What Is Online Identity Theft? Legal Definition and Types

Online identity theft is a federal felony in which someone knowingly uses personal information gathered through digital channels — your Social Security number, financial account details, login credentials, or other identifying data — to commit fraud or another crime. The core federal statute, 18 U.S.C. § 1028, makes the unauthorized use itself the offense; prosecutors don’t have to prove you lost money for the crime to apply.¹ For victims, federal law also builds in liability caps, credit-file protections, and a defined recovery process. Knowing the definition, the categories, and your rights is what keeps a bad week from turning into years of cleanup.

The Federal Legal Definition

The Identity Theft and Deterrence Act of 1998, codified at 18 U.S.C. § 1028, made identity theft a standalone federal felony. The statute reaches anyone who knowingly transfers, possesses, or uses another person’s identifying information without lawful authority and with intent to commit or assist any illegal activity that violates federal law or qualifies as a felony under state or local law.¹ Penalties reach up to 15 years in federal prison plus fines, with sentencing scaled to the scope of the scheme and the number of victims.

The “identifying information” at the center of these cases is what federal agencies call personally identifiable information, or PII. The National Institute of Standards and Technology defines PII as any data that can distinguish or trace someone’s identity, either on its own or combined with other linked information — Social Security numbers, dates of birth, biometric records like fingerprints, and financial account numbers all qualify.² When that data is harvested online and used for fraud, the federal statute applies no matter where the victim or perpetrator sits.

A separate statute, 18 U.S.C. § 1028A, raises the stakes for a defined set of underlying felonies. If someone uses another person’s identifying information while committing fraud, immigration offenses, theft of government benefits, or certain other listed crimes, the court must add a mandatory two-year prison term on top of the sentence for the underlying felony. When the underlying crime is a terrorism offense, the add-on jumps to five years. Two features make this provision especially punishing: the extra time must run consecutively, not concurrently, and the court cannot shorten the underlying sentence to offset it. Probation is unavailable for anyone convicted under this section.³

Common Types of Online Identity Theft

Financial Identity Theft

The most straightforward form. A thief uses your Social Security number, bank details, or card information to make purchases, open new credit lines, or drain existing accounts. You usually discover it when unfamiliar charges appear or a creditor contacts you about a debt you never took on. The immediate harm is financial; the longer-term harm shows up on your credit report and can take months to untangle.

Medical Identity Theft

Someone uses your name or insurance information to obtain healthcare, fill prescriptions, or bill your insurer for procedures you never had. Beyond the money, your medical records can end up contaminated with another person’s blood type, allergies, or drug history, which can translate into a dangerous treatment decision during a genuine emergency. This type is harder to spot because most people don’t routinely review their explanation-of-benefits statements.

Synthetic Identity Theft

Rather than fully impersonating one person, a thief combines a real Social Security number with a fabricated name and address to construct a new identity. The hybrid persona doesn’t belong to any single individual, which makes it slippery for monitoring systems to flag. The thief builds credit for the fake identity over months, then maxes out the credit lines and disappears. The real owner of the Social Security number often finds out only when a creditor comes looking.

Child Identity Theft

Children are appealing targets precisely because nobody checks their credit. A thief can use a child’s Social Security number for years before anyone notices, often not until the child applies for a first student loan or job. Warning signs include pre-approved credit card offers arriving in a child’s name, collection calls for debts a minor couldn’t have incurred, or IRS notices about a tax return filed under the child’s Social Security number.⁴ If any of these show up for your child, check their credit file immediately.

Criminal Identity Theft

Someone presents your identifying information during a police encounter — a traffic stop, an arrest, a background check — and the record attaches to your name. Victims often discover the problem at the worst possible moment: a job background check, or a traffic stop that turns into a detention because of an outstanding warrant they knew nothing about. Clearing a wrongfully attributed record typically requires a police report, a court petition for a finding of factual innocence, and expungement, a process that can take months and often needs an attorney.

Tax Identity Theft

A thief files a federal tax return using your Social Security number and claims a fraudulent refund before you file your legitimate return. You usually find out when the IRS rejects your return as a duplicate or sends you a CP5071 notice asking you to verify your identity.⁵ The IRS offers a preventive tool called the Identity Protection PIN: a six-digit number you enroll in through your IRS online account. Any return filed without the correct IP PIN is rejected, blocking fraudulent filings before they process.⁶

How Information Gets Stolen Online

Phishing is still the most common entry point. A thief sends an email that looks like it came from your bank, a shipping company, or a government agency, hoping you’ll click through and enter your credentials on a fake page. Spear-phishing is the targeted version, built from details scraped off your social media or public records so the message feels personal. The same playbook runs through other channels: vishing uses phone calls that impersonate trusted organizations, and smishing does the same through text messages with links to fraudulent login pages. All three lean on urgency — a suspended account, a suspicious charge, a stuck delivery — to override your caution.

Malicious software is the quieter route. Keyloggers install silently through an infected attachment, a compromised website, or a fake software update, then record every keystroke, capturing passwords and card numbers as you type. Spyware takes a broader approach, monitoring browsing and reaching stored files. Once installed, these programs transmit your data to servers the attacker controls, often with no visible sign on your device.

Large-scale data breaches at corporations and government agencies expose millions of records at once. Thieves sell the bulk data on dark web marketplaces, where other criminals buy individual records for targeted fraud. A single breach can keep your information in circulation for years, because stolen data recirculates long after the original intrusion is patched.

Public Wi-Fi at coffee shops, airports, and hotels is another quiet source. On an unsecured network, an attacker can slip between your device and the connection point in what’s called a man-in-the-middle attack and intercept what you send and receive. Any site that doesn’t use HTTPS encryption exposes your login details to anyone listening. Logging into banking or email over public Wi-Fi without a VPN is a real risk, not a theoretical one.

Signs Your Identity Has Been Stolen

Most victims don’t realize what’s happened until something goes visibly wrong. The sooner you catch it, the less damage accumulates. Watch for:

Password-change confirmations you didn’t request, logins from devices or locations you don’t recognize, or two-factor codes arriving unprompted.
Charges on bank or card statements you don’t recognize, including small ones. Thieves often test an account with a low-dollar charge before scaling up.
A sudden drop in your credit score, accounts on your credit report that you never opened, or hard inquiries from lenders you never contacted. You can pull free weekly reports from the three major bureaus at AnnualCreditReport.com.
Bills arriving for services you didn’t sign up for, or regular statements that suddenly stop coming. The second pattern often means a thief changed your mailing address to divert your mail.
An IRS notice about a return you didn’t file, income you didn’t earn, or a refund you didn’t request.⁵
Wages on your Social Security earnings statement from an employer you’ve never worked for. Check your record by signing in at ssa.gov.⁷
Explanation-of-benefits statements listing procedures, prescriptions, or doctor visits you don’t recognize.

Federal Financial Protections

Federal law caps how much identity theft can cost you, but the protections split sharply between credit cards and debit cards. The difference catches many victims off guard.

Credit Card Liability

Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and only if the thief used the physical card before you reported it lost or stolen. Once you notify the issuer, you owe nothing on later charges.⁸ Most major issuers waive even the $50 by policy. If the thief used only the card number rather than the physical card, federal law imposes zero liability.

Debit Card Liability

Debit cards are far less forgiving, and this is where people get hurt. Under the Electronic Fund Transfer Act, your liability is tied directly to how fast you report the problem:⁹

Report within 2 business days of learning the card was lost or compromised: liability caps at $50.
Report after 2 business days but within 60 days of your statement being sent: liability can reach $500.
Report after 60 days: you can be on the hook for the full amount of unauthorized transfers that occur after that 60-day window.¹⁰

Put plainly: if a thief drains your checking account through your debit card and you don’t notice for two months, the bank has no legal obligation to make you whole. Speed matters with debit card fraud in a way it doesn’t with credit cards.

Credit Freezes and Fraud Alerts

The Fair Credit Reporting Act gives you the right to place a free security freeze on your file at all three major bureaus. A freeze blocks any new creditor from pulling your report, which effectively prevents a thief from opening accounts in your name. The bureau must place the freeze within one business day of an electronic or phone request, and lifting it when you need to apply for credit is also free.¹¹

A fraud alert is a lighter alternative. An initial fraud alert lasts one year and tells creditors to verify your identity before opening new accounts. Victims who file an identity theft report qualify for an extended alert lasting seven years. An alert doesn’t block access to your file; it adds a verification step, and not every creditor treats it as mandatory.¹¹ A freeze is the stronger tool. If you know your information has been exposed, a freeze is almost always the right move.

What to Do If You’re a Victim

Act quickly. The following steps run roughly in priority order, though several can happen in parallel.

1. File a report at IdentityTheft.gov. The FTC’s site walks you through a questionnaire and immediately generates two things: an official Identity Theft Report, which you’ll need for disputes with creditors and credit bureaus, and a personalized recovery plan with pre-filled letters and step-by-step instructions.¹² Create an account so you can track progress and update the plan. If you skip the account, print everything before leaving the page.

2. Place a credit freeze. Contact Equifax, Experian, and TransUnion separately. You can request a freeze online, by phone, or by mail, and an electronic or phone request must be processed within one business day.¹¹ This is the single most effective step to stop new fraudulent accounts.

3. File a police report. IdentityTheft.gov creates a report that satisfies many creditors, but some companies and all three credit bureaus require a police report before they’ll block fraudulent accounts from your credit file. File with your local department, bring your FTC Identity Theft Report, and keep a copy for your records.

4. Notify your bank and card issuers. Call the fraud department of every financial institution where you hold accounts. Close or freeze compromised accounts and request new card numbers. For debit card fraud, this call directly affects how much you can recover under federal law.⁹

5. Handle tax-related theft with the IRS. If your return was rejected as a duplicate, or you received an IRS notice about income you didn’t earn, file Form 14039 (Identity Theft Affidavit). The IRS prefers online submission at irs.gov, though you can also fax or mail the form.¹³ Going forward, enroll in the IRS Identity Protection PIN program, which generates a new six-digit number each year and is available to any taxpayer who can verify their identity.⁶

6. Report Social Security misuse. If someone is using your Social Security number for employment or benefits, report it to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov or by calling 1-800-269-0271.¹⁴ Review your earnings record at ssa.gov at least once a year.⁷

7. Report mail diversion. If you suspect a thief filed a fraudulent change-of-address form, report it to the U.S. Postal Inspection Service at uspis.gov. Redirected mail is often the mechanism that delays discovery of the fraud in the first place.

1
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
2
National Institute of Standards and Technology. PII – Glossary
3
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
4
Social Security Administration. Identity Theft and Your Social Security Number
5
Internal Revenue Service. Understanding Your CP5071 Series Notice
6
Internal Revenue Service. FAQs About the Identity Protection Personal Identification Number (IP PIN)
7
Social Security Administration. Review Record of Earnings
8
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
9
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
10
Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
11
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts
12
Federal Trade Commission. IdentityTheft.gov
13
Internal Revenue Service. Identity Theft Affidavit Form 14039
14
Social Security Administration. Fraud Prevention and Reporting