identity theft

Identity theft, also known as identity fraud, is a crime in which an imposter obtains key pieces of personally identifiable information (PII), such as Social Security or driver's license numbers, to impersonate someone else.

The taken information can be used to run up debt purchasing credit, goods and services in the name of the victim or to provide the thief with false credentials. In rare cases, an imposter might provide false identification to police, creating a criminal record or leaving outstanding arrest warrants for the person whose identity has been stolen.

Types of identity theft

Identity theft is categorized in two ways: true name and account takeover. True-name identity theft means the thief uses personal information to open new accounts. The thief might open a new credit card account, establish cellular phone service or open a new checking account to obtain blank checks.

Account-takeover identity theft is when the imposter uses personal information to gain access to the person's existing accounts. Typically, the thief will change the mailing address on an account and run up a huge bill before the victim realizes there is a problem. The internet has made it easier for identity thieves to use the information they've stolen since transactions can be made without any personal interaction.

There are many different examples of identity theft, including:

  • Financial identity theft. This is the most common type of identity theft. Financial identity theft seeks economic benefits by using a stolen identity.
  • Tax-related identity theft. In this type of exploit, the criminal files a false tax return with the Internal Revenue Service (IRS). Done by using a stolen Social Security number.
  • Medical identity theft. Where, the thief steals information like health insurance member numbers, to receive medical services. The victim's health insurance provider may get the fraudulent bills. This will be reflected in the victim's account as services they received.
  • Criminal identity theft. In this example, a person under arrest gives stolen identity information to the police. Criminals sometimes back this up with a containing stolen credentials. If this type of exploit is successful, the victim is charged instead of the thief.
  • Child identity theft. In this exploit, a child's Social Security number is misused to apply for government benefits, opening bank accounts and other services. Children's information is often sought after by criminals because the damage may go unnoticed for a long time.
  • Senior identity theft. This type of exploit targets people over the age of 60. Because senior citizens are often identified as theft targets, it is especially important for this seniors to stay on top of the evolving methods thieves use to steal information.
  • Identity cloning for concealment. In this type of exploit, a thief impersonates someone else in order to hide from law enforcement or creditors. Because this type isn't explicitly financially motivated, it's harder to track, and there often isn't a paper trail for law enforcement to follow.
  • Synthetic identity theft. In this type of exploit, a thief partially or completely fabricates an identity by combining different pieces of PII from different sources. For example, the thief may combine one stolen Social Security number with an unrelated birthdate. Usually, this type of theft is difficult to track because the activities of the thief are recorded files that do not belong to a real person.

Identity theft techniques

Although an identity thief might hack into a database to obtain personal information, experts say it's more likely the thief will obtain information by using social engineering techniques. These techniques includes the following:

  • Mail theft. This is stealing credit card bills and junk mail directly from a victim's mailbox or from public mailboxes on the street.
  • Dumpster diving. Retrieving personal paperwork and discarded mail from trash dumpsters is an easy way for an identity thief to get information. Recipients of preapproved credit card applications often discard them without shredding them first, which greatly increases the risk of credit card theft.
  • Shoulder surfing. This happens when the thief gleans information as the victim fills out personal information on a form, enter a passcode on a keypad or provide a credit card number over the telephone.
  • Phishing. This involves using email to trick people into offering up their personal information. Phishing emails may contain attachments bearing malware designed to steal personal data or links to fraudulent websites where people are prompted to enter their information.

How to tell if your identity has been stolen

In 2017, major credit bureau Equifax announced a data breach that exposed 147 million people's data. A settlement of $425 million was agreed upon to help the victims affected. However, it was still regarded by some as the most significant instance of identity theft in recent history. It was considered as such because of the large-scale damages and significance of the breached organization. This breach occurred likely due to a number of security lapses brought on by Equifax. This likely increased the possibility of an individual’s PPI in the United States to be easily stolen.

Some warning signs of being an identity theft victim include:

  • Victims notice withdrawals from their bank account that weren't made by them.
  • An impacted credit score.
  • Victims don't receive bills or other important pieces of mail containing sensitive information.
  • Victims find false accounts and charges on their credit report.
  • Victims are rejected from a health plan because their medical records reflect a condition they don't have.
  • Victims receive an IRS notification that another tax return was filed under their name.
  • Victims are notified of a data breach at a company that stores their personal information.

Impact and prevention

In addition to the immediate impact of losing money and running up debt, individual victims of identity theft can incur severe intangible costs. Some costs include damage to reputation and credit report, which can prevent victims from getting credit or even finding a job. Depending on the circumstances, identity theft can take years to recover from.

To protect yourself from identity theft, experts recommend that individuals regularly check credit reports with major credit bureaus, pay attention to billing cycles and follow up with creditors if bills do not arrive on time.

Additionally, people should:

  • destroy unsolicited credit applications;
  • watch out for unauthorized transactions on account statements;
  • avoid carrying Social Security cards or numbers around;
  • avoid giving out personal information in response to unsolicited emails; and
  • shred discarded financial documents.

Many state attorney general websites also offer identity theft kits that are designed to educate people with identity theft prevention and recovery. Some of these offerings may include helpful documents and forms. The Identity Theft Affidavit, for example, is the form used to officially file a claim of identity theft with a given business. This form in particular is most often used when new accounts have been opened using a victim's personal data, not when an already existing account has been illegally accessed.

It is also important to note if an individual is affected by tax-related identity theft, then they should still continue to pay and file taxes, even if they must file paper returns.

Prevent identity theft
Tips to keep your identity from being stolen

Identity theft recovery

Depending on the type of information stolen, victims should contact the appropriate organization and inform it of the situation. This could be the bank, credit card company, health insurance provider or the IRS. Victims should request to have their account frozen or closed to prevent further charges, claims or actions taken by imposters.

In the United States, identity theft victims should file a complaint with the Federal Trade Commission (FTC) and inform one of the three major credit bureaus in order to have a fraud alert or security freeze placed on their credit records. Major credit bureaus include Equifax, Experian and TransUnion.

Victims can visit the FTC website, where they can take steps to obtain a recovery plan and put it into action. The plan includes the collection of forms and letters necessary to guide one through the recovery process.

If people's personal information was compromised in a data security breach, they should follow up with the company responsible. Mostly to see what types of assistance and protections it may have in place for victims and their data.

Identity theft laws and penalties

Different governments all respond to identity theft crimes differently.

In the United States, two of the laws that largely define the legal proceedings around identity theft are the Identity Theft and Assumption Deterrence Act of 1998 and the Identity Theft Penalty Enhancement Act of 2004.

The Identity Theft and Assumption Deterrence Act prohibits "knowingly transferring or using a means of identification with the intent to commit, aid or abet any unlawful activity that constitutes a violation of federal law or that constitutes a felony under any applicable state or local law." This act also increased sentence lengths by varying degrees for both general and terrorism-related offenses. It also established penalties for aggravated identity theft. Aggravated identity theft refers to the use of another person's identity to commit felonies.

Penalties for identity theft are wide-ranging and can be severe. They vary based on offense. Some penalties for identity theft include:

  • In certain first-offense scenarios, thieves may be sentenced to probation if they didn't cause significant harm. Those on probation will still likely be responsible for fines and restitution. Though it's rare that those guilty of identity theft avoid jail time.
  • Being issued for both felony and misdemeanor charges is the most common consequence for perpetrators.
  • The thief may be required to compensate the victim for financial losses, which can include lost wages, legal fees and even costs related to emotional distress.
  • Perpetrators of identity theft in the United States are often sent to prison, with the minimum sentence being two years for aggravated identity theft. This penalty increases with case severity.

Identity theft insurance

Some identity theft resources such as insurance, can help victims. Having identity theft insurance can help victims expediate the slow and costly recovery process. Identity theft insurance usually only covers recovery costs and does not cover the damages caused directly by the theft. Depending on the policy, expenses that are covered may include the following:

  • lost wages
  • child care costs
  • credit monitoring services
  • legal fees
  • copies of credit reports

Identity theft insurance is available either as an endorsement to homeowners, renters insurance policies or as a stand-alone policy. The Insurance Information Institute estimated that this type of insurance usually costs between $25 and $50 a year, regardless of whether it's a stand-alone policy or not.

These insurance policies are also estimated to have between $10,000 and $15,000 in benefit limits. Meaning damages that exceed the limit are not fully covered, and the victim must pay the difference.

If victims are seeking an alternative to insurance or additional help on top of insurance, they can take advantage of identity theft protection services. These services differ from identity theft insurance policies in that they may provide reimbursement of stolen funds and offer restoration services and credit monitoring services for a fee.

This was last updated in June 2020

Continue Reading About identity theft

Dig Deeper on Data security breaches