How does identity theft happen

Content on WhatAnswers is provided "as is" for informational purposes. While we strive for accuracy, we make no guarantees. Content is AI-assisted and should not be used as professional advice.

Last updated: April 8, 2026

Quick Answer: Identity theft occurs when someone wrongfully obtains and uses another person's personal data, typically for financial gain. According to the Federal Trade Commission, identity theft reports surged to 1.4 million in 2021, a 113% increase from 2019. Common methods include data breaches, phishing scams, and physical theft of documents. The Identity Theft and Assumption Deterrence Act of 1998 made identity theft a federal crime in the United States.

Key Facts

Identity theft reports reached 1.4 million in 2021 according to FTC data
The Identity Theft and Assumption Deterrence Act was passed in 1998
Data breaches exposed over 22 billion records globally in 2021
Phishing attacks account for approximately 36% of identity theft incidents
Identity theft cost Americans $5.8 billion in 2021

Overview

Identity theft is the fraudulent acquisition and use of a person's private identifying information, usually for financial gain. The concept dates back centuries, but modern identity theft emerged with the rise of digital technology and electronic transactions. The term gained widespread recognition in the 1990s as internet usage expanded. In 1998, the U.S. Congress passed the Identity Theft and Assumption Deterrence Act, making identity theft a federal crime punishable by up to 15 years imprisonment. The problem has grown exponentially with digitalization - from 1998 to 2021, reported cases increased by over 1,000%. Today, identity theft affects millions globally, with the Federal Trade Commission reporting 1.4 million identity theft cases in 2021 alone, representing a 113% increase from 2019. The COVID-19 pandemic accelerated this trend as more activities moved online, creating new vulnerabilities.

How It Works

Identity theft typically begins with the collection of personal information through various methods. Data breaches at corporations and institutions expose millions of records annually - in 2021 alone, over 22 billion records were compromised globally. Phishing attacks, where criminals send deceptive emails or messages pretending to be legitimate organizations, account for approximately 36% of identity theft incidents. Physical methods include stealing mail, wallets, or documents containing personal information. Once obtained, thieves use this data to open new credit accounts, make unauthorized purchases, file fraudulent tax returns, or obtain medical services. More sophisticated operations involve creating synthetic identities by combining real and fake information. The dark web facilitates this criminal ecosystem, where stolen Social Security numbers sell for as little as $1 and complete identity packages for $30-$100. Thieves often use the stolen identities quickly before detection, making prevention challenging.

Why It Matters

Identity theft has profound real-world consequences for individuals and society. Financially, it cost Americans $5.8 billion in 2021 according to the FTC, with individual losses averaging $1,000-$2,000 per incident. Beyond monetary damage, victims spend an average of 200 hours resolving identity theft issues, dealing with credit bureaus, financial institutions, and law enforcement. The emotional toll includes stress, anxiety, and damaged credit scores that can take years to repair. For businesses, data breaches leading to identity theft result in significant financial penalties and reputational damage - the average cost of a corporate data breach reached $4.24 million in 2021. At a societal level, identity theft undermines trust in digital systems and increases costs for financial services, insurance, and healthcare. It also facilitates other crimes including money laundering, terrorism financing, and illegal immigration.