The difference between identity theft and identity fraud comes down to two separate acts: identity theft is stealing someone’s personal information, and identity fraud is using that stolen information to deceive a business, lender, or government agency for financial gain. The distinction sounds like semantics, but it determines what crime a prosecutor charges, what protections a victim can claim, and which steps actually unwind the damage. The Federal Trade Commission received over 1.1 million identity theft reports in 2024, with credit card fraud alone accounting for nearly 450,000.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 Many of those reports involve both theft and fraud. Some involve only one.
Identity Theft Is the Taking
Identity theft is the unauthorized acquisition of someone else’s personal information. A thief who obtains your Social Security number, date of birth, or login credentials has committed identity theft the moment they have the data, whether or not they ever use it. The crime is in the taking.
The methods range from sophisticated to crude. Phishing emails impersonate banks or government agencies and trick people into entering passwords on fake login pages. Corporate data breaches expose millions of records at once and feed an underground market where stolen profiles are bought and sold in bulk. On the low-tech end, stolen mail, discarded bank statements pulled from the trash, and shoulder-surfing at ATMs still work.
Once your information is out, you’ve lost exclusive control over it. That loss is complete whether or not anyone exploits it. In many breach situations, stolen records sit dormant for months or years before anyone tries to use them, and some are never used at all. The theft is still the first harm.
Identity Fraud Is the Using
Identity fraud picks up where theft leaves off. It’s the active use of someone else’s personal information to deceive a third party for financial benefit. Theft is about acquisition; fraud is about exploitation.
Credit card fraud is the most common form. Someone uses your card number for unauthorized purchases or opens entirely new accounts in your name. Tax refund fraud is another major category: a criminal files a return under your Social Security number and collects the refund before you file your own. Others take out personal loans, apply for government benefits, or rent apartments using a stolen identity. Each of these creates a paper trail of obligations tied to someone who never agreed to them.
The harm reaches past the dollar amount. Victims spend months disputing charges, correcting credit reports, and untangling records that now carry someone else’s activity. Collection agencies pursue debts the victim never incurred, and credit scores take hits that can affect housing and employment background checks for years.
Why the Distinction Matters
Theft and fraud are independent events that often overlap but don’t have to. You can be the victim of identity theft without ever experiencing fraud. This happens routinely in data breaches: a company loses millions of records, and many of those stolen profiles are never actually used. The theft is complete; no fraud follows.
The reverse is also possible. A person can commit identity fraud using information they never personally stole. Dark web marketplaces sell stolen identities in bulk, so the person who opens a fraudulent credit card account may have simply bought your data from a third party. The thief and the fraudster are often different people.
That separation has real legal weight. Prosecutors can charge the data thief and the fraudster independently. Someone who steals a database full of Social Security numbers faces charges even if they never use a single one. Someone who buys that data and opens fake accounts faces different charges for the fraud itself. When the same person does both, they face charges for each act separately.
How Federal Law Treats Each Side
Federal law addresses identity crimes mainly through two statutes, each aimed at a different link in the chain.
18 U.S.C. § 1028: The Documents and Information Side
Section 1028 covers producing, transferring, and possessing false identification documents, and it covers possession or transfer of another person’s identifying information. The Identity Theft and Assumption Deterrence Act of 1998 amended the statute to make it a standalone federal crime to use another person’s identifying information to commit any unlawful activity, whether that activity violates federal law or qualifies as a felony under state law.2Federal Trade Commission. Identity Theft and Assumption Deterrence Act
Penalties scale with the offense. The base maximum for general violations is 5 years in prison. Producing or transferring false versions of specific documents like driver’s licenses or birth certificates raises the ceiling to 15 years. When identity crimes connect to drug trafficking, violent crimes, or a prior conviction, the maximum rises to 20 years. If the crime facilitates terrorism, the maximum reaches 30 years.3Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
18 U.S.C. § 1028A: The Use-in-a-Felony Side
Section 1028A is the statute aimed squarely at identity fraud. Anyone who uses another person’s identifying information during the commission of certain felonies receives a mandatory two-year prison sentence on top of whatever sentence the underlying felony carries. That two-year term cannot run concurrently with other sentences, and no judge can shorten the underlying felony sentence to compensate for it. The court is also barred from substituting probation. If the identity theft connects to terrorism, the mandatory add-on rises to five years. The qualifying felonies are extensive, covering mail fraud, wire fraud, bank fraud, immigration violations, theft of government property, and many more.4Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
The split between the two statutes mirrors the split between the two acts. Section 1028 reaches the person who takes or traffics the information. Section 1028A reaches the person who puts it to work in another crime. States also maintain their own identity theft statutes, so offenders can face prosecution at both federal and state levels for the same conduct.
What the Distinction Means for a Victim
Which protections apply to you depends on whether your situation is pure theft or has moved into fraud.
If Only Your Data Was Taken
When a breach exposes your information but no fraudulent accounts have appeared, the useful tools are preventive. You can place a fraud alert with any one of the three major credit bureaus, which must notify the other two. An initial fraud alert lasts one year and tells lenders to take extra steps to verify your identity before granting credit.5Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts A credit freeze goes further, blocking new credit accounts entirely until you lift it, and it’s free to place and remove with each bureau.6Consumer.ftc.gov. Credit Freezes and Fraud Alerts
If Fraud Has Already Occurred
Once someone has used your information, a different set of protections kicks in, and reporting speed starts to matter. Federal law caps your liability for unauthorized credit card charges at $50 regardless of how much the thief spends, and most issuers waive even that through zero-liability policies.7Office of the Law Revision Counsel. 15 US Code 1643 – Liability of Holder of Credit Card
Debit cards and bank account transfers are less forgiving. Report the unauthorized activity within two business days of learning about it and your liability caps at $50. Wait between 2 and 60 days and it rises to $500. After 60 days from when your statement was sent, you could be liable for the full amount of unauthorized transfers that occur after that window.8eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers A fraudulent credit card charge is an inconvenience. A fraudulent debit card charge left unreported for two months can empty your account with no legal recourse.
Fraud victims also get a tool theft-only victims don’t. Once you submit an FTC Identity Theft Report at IdentityTheft.gov identifying the fraudulent entries, credit reporting agencies must block that information from your file within four business days and notify the company that furnished the data.9Office of the Law Revision Counsel. 15 US Code 1681c-2 – Block of Information Resulting from Identity Theft That report, often paired with a police report many creditors require, is the document that unlocks the strongest recovery rights.10Federal Trade Commission. Identity Theft It also qualifies you for an extended fraud alert that lasts seven years, longer than the one-year initial alert available to anyone.
So when someone asks whether what happened to them is theft or fraud, the honest answer is that it may be one, the other, or both, and the answer dictates what to do next. If your data was exposed but not used, you’re protecting against a crime that hasn’t yet happened. If your data has been used, you’re unwinding one that has. The two problems share a vocabulary but not a solution.