, and social media accounts.
• Your government ID: your driver’s license or passport, including a photo of it.
• Your medical insurance number: used to get medical care in your name.
• Your phone number: used to receive the one-time codes that protect your accounts.

The pieces of your identity. The more pieces a thief collects, the more doors they can open.

Note that one piece alone rarely opens anything. A thief with only your address can’t do much. A thief with your name, date of birth, address, and SSN can apply for credit as you. This is why criminals collect pieces from different places and put them together.

How common is identity theft?

Identity theft is one of the most reported consumer problems in the United States.

In 2024, the FTC received 1,135,291 identity theft reports. That was about 18% of all the reports it received that year, and it was the second biggest category after complaints about credit bureaus.

A survey-based study gives a wider picture, because many victims never file a report. According to Javelin Strategy & Research’s 2026 Identity Fraud Study, identity fraud affected 18 million Americans in 2025 and caused $27.3 billion in losses. That figure doesn’t include scams, which Javelin counts separately.

The raw material for all of this keeps growing. The Identity Theft Resource Center (ITRC) tracked a record 3,322 data compromises in the US in 2025, a 79% jump over five years. In 70% of the breach notices, the company didn’t explain how the breach happened.

It is a myth that identity theft only happens to people who are careless online. You can use strong passwords and never click a strange link, and your SSN can still be stolen from a company that stored it.

How does identity theft happen?

Identity theft usually moves through four stages. We call it the identity theft chain.

1. Collect: the thief gets pieces of your information.
2. Combine and sell: the pieces are put together into a profile and often sold to other criminals.
3. Use: someone uses the profile to open accounts, take over accounts, or file claims in your name.
4. Discover: you, a bank, or a government office finally notices.

The identity theft chain. The longer the gap before discovery, the bigger the damage.

Note that the person who steals your information is often not the person who uses it. Stolen data is traded like any other product, and much of that trade happens on the dark web. We explained what the dark web is and how its markets work in our post on dark web basics.

How thieves collect your information

Here are the most common ways identity theft occurs.

Data breaches: A company, hospital, school, or government office that holds your information gets hacked. You did nothing wrong, but your data is now out. Our Curious Lab Breach Index tracks the breaches made public this year, and our summary of the IBM Cost of a Data Breach report explains what breaches cost the companies themselves.

Phishing and scams: A fake email, text, or call asks you to “verify” your details, and you type them in yourself. We covered how this works in our posts on what is phishing and how to tell if someone is scamming you online.

Malware on your device: An info-stealer is malware that quietly collects the passwords and login sessions saved in your browser. In its 2026 Trends in Identity Report, the ITRC found that unauthorized access to computers and phones grew from 15.3% to 27.2% of all identity compromises in one year. For adults aged 35 to 64, hacked devices are now a bigger cause than scams.

Physical theft: A stolen wallet, a stolen phone, or mail taken from your mailbox, such as bank statements, tax forms, or a new card.

Oversharing: Your birthday, your pet’s name, and your hometown, posted publicly, answer many security questions.

Someone close to you: Sometimes the thief is a relative, a roommate, or a caregiver who already has access to your documents. This is common in child identity theft, because a parent or relative has the child’s SSN.

Types of identity theft

The FTC groups identity theft reports by what the thief did with the information. In 2024, credit card fraud was the most reported type, with 449,032 reports, followed by “other identity theft” and loan or lease fraud.

Bar chart of FTC identity theft reports by type in 2024: credit card 449,032, other identity theft 358,993, loan or lease 176,400, bank account 114,608, employment or tax-related 87,470, phone or utilities 82,626, government documents or benefits 70,332. Identity theft reports by type in 2024.

Source: FTC Consumer Sentinel Network Data Book 2024. One report can include more than one type.

https://www.ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf

Note that in 2024, 14% of identity theft reports included more than one type. Once a thief has your profile, they rarely stop at one thing.

Here are the different types of identity theft, with an example for each. The examples are illustrations, not real cases.

Financial identity theft

This is the most common type, and it comes in two forms.

Existing account fraud: The thief uses an account you already have. Say, for example, your card details are copied at a fake online store. A week later, you see purchases you never made.

New account fraud: The thief opens a new account in your name, such as a credit card, a loan, or a “buy now, pay later” account. You don’t see it because the statements go to the thief. According to Javelin, new account fraud was the only category whose losses grew in 2025, with 5.4 million victims, up 31%.

Account takeover

The thief logs in to your existing online accounts, such as email, bank, shopping, or social media, and changes the password and recovery details so you can’t get back in. Javelin found that account takeover remained the costliest type of identity fraud in 2025, with more than $15 billion in losses and 6 million victims.

A common form is the SIM swap. The attacker tricks your mobile company into moving your phone number to their SIM card. Your one-time login codes then go to the attacker.

Tax identity theft

The thief uses your SSN to file a tax return and collect your refund before you file. You only find out when the IRS rejects your real return because one was “already filed.” A second form is employment fraud, where someone works under your SSN and the IRS then asks you about income you never earned.

Medical identity theft

The thief uses your name or health insurance number to get medical care, prescriptions, or equipment. This one is dangerous in a way the others are not. Their treatment can end up in your medical record, so a doctor may later see the wrong blood type, the wrong allergies, or a diagnosis you never had.

Criminal identity theft

Criminal identity theft occurs when someone gives your name, ID, or details to the police when they are stopped or arrested. The FTC lists “pretending to be you if they’re arrested” as one of the ways stolen information is used. Say, for example, a thief carrying a forged license with your details gets a ticket and never pays it. A warrant is issued in your name. You only learn about it during a routine traffic stop or a background check for a new job.

Child identity theft

A child’s SSN is very valuable because nobody checks a child’s credit for years. The FTC notes that a child under 18 generally won’t have a credit report at all. A thief can use the number for a decade before anyone notices, often when the child applies for a student loan or a first job.

Synthetic identity fraud

This is the newest and hardest type to catch. The thief doesn’t copy one person. Instead, they combine a real SSN, often a child’s, with a fake name and a fake date of birth to create a person who doesn’t exist. The Federal Reserve describes synthetic identity fraud as a combination of real and fake information used to build a new identity. The fake person builds up good credit over time, borrows as much as possible, and disappears.

Government documents and benefits fraud

The thief uses your information to get a driver’s license, a passport, or government benefits such as unemployment payments. You may find out when your own benefit claim is denied because “you” already receive it.

Type	What the thief does	How you often find out
Financial	Spends on your cards or opens new credit	Strange charges, new accounts on your credit report
Account takeover	Logs in and locks you out	Password stops working, “new sign-in” emails
Tax	Files a return to steal your refund	IRS rejects your return or sends a letter
Medical	Gets care on your insurance	Bills or benefit statements for care you never had
Criminal	Gives your name to police	Warrant, failed background check
Child	Uses a child’s SSN for credit or benefits	Child is denied a loan, job or benefit years later
Synthetic	Builds a fake person on a real SSN	Often found late, during an unrelated credit or tax check
Government	Gets IDs or benefits in your name	Your own claim is denied

Eight types of identity theft. Each one uses the same stolen pieces in a different place.

Can someone steal your identity with your ID?

Yes, a stolen or copied ID is useful to a thief, but mostly as one piece of a bigger profile.

Your driver’s license shows your full name, date of birth, address, photo, and license number. That is already several pieces of your identity in one place. Here is what someone can do with your ID.

• Pretend to be you in person, for example at a bank branch, a phone store, or a car rental desk, especially if they look a little like you.
• Pass online identity checks, where a website asks you to upload a photo of your ID.
• Give it to the police during a stop, which can lead to criminal identity theft.
• Combine it with your SSN from a data breach to open new credit.

Note that a photo of your ID is almost as useful as the card itself for online checks. So, send a picture of your license or passport only to organizations you contacted yourself, through their official website or app.

Signs of identity theft

Identity theft is quiet, but it leaves marks. Here is how to tell if your identity has been stolen. Many of these signs come from the FTC’s own list.

In your money:

• Charges or withdrawals you didn’t make.
• A bill or statement that suddenly stops arriving. The thief may have changed your billing address.
• A new card, loan, or account you never asked for.

In your mail and calls:

• Debt collectors calling about debts that are not yours.
• Letters about accounts you don’t recognize.
• A notice that your information was involved in a data breach.

In your accounts:

• Your password stops working, or you get “new sign-in” or “password changed” emails you didn’t trigger.
• Your phone suddenly loses signal and shows “SOS only” or “No service” for no reason. This can be a sign of a SIM swap.

In official records:

• The IRS says a tax return was already filed in your name, or that you earned income from an employer you never worked for.
• Your credit report shows accounts, addresses, or credit checks you don’t recognize.
• Your medical insurance shows treatment you never had, or says you’ve reached your benefit limit.
• You are denied credit, a job, an apartment, or a benefit for reasons that make no sense.

The signs of identity theft. One sign is a reason to check. Two or more are a reason to act.

The single best way to spot new account fraud is your credit report. All three nationwide credit bureaus, Equifax, Experian, and TransUnion, have permanently extended free weekly credit reports at AnnualCreditReport.com. The FTC notes that this is the only site authorized to give out the free reports required by law, so type the address yourself. Fake sites use similar names.

How to avoid identity theft

You can’t stop every company from being breached. But you can make your stolen information much less useful. Here are the steps, starting with the ones that protect you the most.

Step 1: Freeze your credit

A credit freeze stops lenders from seeing your credit report, which means nobody can open new credit in your name, including you, until you lift it. The FTC says a freeze is free to place and free to lift. It doesn’t affect your credit score.

You must contact each of the three credit bureaus, Equifax, Experian, and TransUnion, separately. When you need to apply for credit yourself, you lift the freeze for a short time and then put it back.

Note that a freeze stops new accounts. It doesn’t stop someone from using a card you already have, so the other steps still matter.

Step 2: Get an IRS Identity Protection PIN

An IP PIN is a six-digit number known only to you and the IRS. A tax return filed with your SSN but without the right IP PIN is rejected. So, even if a thief has your SSN, they can’t file a return in your name.

The IRS says anyone with an SSN or an ITIN (Individual Taxpayer Identification Number) can request a free IP PIN, including taxpayers living abroad, once they verify their identity. If you request it online, you get a new one every year, starting mid to late January.

Step 3: Protect your accounts

• Use a different, strong password for every account. A password manager makes this easy. You can also create one with our free password generator.
• Turn on two-step verification, starting with your email, because whoever controls your email can reset almost every other password.
• Use passkeys where they are offered. A passkey only works on the real website, so a fake page can’t steal it.
• Add a PIN or passcode with your mobile company. This makes a SIM swap harder.

We explained all of these steps in detail in our post on how to protect your home computer.

Step 4: Guard your Social Security number

Some organizations really need your SSN, such as the IRS, your bank, and your employer. Many others don’t. The FTC suggests asking four things before you share it: why they need it, how they will protect it, whether they can use another identifier, and whether the last four digits are enough.

Remember, the IRS, your bank, and your employer won’t call, email, or text you to ask for your SSN. If someone does, it is a scam.

Step 5: Protect your paper and your devices

• Shred documents with personal or financial information before you throw them away.
• Collect your mail as soon as you can, and sign up for paperless statements where possible.
• Keep your devices updated and your antivirus on, so info-stealer malware has a harder time getting in.
• Wipe old phones and computers before you sell or recycle them.

Step 6: Protect your children

The FTC says parents can request a free credit freeze for a child under 16, and the freeze stays in place until the parent asks for it to be removed. You can also ask each credit bureau to check whether a credit report exists under your child’s SSN. In most cases, it shouldn’t.

Step 7: Watch, don’t only lock

• Check your free weekly credit reports a few times a year.
• Read your bank, card, and insurance statements every month.
• Turn on transaction alerts in your banking app.

Note that paid monitoring services can help, but the FTC points out their limits. For example, credit monitoring won’t alert you when someone files a tax return with your SSN. The free freeze and the free IP PIN close doors that monitoring only watches.

Five layers of protection.

A freeze and an IP PIN lock the doors. Regular checks tell you if someone tries anyway.

What to do if your identity is stolen

Don’t panic, and don’t wait. The faster you act, the easier it is to fix. Here is how to deal with identity theft, in order.

1. Call the companies where the fraud happened. Ask their fraud department to close or freeze the accounts, and ask for written confirmation that you are not responsible.
2. Place a fraud alert. The FTC explains that you only need to contact one credit bureau for a free, one-year fraud alert, and that bureau must tell the other two. A fraud alert tells lenders to check with you before opening a new account.
3. Freeze your credit with all three bureaus, if you haven’t already.
4. Report it at IdentityTheft.gov. This is the FTC’s official site for identity theft victims. You get a free, personal recovery plan, pre-filled letters to send to companies and credit bureaus, and an official Identity Theft Report that helps you remove fraudulent accounts from your credit report.
5. Change your passwords from a clean device, starting with your email, and sign out of all other sessions.
6. Report to the right office for your type of theft. For tax identity theft, contact the IRS. For criminal identity theft, contact the police department that made the arrest and ask how to clear your name. For medical identity theft, ask your insurer and doctors for your records and correct them.
7. Keep a record of every call, letter, case number, and date. Recovery can take weeks or months, and good notes make every step faster.

The recovery plan. The first day matters most.

Be careful of a second trap. After a theft, you may be contacted by “recovery experts” who promise to fix everything for an upfront fee. We explained this recovery scam in our post on how to tell if someone is scamming you online. IdentityTheft.gov, credit freezes, and IP PINs are all free.

Note that being a victim has nothing to do with being foolish. In many cases, your data was stolen from a company you trusted. The ITRC found that 25.6% of victims who contacted it were dealing with two or more incidents at the same time, which shows how often one theft leads to another. So, finish every step, even after the first problem is fixed.

A real story: the background check company that lost almost everyone’s SSN

National Public Data was a background check company based in Florida. Its business was collecting information about people, such as names, addresses, phone numbers, and Social Security numbers, and selling searches of that information to its customers.

In April 2024, a hacker known as USDoD posted a database on a dark web forum and claimed it came from National Public Data. The asking price was about $3.5 million. Over the summer, most of the data was released for free on a dark web marketplace. We have explained in our post on dark web why so much stolen data ends up being traded in these places.

Security researchers estimated that the leak contained about 272 million unique Social Security numbers, along with names, dates of birth, and current and past addresses. Most of the people in it had never heard of the company.

The company confirmed the breach in August 2024, months after the data first appeared for sale. In October 2024, its parent company filed for bankruptcy, telling the court it could not pay for the expected lawsuits or for credit monitoring for hundreds of millions of people. The same month, police in Brazil arrested one of the hackers behind the USDoD name.

This story shows the most important fact about identity theft today. The people in that database didn’t click anything or lose anything. Their information was taken from a company they had never dealt with. Basically, you can’t control whether your SSN leaks. You can only control how useful it is after it leaks, and that is exactly what a credit freeze and an IP PIN do.

Final thoughts

Identity theft is someone using your personal information to act as you. The thief collects pieces of your identity, puts them together, often buys or sells them on the dark web, and then uses them to open accounts, take over accounts, file taxes or even hide from the police in your name.

You can’t fully stop your information from leaking, because much of it sits with companies and offices you don’t control. But you can make the leaked information close to useless.

Note that you don’t need to do everything today. Start with three free steps: freeze your credit with all three bureaus, request an IRS IP PIN, and turn on two-step verification for your email. Those three steps alone block the most common ways identity thieves turn your data into money.

If you are new to cybersecurity, start with our guide on how cyberattacks work.

We will update this post if we find new identity theft patterns worth knowing.

Stay safe, stay alert!

Related posts from The Curious Lab

• Dark Web Basics: Tools, Links, How to Access
• How to Tell If Someone Is Scamming You Online? Signs, Tests and Free Tools
• How to Protect Your Home Computer? A Simple Guide for Everyone
• How to Prevent AI Cyber Attacks? A Simple Guide for Everyone
• What Is Phishing?
• Key Points to Take in Cost of a Data Breach Report by IBM
• How Cyberattacks Work

Free tools from The Curious Lab

• Curious Lab Breach Index: see the data breaches made public this year and how many accounts they exposed.
• Password Generator: create a strong, random password in one click.
• Link Safety Checker: check a link, or the whole message it came in, before you open it.