Identity theft in cyber security is the use of digital tools, network vulnerabilities, and stolen credentials to take over someone’s personal information and commit fraud in their name. The FTC received more than 1.1 million identity theft reports through IdentityTheft.gov in 2024 alone.1Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024 Federal law treats it as a serious crime carrying up to 15 years in prison, and several statutes give victims concrete financial protections that begin the moment they report unauthorized activity.
Why the Digital Version Is Harder to Catch
Stealing an identity used to mean grabbing a wallet or digging through a mailbox. The cyber version doesn’t require the attacker to be anywhere near you. Someone on another continent can harvest your data from a breached database, test your stolen credentials against hundreds of websites, and drain accounts before you notice anything. A single server breach can expose millions of records at once.
Victims often don’t discover anything until unexplained charges appear on a statement or a creditor calls about an account they never opened. By then, the stolen data may already be circulating on underground marketplaces where other criminals buy it for additional fraud. That delay between theft and discovery is what attackers count on.
How Attackers Get Your Information
Phishing, Vishing, and Smishing
Phishing remains the most common entry point. Attackers send emails designed to look like they come from a bank, employer, or service provider, usually with an urgent prompt like “verify your account immediately.” The link leads to a fake login page that captures whatever the victim types. Vishing is the same tactic over the phone; smishing uses text messages. If you get an unexpected message asking for personal information, close it and contact the organization directly using a number you look up yourself.
Malware and Keyloggers
Malicious software can infect a device through a shady download, an unpatched application, or a compromised ad on a legitimate website. Keyloggers record every keystroke, capturing passwords and account numbers as they are typed. These programs can sit undetected for months.
SIM Swapping
Here the attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once that happens, they receive your calls and texts, including the one-time passcodes that banks send for two-factor authentication. With those codes, they can reset passwords and take over accounts even if your original credentials were strong.
Data Breaches and Credential Stuffing
Large-scale breaches target companies holding millions of records. Once the data is out, criminals use automated tools to try stolen password combinations across hundreds of platforms. This is called credential stuffing, and it is why reusing the same password across sites is dangerous: one leaked password can unlock every account that shares it. Logging into a bank account from an unsecured public Wi-Fi network carries its own risk, since an attacker on that network can intercept data in real time.
Federal Penalties for Cyber Identity Theft
Identity Theft and Assumption Deterrence Act (18 U.S.C. 1028)
Before 1998, federal law made it illegal to create or possess fake identification documents, but stealing someone’s personal information wasn’t itself a standalone crime. The Identity Theft and Assumption Deterrence Act closed that gap by making it a federal offense to knowingly use another person’s identifying information to commit fraud.2Office for Victims of Crime. Federal Identity Theft Laws Under 18 U.S.C. 1028, this covers producing or possessing fake IDs, trafficking in stolen Social Security numbers and credit card data, and using someone else’s identity in connection with any federal crime or state felony.3Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
Penalties depend on severity. The base range is up to 5 years in prison for less serious violations, scaling to 15 years for offenses involving large-scale trafficking or use in connection with other serious crimes.3Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information Fines can reach $250,000 for individuals and $500,000 for organizations.4Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine Courts routinely order restitution requiring the defendant to repay what was stolen.5Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
Aggravated Identity Theft (18 U.S.C. 1028A)
When someone uses another person’s identity during the commission of a qualifying felony like wire fraud, bank fraud, or mail fraud, the charge escalates to aggravated identity theft. This carries a mandatory two-year prison sentence that runs on top of whatever sentence the underlying felony carries, and a judge cannot substitute probation. If the identity theft was connected to a terrorism offense, the mandatory add-on jumps to five years.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Computer Fraud and Abuse Act (18 U.S.C. 1030)
This statute targets the hacking side. It makes it a federal crime to intentionally access a computer without authorization and obtain information from financial records, consumer reporting agency files, or any protected computer. A first offense can mean up to one year in prison, but if the access was for financial gain or in furtherance of another crime, the ceiling rises to five years. Repeat offenders face up to ten years.7Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Prosecutors often stack this charge alongside 18 U.S.C. 1028 when a data breach leads to identity theft.
How Much You Can Be Forced to Pay
Federal law limits how much money victims can lose from unauthorized transactions, but the rules differ sharply between credit cards and debit cards.
Credit Cards
Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and even that applies only if the card issuer has met certain disclosure requirements.8Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major card networks offer zero-liability policies that waive even that $50, but the statutory cap is the legal floor. Once you report the card as stolen, you have zero liability for any charges made after the report.
Debit Cards and Electronic Transfers
Debit cards get far less generous treatment, and timing is everything. Under the Electronic Fund Transfer Act:
- Report a lost or stolen card within two business days and your liability caps at $50.
- Wait longer than two days but report within 60 days of your statement being sent, and you could be on the hook for up to $500.
- Miss the 60-day window entirely, and you risk losing everything the attacker takes after that deadline.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
This is the single most important reason to review your bank statements regularly. The difference between checking your account on Monday versus waiting until next month could be the difference between losing $50 and losing your entire balance.
What to Do If You’re a Victim
Speed matters more than anything else. Every day you wait gives the attacker more time to open accounts, drain funds, and create a larger mess to clean up.
- Call the fraud department at any bank, card issuer, or service provider where unauthorized activity occurred. Ask them to close or freeze the compromised accounts and change all login credentials.
- Report the theft at IdentityTheft.gov. The site walks you through your situation, generates a personalized recovery plan, and creates an Identity Theft Affidavit you’ll need when disputing fraudulent accounts. Print the affidavit immediately after creating it, as you may not be able to retrieve it later.10Federal Trade Commission. IdentityTheft.gov11Federal Trade Commission. What To Do Right Away
- Place a credit freeze with each of the three major credit bureaus (Equifax, Experian, TransUnion). This blocks potential creditors from pulling your credit report, which stops most new-account fraud cold. Freezes are free to place and lift.12Consumer Advice – FTC. Is a Credit Freeze or Fraud Alert Right for You
- Consider a fraud alert as a supplement. A standard fraud alert lasts one year and requires businesses to verify your identity before opening new accounts in your name. If you’ve already been victimized, you can request an extended fraud alert lasting seven years.13Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
- File a police report. Some creditors and financial institutions require one before they will remove fraudulent accounts. Keep a copy for your records.
If health insurance information was involved, you also have the right to request correction of errors in your medical records, and the healthcare provider must respond within 30 days.14Federal Trade Commission (FTC). What To Know About Medical Identity Theft
When a Company Should Have Told You
When a company holding your data gets breached, federal law imposes notification deadlines that vary by industry. Healthcare organizations covered by HIPAA must notify affected individuals within 60 days of discovering the breach. If more than 500 people in a single state are affected, the organization must also notify the media and the Department of Health and Human Services within the same 60-day window.15HHS.gov. Breach Notification Rule
Financial institutions covered by the Gramm-Leach-Bliley Act’s Safeguards Rule face a tighter deadline: they must report qualifying breaches to the FTC within 30 days of discovery.16Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Beyond these federal rules, all 50 states have their own data breach notification laws. Most require notice without unreasonable delay, and roughly 20 states set specific numeric deadlines ranging from 30 to 60 days. If a company drags its feet, it may be violating these requirements, and the sooner you find out about a breach, the sooner you can freeze your credit and limit the damage.