Identity theft is the use of another person's personal information, such as a name, date of birth, national identity number, bank details or login credentials, without permission to commit fraud or other crimes. Criminals use stolen identities to open credit cards and loans, take over existing bank accounts, claim tax refunds or government benefits, obtain medical care and pass checks run by banks and employers. The victim is usually left with debts, damaged credit records and a long clean-up.
Some countries separate the theft of personal data from its later misuse, which the United Kingdom's fraud prevention body Cifas calls identity fraud. Identity theft is closely related to synthetic identity fraud, where criminals mix real and invented details to create a person who does not exist, and to account takeover, where an existing account is hijacked. It is one of the main routes into payment fraud.
Identity theft in plain terms
Your identity works like a set of keys that unlock things in your name: a bank account, a phone contract, a loan. Identity theft is someone copying those keys and using them as if they were you. You may not notice for months, because the doors they open are often ones you never use, such as a new credit card sent to a different address.
The damage comes later, when a bill arrives for something you never bought or a lender turns you down because of debts you never took on. Getting the keys back is slow. You have to prove to each organisation that the person who used them was not you, much like proving you were somewhere else on the night a crime was committed.
How identities are stolen and used
Personal details are gathered in many ways. Large data breaches at retailers, health providers and government agencies put millions of records on criminal markets at once. Individuals are targeted through phishing emails and texts, fake websites, spoofed phone calls from people claiming to be the bank, malware on phones and computers, stolen post and documents thrown away without shredding. Social engineering fills the gaps, for example by persuading a call centre to change an address or reissue a card.
Once a criminal has enough details, common uses include:
- New-account fraud. Opening credit cards, loans, buy-now-pay-later accounts or phone contracts in the victim's name and never paying.
- Existing-account fraud. Using passwords or one-time codes to log in to the victim's bank, often helped by SIM swapping to intercept text messages.
- Government and tax fraud. Filing false tax returns to collect refunds, or claiming benefits and unemployment payments.
- Mule activity. Opening accounts used to receive and pass on stolen money, which ties the victim's name to money laundering.
Scale and the law in the United States
The Federal Trade Commission received more than 1.1 million identity theft reports through its IdentityTheft.gov website in 2024, according to its Consumer Sentinel data. The Identity Theft and Assumption Deterrence Act of 1998 made identity theft a federal crime. In the US the Social Security number is central to the problem, because lenders long used it both as an identifier and as proof of identity.
US law gives victims several tools. Under the Fair Credit Reporting Act, consumers can place a fraud alert on their credit report, block fraudulent entries and get free reports. Since September 2018 a security freeze, which stops new lenders from seeing the file, has been free at the three nationwide credit bureaus. The FTC's Red Flags Rule requires many lenders and other "creditors" to run written identity theft prevention programmes that spot warning signs such as mismatched addresses or documents that look altered.
Identity theft elsewhere
In the UK, Cifas runs a shared database of fraud cases and a Protective Registration service that flags a person's name so member firms run extra checks. In the European Union, the GDPR requires organisations to protect personal data and to report serious breaches, which affects how quickly victims learn their details have leaked. Countries with national digital identity systems, such as India's Aadhaar, face a different version of the problem: when one credential unlocks many services, protecting that credential and its biometric records becomes the main defence.
Prevention and detection
Firms try to stop stolen identities at account opening through know your customer checks, document and selfie checks under identity verification, and data such as device and network signals from a digital fingerprint. They have moved away from knowledge-based authentication, because answers to questions like "your mother's maiden name" are easy to find after a breach. For existing customers, multi-factor authentication, behavioral analytics and alerts on changes to contact details make takeovers harder.
Individuals reduce their exposure by freezing credit files when they are not applying for credit, using a different password for each service, preferring app-based or hardware security keys to text-message codes, and checking statements and credit reports regularly. When theft is discovered, the usual steps are to contact the organisations involved, file a report (in the US through IdentityTheft.gov), freeze credit and change passwords. Because a stolen identity can be reused years later, monitoring is ongoing rather than one-off.