Identity thieves get your personal information in six main ways: they trick you into handing it over, buy or steal it from breached databases, sneak malware onto your devices, take it physically from your mail or wallet, intercept it on unsecured networks, or piece it together from what’s already public. Knowing how each method works is what lets you shut it down before a thief can open an account in your name.
Deception: Phishing, Smishing, Vishing, and Pretexting
Most identity theft starts with a lie. The thief doesn’t break into anything; they get you to open the door. The FBI’s Internet Crime Complaint Center logged more than 193,000 phishing and spoofing complaints in 2024 alone, with reported losses topping $70 million.1FBI Internet Crime Complaint Center. 2024 IC3 Annual Report
Phishing emails are the most common version. A message that looks like it came from your bank, a delivery service, or the IRS asks you to click a link and “verify” your account. The link goes to a fake login page that captures whatever you type. The same trick works over text (smishing) and phone (vishing), where a caller claims to be from a fraud department and pressures you to read back account numbers or one-time codes.
Pretexting goes further. Instead of a mass blast, the thief researches you first and builds a believable story. They might call your phone company posing as you, armed with enough personal details to pass the security questions, and redirect your number to a device they control.2Legal Information Institute. Pretexting These attacks work because they exploit psychology, not software. Slow down when a message creates urgency, and call the company back on a number you looked up yourself, not one the caller gave you.
Data Breaches
When a retailer, hospital, or government agency is breached, millions of records can spill at once. Stolen data typically pairs your name with a Social Security number, driver’s license number, or financial account details.3National Association of Attorneys General. Data Breaches You have no control over how well those organizations guard their databases, which is what makes breaches so frustrating.
Every state and the District of Columbia now requires notification when your data is exposed. Those letters usually come weeks or months later and include an offer of free credit monitoring. Monitoring is worth activating, but it only alerts you after someone has already tried to use your information. A credit freeze is a stronger shield because it stops new accounts from being opened at all.
Malware
Malware is software that runs on your device without your knowledge. It usually arrives through a deceptive download, an infected email attachment, or a compromised website, and once installed it works quietly in the background.
- Keyloggers record every keystroke, capturing passwords, card numbers, and logins as you type them.
- Spyware tracks your browsing and can harvest saved credentials, autofill data, and files.
- Trojans pose as legitimate software and open a backdoor that lets a thief access your system remotely.
The common thread is that malware needs a way in, so the entry point is where you defend. Keep your operating system and browser updated, avoid downloads from unfamiliar sources, and run reputable antivirus software.
Physical Theft
Some of the oldest methods still work because they need nothing more than opportunity. Stealing mail is a federal crime punishable by up to five years in prison, and it stays common because tax documents, bank statements, pre-approved credit offers, and insurance letters contain enough to open a fraudulent account.4Office of the Law Revision Counsel. 18 U.S. Code 1708 – Theft or Receipt of Stolen Mail Matter Generally A stolen wallet is more direct, putting a driver’s license, credit cards, and sometimes a Social Security card into someone else’s hands.
Dumpster diving sounds crude, but discarded bank statements, medical bills, and old tax returns are useful to anyone willing to dig. A cross-cut shredder eliminates that risk almost entirely.
Skimming and Shoulder Surfing
Skimmers are small hardware overlays criminals attach to ATMs and point-of-sale terminals. According to the U.S. Secret Service, ATM skimmers are typically inserted deep inside the card reader and are nearly impossible to spot from the outside, while point-of-sale overlays are made to look identical to the terminal’s surface and capture both card data and PIN entries.5U.S. Secret Service. ATM and POS Terminal Skimming If a card reader feels loose, bulky, or different from the machines next to it, don’t use it.
Shoulder surfing is lower-tech: someone watches over your shoulder as you type a PIN or password. It happens most often in crowded places where standing close raises no suspicion. Shielding the keypad with your hand defeats it.
Network Interception
Public Wi-Fi in coffee shops, airports, and hotels used to be genuinely dangerous because data traveled in the clear. Modern sites overwhelmingly use HTTPS, which encrypts your connection to the site and makes casual interception much harder. The risk hasn’t gone away, though. Thieves can still set up fake hotspots with names like “Airport_Free_WiFi” that mimic a real network. Once you connect, your traffic runs through the thief’s device, and they can capture credentials or push you toward phishing pages.
A VPN on public networks adds an encryption layer that renders intercepted traffic useless. Without one, stick to HTTPS sites and skip sensitive tasks like banking until you’re on a network you trust.
Public Records and Pieced-Together Information
Sometimes a thief doesn’t need to steal anything. They just collect what you’ve already shared. A birthdate on Facebook, a pet’s name on Instagram, an employer on LinkedIn, and a home address from public property records can, together, answer enough security questions to take over an account. Federal courts have recognized this risk and now require Social Security numbers, financial account numbers, and dates of birth to be redacted from electronic case filings.6United States Courts. Privacy Policy for Electronic Case Files Lock down social profiles, limit what you post about milestones and family, and avoid using easily discoverable answers for security questions.
Synthetic Identity Fraud
A growing variation blends stolen and made-up data. In synthetic identity fraud, a thief takes a real Social Security number and pairs it with a fake name, birthdate, and address to create a new “person.”7FedPayments Improvement. Synthetic Identity Fraud Defined Because the resulting identity doesn’t match any existing profile, it slips past standard fraud detection. The real owner of the Social Security number may not find out for years, often when they apply for credit and see accounts they never opened. Children and elderly adults are frequent targets because their numbers are less likely to be in active use.
Why Children Are Targeted
A child’s Social Security number is especially valuable because it typically has no credit history attached. Fraud can go undetected for a decade or more, until the child applies for a student loan or first credit card and finds accounts opened years earlier.
Warning signs include pre-approved credit offers arriving in a child’s name, denial of government benefits because the Social Security number is already tied to another account, or the discovery of an existing credit file for a child who has never been added as an authorized user.
Federal law lets a parent or legal guardian place a credit freeze on a child’s file with each of the three nationwide credit bureaus. If no file exists yet, the bureau must create one solely to freeze it. You’ll need to provide proof of authority, such as a birth certificate.8Consumer Advice. New Protections Available for Minors Under 16 Freezing a child’s credit before anyone can exploit it is one of the strongest preventive steps a parent can take.
What to Do If Your Identity Is Stolen
Speed matters. The faster you move, the less a thief can do with what they have.
- Place a fraud alert. Contact any one of the three major credit bureaus (Equifax, Experian, or TransUnion) and request an initial fraud alert. That bureau must notify the other two. An initial alert lasts one year and signals lenders to verify your identity before extending credit.9Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
- Freeze your credit. A freeze is stronger than an alert because it blocks new accounts entirely until you lift it. Freezes are free under federal law, and each bureau must place one within one business day of an online or phone request. Contact all three bureaus individually.10Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
- Report to the FTC. File at IdentityTheft.gov. The site generates a personalized recovery plan with step-by-step instructions and pre-filled letters for creditors, debt collectors, and the credit bureaus.11Consumer Advice. Planning for 2026: Add Identity Theft Awareness Week to Your Calendar
- File a police report. A local police report combined with your FTC report creates an official identity theft report, which you’ll need if you want an extended fraud alert (good for seven years) or if you have to dispute fraudulent debts.12Consumer Advice. Credit Freezes and Fraud Alerts
- Block fraudulent accounts. Under the Fair Credit Reporting Act, you can ask the credit bureaus to block information resulting from identity theft from your file. Once a fraudulent debt is blocked, the creditor or collector cannot sell, transfer, or keep collecting on it.
If the damage is significant, upgrade an initial fraud alert to an extended one or leave your credit frozen indefinitely. A freeze costs nothing and stays in place until you remove it. You can lift it temporarily when you need to apply for credit, then refreeze right after.