When your driver's license and credit cards are sitting snugly in your wallet feet away, it's easy to assume your identity is safe. But in reality, scammers are working hard behind the scenes to steal your data — and impersonate you for their own financial gain.
Identity theft, also called identity fraud, occurs whenever a person wrongfully takes someone else's information and pretends to be them. It's a widespread problem in the U.S., and it's an expensive one. According to Javelin Strategy and Research, some $16.9 billion was lost to identity fraud in 2019.
Identity theft is a particularly scary crime because the stakes are so high — it's your money and reputation, after all — and you might not even realize what's happening until the damage is done. Worse yet, recovering from identity theft takes a ton of time and effort.
With the rise of social media, identity theft schemes have grown more sophisticated. From shoulder surfing — where people spy over your shoulder as you enter your PIN — to phishing emails, "fraudsters are always looking for new ways to steal people's information," says Paige Schaffer, the CEO of global identity and cyber protection services at Generali Global Assistance. (For a list of website breaches where your data was compromised, check out Money's new identity theft tool).
They'll take whatever they can get: Your name, Social Security number, address, bank account, credit card number and more. Children and elderly Americans are especially at risk.
So how do you protect your money against identity theft? Here's what you need to know.
How does identity theft happen?
There are several types of financial identity theft, but the two major ones are application fraud and account takeover fraud.
As the name suggests, application fraud occurs when someone uses your identity to apply for and open a new bank or credit card account without your knowledge or consent. They'll rack up charges and not pay them, let the account go bad and — in a worst-case scenario — ruin your financial standing in the process. This is also called "new account fraud."
Account takeover fraud, meanwhile, occurs when someone commandeers your existing bank or credit card account. A bad guy will hack in and pretend to be you, either by cracking your password or by engineering a reset. They may even call your bank and trick the agent on the phone into sending a new card to their address.
This is where your data comes into play. Schaffer says there are pieces of your identity all over the dark web. Your credit card number may have been exposed in one data breach; your zip code leaked in another. You may have posted the answers to your security questions — like your first pet or mother's maiden name — while participating in a Facebook trend.
"We are out there, in so many ways, online," Schaffer adds.
Once fraudsters obtain these facts on the internet and weaponize them, they have full access to your money. They may access your online banking portal to wire out your savings or use an ATM to clean out your checking account. They may even trick you into sending them money voluntarily, like through a sketchy Kickstarter or an authorized push payment scam.
"Consumers need to be extra vigilant about what is legitimate and what is not, because scammers will prey on your goodwill and your anxiety — any situation that makes you uncomfortable," says Liz Lasher, vice president of fraud, financial crime and cyber risk portfolio marketing at FICO.
How identity theft affects you
With account takeover, the consequences are immediate but limited.
If you have $5,000 in your bank account and someone transfers it all out, you no longer have that $5,000 — but you'll probably be able to get it back. Your liability is limited under the Fair Credit Billing and Electronic Fund Transfer acts, especially if you report the purchase or lost card promptly. On top of that, most banks and credit card companies have zero-liability policies that protect you from actually losing money in fraudulent transactions.
Even though the money isn't necessarily gone forever, these situations often take a while to resolve. If rent comes due in that period, you may be out of luck.
Application fraud, on the other hand, can affect your credit report. If someone opens an account in your name and doesn't pay the bills, it can "negatively impact your ability as a legitimate consumer to get access to credit in the future until you've contested those charges," Lasher says.
That's because one big factor in your credit score is your payment history. In this example from FICO, a 22-year-old with two credit accounts who missed a payment by 90 days saw his score drop by over 150 points. The credit bureaus typically have to investigate disputed claims with 30 days, but it can take a while for your score to return to normal — especially if you don't notice the fraud right away.
"The consumer may not know for a very long period, and in the meantime, a lot of damage is being done," Schaffer adds. "Something more invasive like this may take months and, in some extreme cases, years to correct."
Other kinds of identity theft could result in you not receiving a benefit you deserve. Take unemployment fraud, for instance. If an impostor has already filed for unemployment in your name and then you attempt to claim it, you might find you're not eligible to get money you sorely need.
Will identity theft cost you money?
A 2014 report from the Department of Justice found that roughly two-thirds of victims said they had financial losses stemming from identity theft. Those who suffered both direct and indirect losses — the latter of which includes charges like legal fees and postage — lost an average of $1,343. Some 14% of victims ended up with out-of-pocket expenses.
That's only looking at dollar figures, though. Identity theft is a colossal time suck: The DOJ report found that the average victim spent an average of seven hours dealing with issues related to identity theft. Other estimates range from 100 to 1,200 hours.
Resolving identity theft involves contacting several entities, and most are only open during business hours. As such, victims are often forced to take time off work to deal with it. Time off can mean lost income.
Schaffer adds that there's a huge emotional toll, as well. Victims are stressed and worried about their financial futures, leaving them in a headspace that can affect their ability to work and make money. The DOJ report found that of the people who had to spend six months or more dealing with financial and credit problems after identity theft, 29% felt severe distress.
"It's not a matter of hours, it's a matter of investing days in this recovery process," Lasher says. "It can be quite burdensome and scary and difficult."
What to do if you suspect your identity has been stolen
It's a smart idea to regularly check your credit reports to make sure nothing's amiss. You can get one free credit report per year from each of the major credit bureaus, Equifax, Experian and TransUnion. Do this at annualcreditreport.com or by calling 1-877-322-8228.
Because of the pandemic, all three credit bureaus are allowing consumers to pull their credit reports for free once a week through April 2021. You can also get six free credit reports every year through 2026 through Equifax, due to legal settlements in connection with its 2017 data breach.
Consider setting up alerts on your bank account and credit cards that notify you after every transaction. Between these alerts and your credit report monitoring, you should know as soon as possible if your identity has been stolen. The faster you catch it, the easier it is to fix.
The Federal Trade Commission has a helpful guide to what to do if you think your identity has been stolen. (The IRS, for its part, has a robust guide for dealing with suspicious tax returns and other forms of tax-related identity theft).
First, contact the companies where the fraud occurred and tell them to freeze your account(s). Then, change your passwords.
Next, put a fraud alert on your credit report. If you tell one of the credit bureaus, it will inform the other two. Fraud alerts last for one year; they instruct creditors to verify your identity before opening a new line of credit or upping your limit.
After that, contact the FTC. You can report identity theft at identitytheft.gov or by calling 1-877-438-4338. Finally, file a report with your local police department.
Recovering from identity theft may also involve replacing your ID cards and clearing your name of criminal charges. For tax-related identity theft, check out
How to prevent identity theft
One of the best ways to prevent identity theft is to practice what Lasher calls "good password hygiene."
"It's not just about using @ symbols and exclamation points anymore," she says. "What really helps are long passwords."
Long passwords are harder to crack through brute force, or repeated trial-and-error attempts by a scammer. You should also have unique passwords for each of your accounts, and you should consider using a secure password manager to keep track of them all. Finally, if you can, utilize multi-factor authentication that texts your cell phone or uses an app to verify you're you when logging in.
"It adds another layer that blocks the fraudster from using your identity," Lasher says. "They're looking for low-hanging fruit. The friction you've introduced can deter them."
Constant vigilance and smart behavior are crucial in preventing identity theft, too. Products advertised in Instagram ads may catch your eye, but don't let shopping lead you to a sketchy website, Schaffer says. Before giving up your payment information, check to see if a company is reputable by Googling it or looking it up with the Better Business Bureau.
It's important to make sure you have up-to-date firewalls and use protected Wi-Fi networks. Schaffer says to never click links in emails; if you want to visit a website, type in its name yourself. While you're at it, check that the website you're shopping on has a security lock (a small lock icon in your browser's address bar.) Then go a step further: Click the lock to see its security certificate, and make sure the name on the certificate matches the name on the website.
If you have the money and inclination, you can buy identity theft insurance, which often provides restoration services that greatly reduce the time and effort victims have to spend setting things right after experiencing fraud.
State Farm, for example, offers a $25 policy that comes with a case manager "who'll work directly with your credit card companies, credit bureaus, creditors, and other financial institutions for up to one full year for a covered incident." Allstate Identity Protection has a $9.99 individual plan that helps cover restoration costs, reimbursing victims for legal expenses and wages lost while dealing with the fraud.
There are also services that help prevent identity theft on the front end. Identity monitoring tools can notify you if your passport or Social Security card shows up on the dark web. But checking your credit report, opting into account alerts and strengthening your passwords is free.
Take those steps and avoid a headache later.