The common causes of identity theft fall into a handful of channels: large data breaches at companies that hold your records, online scams and malware, physical theft of mail and cards, social engineering that talks you into handing information over, and misuse by people who already have access to you. From those raw sources, criminals run specialized schemes like synthetic identities, tax refund fraud, and medical billing fraud. The FTC received more than 1.1 million identity theft reports through IdentityTheft.gov in 2024, with credit card fraud topping the list at nearly 464,000 reports, followed by government documents or benefits fraud, loan fraud, and bank fraud.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024
Data Breaches at Companies That Hold Your Information
You can do everything right and still be exposed. When a company, hospital, or government agency is hacked, the stolen records typically include names, addresses, Social Security numbers, dates of birth, credit card numbers, bank account details, login credentials, and health records.2Computer Security Resource Center. Personally Identifiable Information Once that data reaches criminal markets, it gets used to open fraudulent accounts, run up purchases, or assemble new identities.
Every state, the District of Columbia, and U.S. territories now require organizations to notify you when your data has been compromised.3National Conference of State Legislatures. Security Breach Notification Laws Take those letters seriously. Breached data feeds most of the attacks that follow.
Online Attacks
Phishing and Smishing
Phishing emails and smishing texts impersonate banks, delivery services, or government agencies and steer you to fake sites that harvest login credentials, Social Security numbers, or payment details. The fakes are often good enough to catch careful readers.
Malware
Malware installed through a bad link, attachment, or download can log your keystrokes, pull passwords from your browser, and quietly transmit financial data back to the attacker. Nothing looks wrong while it’s running.
Public Wi-Fi
Networks at coffee shops, airports, and hotels often lack encryption, which means anyone else on the network can potentially intercept your traffic. A virtual private network adds a layer of protection when you have to use one.
Credential Stuffing
Reusing passwords turns a single breach into many. Once your username and password leak from one site, automated bots try that combination on hundreds of others. These tools can bypass CAPTCHAs and spoof IP addresses, and every successful match becomes another account to drain.
Physical Theft
Bank statements, credit card offers, tax documents, and insurance mailings all contain enough information to be useful. Pre-approved credit card offers are especially valuable because a thief can activate the card and begin spending before you know the offer arrived. Mail theft is a federal crime carrying up to five years in prison.4Office of the Law Revision Counsel. 18 U.S. Code 1708 – Theft or Receipt of Stolen Mail Matter Generally
Wallets and Purses
A single theft can yield your driver’s license, credit and debit cards, insurance cards, and sometimes your Social Security card. That bundle is enough to make purchases, drain accounts, and apply for new credit before you cancel anything.
Dumpster Diving
Household trash is a surprisingly reliable source. Bank statements, credit card bills, and even junk mail carry names, account numbers, and sometimes Social Security numbers. Shredding anything with personal details before you throw it out closes this channel almost entirely.
Card Skimmers
Skimming devices attached to ATMs, gas pumps, and retail terminals capture card data when you swipe or insert. Many setups add a hidden camera or a fake keypad overlay to grab your PIN. Check the reader for anything loose, bulky, or misaligned before you use it, and shield the keypad with your hand.5United States Secret Service. ATM and POS Terminal Skimming
Social Engineering
Social engineering works on trust, urgency, and fear rather than technical exploits. The goal is to get you to hand over information voluntarily.
Impersonation
Scammers pose as IRS agents, bank fraud investigators, tech support, or law enforcement. They manufacture an emergency: your account is compromised, you owe back taxes, your computer is infected.6Federal Trade Commission. How To Avoid Imposter Scams The panic is the strategy. Impersonation of government agencies and businesses in interstate commerce is now prohibited by an FTC rule.7Federal Trade Commission. Trade Regulation Rule on Impersonation of Government and Businesses
Pretexting
Pretexting is a more targeted version. A caller invents a plausible role, such as bank security verifying a suspicious transaction or HR confirming employment for a background check, so that answering questions feels routine.8Legal Information Institute. Pretexting
AI Voice Cloning
Voice cloning tools can replicate a person’s voice from a few seconds of audio scraped off social media or voicemail. Scammers use cloned voices to call relatives with fake emergencies claiming a loved one has been arrested, injured, or kidnapped and needs money now. The FTC advises hanging up and calling the supposed person back at a number you already have for them.9Federal Trade Commission. Fighting Back Against Harmful Voice Cloning
Social Media Details
Your birthday, hometown, employer, pet’s name, and vacation photos help scammers answer security questions and craft convincing phishing messages. Quiz posts asking about your first car or childhood street are often harvesting the exact answers banks use to verify you.
Someone You Know
This is the cause most people don’t want to consider. FTC survey data found that in roughly a quarter of cases, victims knew who misused their information. Among those who could identify the thief, about 35 percent named a family member or relative, and when the fraud involved opening new accounts rather than just misusing existing cards, family members accounted for 52 percent of identified thieves.10Federal Trade Commission. Identity Theft Survey Report
Relatives, roommates, and close friends already have physical access to your mail, documents, and devices, and they often know the answers to your security questions. This kind of theft can go undetected for months because you aren’t looking for it.
Who and What Thieves Target
Children
Children’s Social Security numbers usually go unmonitored for years, and their credit files start clean. A stolen SSN can be used to open credit cards, take out loans, or apply for benefits, and the fraud often surfaces only when the child turns 18 and applies for their first credit card or student loan. Children in foster care face elevated risks because their information passes through multiple adults. A federal review found credit reports already existed for 4 percent of foster children who received credit checks, a red flag given that minors generally cannot sign contracts or apply for credit.11Office of Inspector General. Most Children in Foster Care Did Not Receive Credit Checks and Assistance
Synthetic Identity Fraud
Instead of stealing your whole identity, criminals mix a real piece of your information (usually your SSN) with a fabricated name, address, and date of birth to create a person who doesn’t exist. They build credit under the synthetic profile for months or years, then max everything out and disappear. Losses crossed $35 billion in 2023.12Federal Reserve Bank of Boston. Gen AI Is Ramping Up the Threat of Synthetic Identity Fraud The Social Security Administration’s move to randomized SSN issuance has made these fabricated numbers harder for fraud systems to spot by format alone.
Tax Refund Fraud
Someone files a return using your SSN to claim your refund before you do. Most victims find out only when the IRS rejects their real return as a duplicate, which can delay a legitimate refund for months. The stolen information usually comes from one of the causes above. The IRS handles reports through its Identity Theft Central resource.13Internal Revenue Service. Identity Theft Central
Medical Identity Theft
Thieves use your name, SSN, or health insurance to obtain medical care, prescription drugs, or to bill insurers. HHS’s Office of Inspector General warns this can contaminate your health records with someone else’s diagnoses, blood type, or medication allergies, which can lead to dangerous treatment decisions in an emergency.14Office of Inspector General. Medical Identity Theft It often surfaces only when you get an unexpected bill or an insurer denies coverage because your benefits have been exhausted.
How To Reduce Your Exposure
The strongest single step is a security freeze on your credit reports at Equifax, Experian, and TransUnion. A freeze blocks new credit accounts from being opened until you lift it, and federal law requires the bureaus to place and lift freezes for free.15Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Freezes don’t affect your credit score or your existing accounts.
If you suspect exposure but haven’t confirmed fraud, an initial fraud alert lasts at least a year and requires lenders to take extra steps to verify you. If you’ve already filed an identity theft report, an extended fraud alert lasts seven years. You only need to contact one bureau; it must notify the other two.
If theft has already happened, start at IdentityTheft.gov, which generates a recovery plan and pre-filled letters for creditors and bureaus.16Federal Trade Commission. Report Identity Theft Day to day, use a unique password for every account, turn on two-factor authentication wherever it’s offered, shred documents before discarding them, check your credit reports on a regular schedule, and be skeptical of any unsolicited request for personal information no matter how urgent it sounds.