Identity theft is the unauthorized acquisition and use of someone’s personal information (name, Social Security number, financial account details, or credentials) to commit fraud, typically by impersonating the victim to access money, credit, or services. Unlike synthetic identity fraud, which fabricates a person, identity theft targets a real individual, who becomes the victim of the crime.

Identity theft is the raw material for much downstream fraud. Once a criminal holds enough of someone’s personal data, they can open accounts, take over existing ones, file fraudulent claims, or sell the information on, and the victim often discovers it only after the damage is done.

The main types

• Financial identity theft: using stolen data to access bank accounts, open credit, or make purchases, the most common form.
• Account takeover: hijacking a victim’s existing accounts (a specific, high-impact form of identity theft).
• New-account fraud: opening new accounts in the victim’s name.
• Medical identity theft: using someone’s identity to obtain healthcare or prescriptions.
• Tax and benefits fraud: filing fraudulent tax returns or claiming benefits in the victim’s name.
• Criminal identity theft: giving a victim’s identity to authorities during an arrest.

How identities are stolen

The data behind identity theft comes from many sources: large-scale data breaches that leak personal records en masse, phishing and social engineering that trick victims into handing over information, malware that harvests credentials, physical theft of documents or mail, and the aggregation of scattered personal data from social media and data brokers. Much of this stolen data ends up traded on the dark web, feeding a whole economy of fraud. The sheer volume of breached data means most people’s information is exposed somewhere, which is why identity theft is so pervasive.

The impact on victims

For victims, identity theft can be financially and emotionally devastating: drained accounts, fraudulent debts, damaged credit that takes years to repair, and hours of effort to reclaim their identity. Warning signs include unexpected accounts or charges, denied credit for no clear reason, missing mail or statements, and alerts about logins or changes the person didn’t make. The lag between theft and discovery is often what makes it so damaging.

Identity theft vs. synthetic identity fraud vs. ATO

These related terms are worth separating. Identity theft uses a real person’s real identity. Synthetic identity fraud fabricates a (partly or wholly) fake identity with no single real owner. Account takeover is a specific outcome of identity theft, using stolen credentials or data to seize a victim’s existing account. Understanding which is in play matters, because the defenses differ: protecting real identities (and the accounts tied to them) versus detecting fabricated ones.

How to prevent identity theft

For individuals, the defenses are data hygiene: strong, unique credentials (ideally passkeys), caution against phishing, monitoring accounts and credit, and freezing credit where possible. For the businesses that hold and rely on identities, prevention means protecting the data they store (so they don’t become the breach), stopping the fraud that stolen identities enable (strong identity verification at onboarding, phishing-resistant authentication against takeover, and fraud detection across the lifecycle) and, ideally, storing less sensitive data in the first place. Since stolen identities fuel account takeover and new-account fraud, the same defenses that stop those attacks limit what identity theft can achieve.

The dark web economy behind identity theft

Identity theft is powered by a mature underground economy. Stolen personal data (credentials, full identity profiles ("fullz"), card details, and account access) is bought and sold on dark web marketplaces at commodity prices, often in bulk from breach dumps. This industrialization is why identity theft is so pervasive and so cheap to commit: an attacker doesn’t need to steal data themselves, only to buy it. Specialized sellers, checker tools, and fraud-as-a-service offerings lower the barrier further, so even unsophisticated criminals can obtain and exploit stolen identities. The practical implication for businesses is sobering: assume the personal data your customers use to authenticate is already exposed somewhere, which is exactly why knowledge-based checks and static personal data make weak defenses, and why possession- and biometric-based verification and phishing-resistant authentication matter so much.

Frequently asked questions

Where do stolen identities get sold?

On dark web marketplaces, often in bulk from data breaches, alongside tools and fraud-as-a-service offerings that make exploitation cheap.

Does identity theft always involve financial fraud?

No. It also includes medical, tax, benefits, and criminal identity theft, though financial identity theft is the most common.

What is identity theft?

The unauthorized use of someone’s personal information to commit fraud by impersonating them.

What’s the difference between identity theft and synthetic identity fraud?

Identity theft uses a real person’s real identity; synthetic fraud fabricates an identity with no single real owner.

How do criminals steal identities?

Through data breaches, phishing, malware, physical theft, and aggregating personal data, much of it traded on the dark web.

What are the warning signs of identity theft?

Unexpected accounts or charges, unexplained credit denials, missing mail, and alerts about changes you didn’t make.

How can businesses help prevent identity theft?

Protect stored data, verify identities at onboarding, use phishing-resistant authentication, and detect fraud across the lifecycle.

Related: Account Takeover (ATO) · Synthetic Identity Fraud · New Account Fraud · Phishing · Dark Web · Credential Stuffing