Identity theft is a federal crime in which someone uses your personal information, such as your Social Security number, bank account details, or name and date of birth, without permission and with the intent to commit fraud. The Federal Trade Commission received over 1.1 million identity theft reports in 2024, with new-account credit card fraud topping the list at more than 406,000 reports.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 Unlike stealing a wallet or a car, identity theft targets intangible data that can be exploited repeatedly, often without the victim realizing anything is wrong for months.
How Federal Law Defines Identity Theft
Federal law defines identity theft at 18 U.S.C. § 1028(a)(7) as knowingly transferring, possessing, or using another person’s identifying information without lawful authority, with the intent to commit any unlawful activity that violates federal law or qualifies as a felony under state or local law.2Office of the Law Revision Counsel. 18 U.S.C. 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information Two elements matter here: the information has to belong to a real person, and the person using it has to intend something illegal. Simply having someone else’s Social Security number is not enough. Prosecutors must show the person planned to use it for fraud or another crime.
The statute defines “means of identification” broadly. It covers names, Social Security numbers, dates of birth, driver’s license numbers, passport numbers, and taxpayer identification numbers, among others.2Office of the Law Revision Counsel. 18 U.S.C. 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information The breadth of that definition reflects reality: a thief doesn’t need your entire profile to cause damage. A single data point, combined with other easily available information, can unlock credit accounts, medical services, or tax refunds in your name.
The Main Types of Identity Theft
Financial Identity Theft
Financial identity theft is the most reported category. It involves using someone’s personal information to open new credit cards, take out loans, or drain existing bank accounts. In 2024, over 406,000 FTC reports involved new credit card accounts opened fraudulently, while nearly 96,000 involved fraudulent personal or business loans.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 Thieves may also use forged checks or unauthorized electronic transfers to empty checking and savings accounts directly. The immediate fallout is twofold: the victim’s credit score takes a hit from accounts they never opened, and untangling the mess with creditors can take months.
Tax and Employment Identity Theft
Tax identity theft happens when someone files a fraudulent tax return using your Social Security number to claim your refund. The IRS flags millions of returns each year for suspected identity theft. In one recent year, the agency initially froze $7.5 billion in claimed refunds through its Taxpayer Protection Program.3Taxpayer Advocate Service. TAS Research Reports – Annual Report to Congress 2024 Victims typically discover the problem when their legitimate return gets rejected because one has already been filed under their Social Security number.
Employment identity theft is closely related. A thief uses your Social Security number to get a job, and the wages their employer reports to the IRS show up on your tax record. An SSA Office of Inspector General audit found that in one three-year period, roughly 37,700 employers reported approximately $1 billion in wages tied to the Social Security numbers of over 36,500 children aged 13 and younger.4Office of the Inspector General. Social Security Administration’s Role in Combatting Identity Fraud Children are common targets precisely because nobody checks their credit reports for years.
Medical Identity Theft
Medical identity theft occurs when someone uses your name and insurance details to receive healthcare, fill prescriptions, or submit claims. Beyond the financial damage of bills for procedures you never had, this category carries a unique physical danger: a thief’s medical history can contaminate your records. If incorrect blood type data, allergies, or diagnoses end up in your file, a doctor treating you in an emergency could make decisions based on someone else’s health profile. Correcting medical records is also harder than disputing a credit card charge because healthcare privacy laws create additional procedural layers.
Criminal Identity Theft
Criminal identity theft happens when someone gives your name and identifying information to police during an arrest or traffic stop. Warrants, charges, and even convictions can appear on your record for things you had nothing to do with. Victims often find out only when they’re pulled over for a routine stop and learn there’s an outstanding warrant in their name, or when a background check for a job comes back with someone else’s criminal history. Clearing fraudulent criminal records generally requires court appearances and fingerprint comparisons to prove you aren’t the person who was actually arrested.
Synthetic Identity Theft
Synthetic identity theft blends real data with fabricated information to create an entirely new persona. A thief might pair a real child’s Social Security number with a fake name and date of birth, then spend years building credit under that invented identity before maxing out accounts and disappearing.4Office of the Inspector General. Social Security Administration’s Role in Combatting Identity Fraud Because the resulting identity doesn’t match any single real person’s complete profile, creditors and credit bureaus often fail to flag the fraud for years. This is the hardest type to detect, and often the most damaging by the time anyone catches it.
How Thieves Get Your Information
Physical Methods
Low-tech theft remains surprisingly effective. Searching through residential or commercial trash can turn up bank statements, pre-approved credit offers, and tax documents with enough information to open accounts. Stealing mail directly from a mailbox is another common approach. New credit cards, government checks, and financial statements all arrive in plain envelopes. Thieves also steal wallets and purses for the driver’s licenses, insurance cards, and debit cards inside.
Digital Methods
Phishing uses deceptive emails designed to look like messages from your bank or a government agency. The email directs you to a fake website where you enter login credentials or personal information. Vishing applies the same concept over the phone, with callers spoofing legitimate numbers and pressuring you into providing account details or Social Security numbers. Smishing works through text messages containing links to fraudulent websites or phone numbers.
Skimming involves small electronic devices placed over card readers at gas pumps or ATMs. The device captures data from your card’s magnetic strip as you swipe. On a larger scale, data breaches at corporations expose millions of records at once. These breaches provide thieves with names, Social Security numbers, and financial data in bulk, which then gets sold on dark web marketplaces.
Federal Criminal Penalties
The penalties for identity theft under 18 U.S.C. § 1028 scale with the severity of the offense:2Office of the Law Revision Counsel. 18 U.S.C. 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
- Up to 5 years for general identity theft offenses, including unauthorized use of another person’s identifying information.
- Up to 15 years for offenses involving fraudulent government-issued documents like birth certificates or driver’s licenses, or when the stolen identity yields $1,000 or more in value during any one-year period.
- Up to 20 years for identity theft committed to facilitate drug trafficking, in connection with a violent crime, or by someone with a prior identity theft conviction.
- Up to 30 years for identity theft committed to facilitate domestic or international terrorism.
All penalty tiers also carry potential fines, and courts must order forfeiture of any personal property used in the offense.2Office of the Law Revision Counsel. 18 U.S.C. 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
Aggravated Identity Theft
A separate federal statute, 18 U.S.C. § 1028A, adds a mandatory prison sentence on top of whatever punishment the underlying crime carries. If someone uses another person’s identity while committing a qualifying federal felony, the court must impose an additional two years of imprisonment. If the offense is connected to terrorism, the mandatory add-on jumps to five years. These extra years cannot run at the same time as the sentence for the underlying felony. They stack on top of it. Courts are also prohibited from reducing the sentence for the underlying crime to compensate. Probation is not an option for anyone convicted under this statute.5Office of the Law Revision Counsel. 18 U.S.C. 1028A – Aggravated Identity Theft
Your Liability for Fraudulent Charges
Federal law limits how much a victim can lose from unauthorized transactions, but the rules differ depending on whether a credit card or debit card was compromised.
For credit cards, your maximum liability for unauthorized charges is $50, and that cap only applies if the fraudulent use happens before you report the card lost or stolen.6Office of the Law Revision Counsel. 15 U.S.C. 1643 – Liability of Holder of Credit Card Once you notify the issuer, you owe nothing for subsequent charges. In practice, most major card issuers waive even the $50 as a matter of policy.
Debit cards and other electronic fund transfers follow stricter timelines under the Electronic Fund Transfer Act. If you report a lost or stolen card within two business days of discovering the problem, your liability caps at $50. Wait longer than two business days and your exposure rises to $500. If unauthorized transfers appear on your statement and you don’t report them within 60 days, you could lose everything the thief takes after that 60-day window.7Office of the Law Revision Counsel. 15 U.S.C. 1693g – Consumer Liability The gap between credit card and debit card protections is one of the most important things identity theft victims need to understand. Speed matters far more with a debit card.
What to Do If You’re a Victim
The single best starting point is IdentityTheft.gov, the FTC’s dedicated recovery portal. You answer questions about what happened, and the site generates a personalized recovery plan with pre-filled letters and step-by-step checklists tailored to your situation.8Federal Trade Commission. IdentityTheft.gov
Filing a police report strengthens your legal position considerably. Combining the FTC’s Identity Theft Affidavit with a police report creates what the Fair Credit Reporting Act calls an “Identity Theft Report,” which unlocks the strongest protections: a seven-year extended fraud alert, the right to permanently block fraudulent accounts from your credit file, and the ability to stop debt collectors from pursuing debts the thief created.9Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Place a credit freeze with all three major bureaus immediately. A fraud alert asks lenders to verify your identity. A freeze blocks access to your report entirely, which is the stronger option, and since 2018 federal law requires all three bureaus to let you place and lift freezes for free.10Federal Trade Commission. Credit Freezes and Fraud Alerts11Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts Then dispute any fraudulent accounts directly with the credit bureaus in writing. Under the FCRA, the bureau must investigate and remove inaccurate information, typically within 30 days.12Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
If a thief has filed a tax return using your Social Security number, submit IRS Form 14039 (Identity Theft Affidavit).13Internal Revenue Service. Identity Theft Affidavit Form 14039 For future returns, enroll in the IRS Identity Protection PIN program. Anyone with a Social Security number or Individual Taxpayer Identification Number can request a six-digit PIN that must be included on your tax return for it to be accepted, which blocks fraudulent filings.14Internal Revenue Service. Get an Identity Protection PIN For employment-related identity theft, where someone is working under your Social Security number, report the misuse to the Social Security Administration’s Office of the Inspector General.15Social Security Administration. Fraud Prevention and Reporting Unreported employment fraud can create tax problems for years, because the IRS may think you earned income you never received.