What Is Identity Theft?

Identity theft is the unauthorized use of another person's personal information (name, date of birth, national ID number, financial details) to commit fraud in their name. It is the umbrella crime under which most identity-based online fraud sits: opening a loan the victim never applied for, filing a tax refund before they do, or gaining access to accounts that should be theirs alone. What makes identity theft distinctly costly to its victims is asymmetry: the crime happens using an identity, but the consequences land on the person the identity belongs to, often long after the theft itself and far from where it occurred.

Where stolen identities come from

Personal data enters the criminal economy through several channels that converge on the same underground marketplaces: large-scale data breaches exposing millions of records at once, phishing that harvests details one victim at a time, email scraping that builds contact and employer context around a target, and physical theft of mail or documents. Complete identity bundles, combining a name with a date of birth, government ID number, and financial details, circulate as fullz, priced by completeness and freshness. A single breach can seed years of downstream fraud, since victims rarely learn their data was exposed until it is already being used.

How stolen identities get used

Two distinct fraud patterns follow from the same stolen data. True-name fraud uses a real, complete identity to open new accounts, apply for credit, or take over existing ones, the direct route into account takeover and fake account creation built on someone else's name. Synthetic identity fraud takes the more patient path: a real Social Security or national ID number is combined with a fabricated name and history to build a synthetic account that has no genuine person to complain when the fraud is eventually discovered, which is why synthetic identities often operate far longer than stolen-identity fraud before detection.

Reducing exposure at both ends

Individuals limit exposure through data minimization habits, such as sharing less, monitoring credit files, and freezing credit when not actively borrowing, but the more consequential defense sits with the organizations verifying identity at scale. Because most identity theft is monetized through automated account creation and login attempts rather than one attacker manually impersonating one victim, bot detection at registration and authentication endpoints interrupts the economics: CaptchaFox verifying that a human, not a script, is submitting an application catches the volume-driven abuse that turns one breach into thousands of fraudulent accounts. Identity verification and bot verification are complementary rather than redundant: one confirms who someone claims to be, the other confirms that a person is making the claim at all.