Identity theft is what happens when someone uses your personal information — your name, Social Security number, bank details, or other identifying data — without permission to commit fraud or another crime. Federal law makes it a standalone offense under 18 U.S.C. § 1028, as amended by the Identity Theft and Assumption Deterrence Act of 1998, which covers the knowing use or transfer of someone else’s identifying information to carry out any activity that violates federal law or qualifies as a felony under state or local law.1Federal Trade Commission. Identity Theft and Assumption Deterrence Act The Federal Trade Commission logged more than 1.1 million identity theft reports in 2024, with credit card fraud alone accounting for roughly 449,000 of them.2Federal Trade Commission. Consumer Sentinel Network Data Book 2024
The statute defines “means of identification” broadly. Names, Social Security numbers, dates of birth, driver’s license numbers, biometric data like fingerprints, and electronic identifiers such as account routing codes all count. Each separate use or transfer of someone’s identity is treated as a distinct offense, and the law requires proof of intent, so accidental misuse doesn’t qualify.
The Forms Identity Theft Takes
Identity theft isn’t a single crime. It shows up in several distinct patterns, and the type matters because it shapes both the damage and the cleanup.
Financial Identity Theft
The most common form. A thief uses your Social Security number, bank information, or credit card details to open new accounts, take out loans, or make purchases. You usually find out when collection notices arrive for debts you never incurred or your credit score drops with no explanation. Because creditors report delinquent accounts to all three major credit bureaus, the damage spreads across your financial profile quickly.
Medical Identity Theft
Someone uses your name and insurance details to receive healthcare, fill prescriptions, or submit fraudulent claims. This is especially dangerous because it creates false entries in your permanent medical records. An incorrect blood type, allergy, or diagnosis sitting in your file could lead to a life-threatening treatment error. Cleaning it up means working with every provider and insurer that holds the tainted records, which is slower than disputing a credit card charge.
Criminal Identity Theft
When someone gives your name and identifying information to police during an arrest or traffic stop, their charges can end up attached to you. If they skip court, you could have an outstanding warrant in your name without knowing it. Victims often discover this during a routine background check or when they’re pulled over for something minor. Clearing your record requires proving your identity through fingerprints and filing petitions with the court.
Tax-Related Identity Theft
A thief files a fraudulent tax return using your Social Security number, claiming a refund before you file your own. The IRS then rejects your legitimate return as a duplicate. Red flags include IRS notices about income you didn’t earn, a CP2000 notice listing wages from an employer you’ve never worked for, or a W-2 from a company you don’t recognize.3Internal Revenue Service. Guide to Employment-Related Identity Theft If this happens, you file IRS Form 14039 (Identity Theft Affidavit) to alert the agency and start the resolution process.4Internal Revenue Service. Identity Theft Affidavit
Child Identity Theft
Children are attractive targets because their Social Security numbers have no credit history, so fraudulent accounts can go undetected for years, often until the child applies for their first student loan or credit card. Warning signs include collection calls about your child’s supposed debts, denial of government benefits because someone is already using your child’s Social Security number, or an IRS letter about your child’s unpaid taxes.5Federal Trade Commission. How To Protect Your Child From Identity Theft
Synthetic Identity Theft
Rather than stealing one person’s full identity, criminals combine a real Social Security number with a fake name and address to invent an entirely new person. The fabricated identity doesn’t appear on the real number-holder’s credit report right away, so the fraud can run for years while the thief builds a credit history and eventually maxes out every account before disappearing. Losses from synthetic identity fraud crossed $35 billion in 2023, and the problem is growing as generative AI makes it easier to produce convincing supporting documents.6Federal Reserve Bank of Boston. Gen AI Is Ramping Up the Threat of Synthetic Identity Fraud
How Thieves Get Your Information
The methods range from low-tech to large-scale. Knowing the common ones helps you spot risks before they become losses.
Mail and trash. Dumpster diving through residential trash turns up pre-approved credit offers, tax documents, and utility bills containing account numbers. Stealing mail from unlocked mailboxes gives direct access to bank statements, newly issued credit cards, and insurance documents. Fraudulent change-of-address requests are another angle: a thief submits a mail-forwarding form with the postal service, redirecting your mail to an address they control.
Phishing, smishing, and vishing. Phishing emails impersonate legitimate companies or government agencies and try to trick you into clicking a link and entering your login credentials, account numbers, or Social Security number. The same concept works over text messages (smishing) and phone calls (vishing). Caller ID spoofing makes the incoming number look legitimate, so the display offers no protection on its own.
Skimming devices. Thieves attach small hardware overlays to ATMs, gas pumps, or point-of-sale terminals that read data from the magnetic stripe as you swipe. The captured data is later used to create counterfeit cards or make online purchases. Chip-enabled readers have reduced skimming at some locations, but older terminals and self-service kiosks remain vulnerable.
Data breaches. When hackers penetrate a company’s or government agency’s database, they can expose millions of records at once. The stolen data is often sold in bulk on dark-web marketplaces. A single large breach can feed identity theft operations for years, because much of the stolen information — particularly Social Security numbers and dates of birth — never changes.
Across all these methods, certain identifiers get prioritized. Social Security numbers are the master key, because government agencies and financial institutions use them as a primary identifier and you can’t easily change yours. Financial account numbers unlock immediate access to money. Driver’s license numbers help produce fake IDs. Email credentials are a gateway to nearly everything else, because password-reset links for banking and other accounts route to your inbox. Biometric data like fingerprints is harder to steal, but once compromised cannot be reset.
What Happens to Someone Convicted
Federal prison sentences under 18 U.S.C. § 1028 scale with the severity of the offense, ranging from up to one year for basic violations to up to 30 years when identity theft is committed to facilitate domestic or international terrorism. In between, general identity fraud can draw up to five years, producing counterfeit government documents or netting $1,000 or more from stolen identities in a single year carries up to 15 years, and crimes tied to drug trafficking, violence, or a prior conviction under the same statute can bring up to 20. Fines reach $250,000 for individuals.7Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents8Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine A separate statute, 18 U.S.C. § 1028A, adds mandatory prison time on top of the sentence for the underlying crime: two years for most qualifying felonies, five years if the felony is terrorism-related.9Office of the Law Revision Counsel. 18 U.S.C. 1028A – Aggravated Identity Theft
Every state also criminalizes identity theft independently. Some treat all identity theft as a felony regardless of the dollar amount; others classify lower-value offenses as misdemeanors and escalate once losses cross a threshold, often around $1,000.
Convicted thieves can also be ordered to pay victims back. Under the Mandatory Victims Restitution Act, federal courts can order restitution covering the value of property lost or damaged, income you lost while dealing with the fallout, and expenses tied to participating in the investigation or prosecution, including transportation and child care costs.10Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes
What to Do If Your Identity Is Stolen
Speed matters. The longer fraudulent accounts or records stay active, the harder cleanup becomes.
1. Report to the FTC. Go to IdentityTheft.gov or call 1-877-438-4338. The site walks you through a questionnaire and generates a personalized Identity Theft Report and recovery plan. Creating an account lets you track your progress and get pre-filled dispute letters; if you skip the account, print everything before leaving the page, because you won’t be able to retrieve it later.11IdentityTheft.gov. Identity Theft Recovery Steps
2. File a police report. Combining your FTC Identity Theft Affidavit with a local police report produces the formal Identity Theft Report that proves to businesses and credit bureaus that someone stole your identity. Bring a government-issued photo ID, proof of your address, your FTC affidavit, and any evidence of the theft, such as fraudulent bills or IRS notices. Ask for a copy of the report before you leave.12Federal Trade Commission. What To Do Right Away
3. Place a fraud alert or credit freeze. An initial fraud alert lasts one year and requires creditors to take extra steps to verify your identity before opening new accounts. An extended alert lasts seven years but requires a police report or FTC Identity Theft Report.13Consumer Advice – FTC. Credit Freezes and Fraud Alerts A credit freeze is stronger: it blocks new creditors from pulling your report entirely. Freezing and unfreezing are free by federal law at all three bureaus (Equifax, Experian, and TransUnion), and a freeze does not affect employers, landlords, or insurers who request your report for non-credit purposes.14Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report
4. Request blocks on fraudulent credit report entries. Under the Fair Credit Reporting Act, credit bureaus must block any information you identify as resulting from identity theft within four business days of receiving your identity theft report, proof of identity, and a statement identifying the fraudulent entries.15Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft A block removes the fraudulent account entirely, which is different from disputing it.
5. Contact affected companies directly. Call the fraud department of every company where accounts were opened or misused in your name. Ask them to close or freeze the fraudulent accounts and send you written confirmation. Your Identity Theft Report gives you the legal standing to demand these actions.
How to Prevent It
No single step eliminates the risk. Stacking a few of them makes you a much harder target.
Freeze your credit. This is the single most effective preventive step, because it stops new accounts from being opened in your name. Freezing at all three bureaus is free, and you can temporarily lift the freeze when you need to apply for credit legitimately. Some bureaus sell paid “credit locks,” but the Consumer Financial Protection Bureau has stated that locks are no more effective than the free freeze you’re entitled to by law.14Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report
Enroll in the IRS Identity Protection PIN program. Anyone with a Social Security number or Individual Taxpayer Identification Number can get an IP PIN, a six-digit number you include on your tax return each year. The IRS rejects any return filed without it. Parents can request IP PINs for dependents. You can enroll online through your IRS account, or by submitting Form 15227 by mail if your adjusted gross income is below $84,000 (individual) or $168,000 (married filing jointly).16Internal Revenue Service. Get an Identity Protection PIN
Build everyday habits that cut off the easiest attack paths. Shred documents containing personal or financial information before discarding them. Use a locked mailbox or a P.O. box, especially if you live somewhere with unsecured curbside delivery. Turn on two-factor authentication for email and banking, so a stolen password alone isn’t enough. Review your credit reports regularly through AnnualCreditReport.com and watch for accounts or inquiries you don’t recognize.