How Does Identity Theft Happen?

What Is Identity Theft?

Identity theft occurs when criminals steal sensitive data or documents, such as your Social Security number (SSN), login credentials, driver's license or passport and use it without your permission. With the right information, they may be able to gain access to your existing financial accounts, open new accounts in your name, steal your tax refund, collect benefits in your name and more.

Identity theft can wreak havoc on your finances and credit. Because of the many ways criminals use technology to steal information, you may not be aware that your data has been compromised.

How Does Identity Theft Happen?

Identity thieves can get your information in many ways.

Data Breaches

Nearly 279 million people had their personal information compromised in a data breach in 2025, according to the nonprofit Identity Theft Resource Center (ITRC). Data breaches occur when thieves gain unauthorized access to electronic records containing sensitive information, such as names, addresses, SSNs, credit card information and other data.

Criminals may sell information they acquire during a data breach or use it to try to gain access to your accounts, steal money, open lines of credit and more.

Example: Someone gains unauthorized access into your favorite retailer's electronic records and steals thousands of names, email addresses and credit card data, including yours. They then use your credit card information to make fraudulent purchases.

Theft

A stolen wallet, purse, electronic device or mail can give thieves access to your financial statements, credit cards, debit card and driver's license. They may be able to use the information and documents they steal to access your accounts, apply for credit in your name or take over your identity.

Example: A fraudster steals mail out of your mailbox and uses the information on your bank statement and preapproved credit offer to open a line of credit in your name without your knowledge. The next time you review your credit reports, you see accounts you didn't open with reported delinquencies and chargeoffs.

Smishing

Smishing uses fraudulent text messages to trick users into sending money or divulging personal information. Smishers may pretend to be someone from your bank investigating a suspicious purchase, the U.S. Postal Service letting you know a package couldn't be delivered or a charitable organization asking for a donation after the latest natural disaster.

Example: You receive a text message from the IRS saying your taxes are overdue. It warns you could be subject to fines, jail and other penalties if you don't pay them immediately. The message includes a link for you to make a payment, but rather than paying the IRS, you're sending your payment details to the fraudsters.

Phishing

Similar to smishing, phishing scams use email messages to trick you into sending money or sensitive data or downloading malware on your device. Phishing emails may be threatening, have suspicious email addresses, include misspellings or contain grammatical errors, and they often require "immediate" action.

Example: You receive an email with an invoice for a product similar to one you recently purchased saying you haven't paid yet. The email includes a link where you can pay for your product. If you click on the link to "make a payment," the scammers will capture your payment information.

Vishing

When fraudsters take to the phone lines to scam you, it's called vishing. The number they're calling from may even be one you recognize because scammers can spoof phone numbers of people and businesses you have an existing relationship with, such as your bank, employer, credit card company or a government agency.

Example: A caller says they're from your bank and there's suspicious activity on your account. They ask you to "verify" your information by providing your SSN and account number. They use the information you provide to access your bank account.

Skimming

Your credit or debit card could be at risk at point-of-sale terminals or when getting cash from the ATM. Scammers install a device called a skimmer or shimmer over the card reader that can read your credit or debit card information. Then, they create a fake card and use it to make fraudulent purchases or steal money from your accounts.

Example: A criminal installs a shimmer over the card reader at your local gas station. When you pay with your credit or debit card, the device captures your card information. The scammer uses the stolen data to create a fake card with your information and uses it to make unauthorized purchases.

Wi-Fi Hacking

Wi-Fi hacking occurs when criminals intercept your data while you're using an unsecured or compromised wireless network. They may also create fraudulent Wi-Fi hotspots with names that sound like legitimate networks.

Example: You log in to what you think is the airport's Wi-Fi while you're waiting to catch your flight. You don't realize at the time, however, that it's a fake network controlled by an attacker who steals information users enter while connected to it.

Unsecure Browsing

When you enter your name, address, phone number, email address and credit card information on an unsecured site, thieves may be able to access it. Checking for "https" at the beginning of a web address and a lock icon in your browser bar is no longer enough. Cybercriminals are including these elements on dangerous websites, making it more important than ever to stick with sites you know.

Example: You click on an ad for a retailer you're familiar with, but the ad is a fake that takes you to a fraudulent website. It looks the same as the site you always use, so you make your purchase. Instead of the purchase going through at checkout, scammers capture the information you entered.

Dark Web Marketplaces

Not all identity thieves use the information they steal for themselves. Some sell it on the dark web to other scammers who may use it to gain unauthorized access to accounts or steal a person's identity. Information sold may include passwords, payment card information, Social Security numbers and other personal data.

Example: A hacker sells hundreds of usernames and passwords they obtained during a data breach on the dark web. An identity thief buys the data and uses it to gain unauthorized access to victims' email, financial and online shopping accounts.

Social Media Accounts

If you have enough information on your social media accounts, fraudsters may be able to piece it together to steal your identity. Public posts that include names, birthdays, locations, family relationships, employers and other personal details can help criminals scam victims. Scammers may also clone your profile and use it to target others.

In 2025, almost 30% of people who reported losing money to a scam said it began on social media, according to the U.S. Federal Trade Commission (FTC).

Example: A fraudster creates a fake profile in your name and sends a message about a GoFundMe campaign "you" set up to raise money for a sick family member. People in your network who click on the fundraising link to support you send money to the scammers instead.

Shoulder Surfing

Shoulder surfing occurs when fraudsters steal your identity by watching as you input usernames, PINs, passwords and account numbers on your device in public.

Example: While waiting to meet someone for lunch, you decide to catch up on paying your bills. The person at the table next to you records the information you enter and uses it to access your accounts.

Fake Job Postings

Scammers pose as recruiters or post fake job listings online to collect sensitive information from job seekers. During the interview process they may ask for your name, address, SSN and birth date or tell you that you need to pay for materials, equipment or training before your first day on the job. If you give them your information, they may be able to use it to access your accounts.

Example: A recruiter reaches out on a professional networking site about a job that sounds legitimate. After multiple rounds of interviews, they make you an offer. But before you can start, you have to buy training materials. When you "purchase" the materials on the website the scammer provides, they steal your money, and it's unlikely it will be recovered.

Warning Signs of Identity Theft

If you notice any of the following, don't ignore them. They could signal identity theft.

• Suspicious account activity: Your credit card statements list purchases you don't recognize, and your bank statement lists withdrawals or debit card purchases you didn't make.
• Missing mail: You stop receiving credit card, bank, investment and insurance statements you used to get in the mail.
• Credit denials: Your application for a loan or credit card gets denied, even though you had no derogatory marks the last time you reviewed your credit reports.
• Accounts you don't recognize: Your credit reports list accounts you didn't open.
• Duplicate tax returns: When you try to file your tax return, you get a notice from the IRS saying it's a duplicate.
• Ineligibility for benefits: You get denied when you apply for unemployment, insurance or Social Security benefits because they've already been used.
• Account lockout: You can't access your online accounts, which may mean someone has changed your login credentials.
• Payments stop: You suddenly stop receiving unemployment or Social Security benefits without explanation.
• Activity alerts: You receive alerts from your bank or credit card company about account activity you don't recognize.
• Fraudulent statements: You receive statements for loans or credit cards in your name that you didn't apply for.
• Collection calls: You receive calls from debt collectors for accounts you never opened.

How to Protect Yourself From Identity Theft

No single action can prevent identity theft, but safeguarding your information can make it less likely. Here's how.

• Use unique passwords. Create strong passwords for your devices and online accounts. Don't store passwords in your browser, and consider using a password manager to keep track of them.
• Activate "find my device." Android and iPhone operating systems allow you to remotely delete information on your phone, watch or other devices if they're lost or stolen.
• Watch for fake texts and emails. Never open an attachment or click on a link in an email or text message from someone you don't know. If you're unsure whether a message is legitimate, contact the business directly.
• Limit what you carry with you. To minimize the damage from a lost or stolen wallet or purse, take only what's necessary. Leave the rest at home, and never carry your Social Security card with you.
• Be careful what you share online. Adjust your privacy settings; don't add location tags to your posts; and think twice about completing online quizzes and surveys. These can provide small nuggets of information criminals may be able to use to commit identity theft.
• Bring your mail inside every day. If you're going on vacation, place a hold on it until you return. Shred all documents you receive that contain sensitive data before throwing them away, and if you need to mail a check or bill with your account information on it, take it to the post office—don't leave it in your mailbox for the mail carrier. Someone could steal it before the postal carrier arrives.
• Safeguard sensitive documents. Keep sensitive information in a locked safe in your home or safe deposit box at your local bank or credit union. If you receive financial statements through the mail, consider switching to electronic versions.
• Don't give out personal information over the phone. Don't answer calls from numbers you don't recognize, and be aware that scammers can spoof phone numbers of people and businesses you know.
• Enable multifactor authentication (MFA). MFA requires two pieces of information to log in to an account, adding an extra layer of protection.
• Ensure your Wi-Fi network is encrypted. Never use the manufacturer's password or wireless network name. Update your router software regularly and change your password every few months.
• Sign up for dark web monitoring. Services like Experian's identity theft protection plans regularly check the dark web for your Social Security number, phone number and email address to ensure they're not being misused.
• Be vigilant in public. Avoid sensitive activities such as banking and shopping on unsecured public networks. When using an ATM, mobile phone, laptop or tablet, block the view of anyone who might be watching. Consider using a screen protector or wait until you get home to access sensitive data.

What to Do if Your Information Has Been Compromised

If you believe your personal information has been compromised, take steps to help repair the damage.

1. Report the theft to the FTC. You can report identity theft to the FTC at IdentityTheft.gov. They will help you create a recovery plan and provide a report you can use to prove your identity if necessary.
2. Review your credit reports. Checking your credit reports with all three consumer credit bureaus (Experian, TransUnion and Equifax) will alert you to potentially fraudulent activity. You can review your Experian credit report for free anytime or check your credit reports from all three bureaus at AnnualCreditReport.com. You have the right to dispute information on your credit reports that you believe to be fraudulent to have the inaccurate information removed.
3. Place a fraud alert on your credit reports. You have the right to place a fraud alert, which instructs companies to verify your identity before opening credit in your name. You also have the right to freeze your credit, which means no one—including you—can open new accounts in your name.
4. Contact providers where there was fraud. This may include your bank, credit union, credit card company, utility company, phone company or other business. Cancel affected credit and debit cards, and close or freeze compromised accounts. Ask your providers to remove fraudulent charges from your legitimate accounts.
5. File a police report. You may need a copy of a report from your local police department to repair any damage the identity thieves caused.

For more information on what to do after identity theft occurs, check out IdentityTheft.gov.

Frequently Asked Questions

The Bottom Line

Identity theft can happen to anyone at any time, but you can take steps to protect yourself from identity theft. If you believe you've been a victim of identity theft, it's important to act quickly to minimize the damage. Experian's free credit monitoring alerts you to changes in your credit report to help you discover and correct inaccurate information as soon as possible.