Identity theft statistics 2026: facts and data by source

An examiner who reads a fraud risk assessment will ask three things about any identity theft number in it: which source, which edition, and what the source counts. A report count, a complaint count and a survey estimate measure different things. Each figure below names all three.

Why do identity theft statistics differ by source?

Each publisher counts a different unit: reports, complaints, survey answers, breach notices or member filings, each on its own calendar.

Table 1. Identity theft statistics by source, current edition as of 30 October 2026

Anyone studying identity theft stats needs to know the unit before the number. The FTC and IC3 count what people chose to report, without verifying it. In the FTC's Data Book 2024, 14 percent of identity theft reports named more than one type, so its type rows add up to more than the total (p. 14). The ITRC's Trends in Identity Report counts the people who contacted the center, and its method note says the result is not a measure of prevalence (p. 41).

Only surveys estimate how many people are hit. Javelin's runs every year; the BJS household survey was last published for 2021. Cifas and UK Finance count what member firms file, and Cifas calls it identity fraud.

For your fraud team the importance of the edition is practical: pick one source per question, cite it with its edition and page, and match it to your customers. A US card issuer reads the FTC's credit card rows; a UK lender reads Cifas.

How common is identity theft in the US?

Identity theft is the second largest of 29 report categories in the FTC's Consumer Sentinel Data Book 2024: 1,135,291 reports, 17.5 percent of all 6,471,708, behind complaints about credit bureaus and information furnishers (1,353,175) (p. 7). The FTC's reports page listed no 2025 Data Book as of 30 October 2026, so 2024 is the newest full FTC year. Spread over 2024's 366 days, that is about 3,100 reports a day, a derived figure.

On the complaint count in IC3's 2025 Internet Crime Report, the scope keeps widening: 31,675 identity theft complaints in 2025, up 48 percent from 21,403 in 2024 and 19,778 in 2023 (p. 25). Surveys put the Americans affected far higher: 18 million identity fraud victims in 2025 (Javelin) and about 23.9 million people 16 or older, 9 percent, in 2021 (BJS).

Table 2. How common is identity theft in the US: the counts side by side

A category that large belongs in your onboarding risk assessment as a standing input. The IC3 rise is a complaint trend, so set it beside your own confirmed application fraud before you move a threshold.

Identity theft data published in 2026

Seven publications moved these numbers this year.

• January. The ITRC's 2025 Annual Data Breach Report counted a record 3,322 US data compromises for 2025.
• 12 March. Cifas's Fraudscape 2026 counted a record 444,993 UK cases for 2025, 242,003 of them identity fraud.
• 25 March. The FTC's statement to the Joint Economic Committee gave 3 million fraud reports and $15.9 billion reported lost in 2025, but no identity theft count.
• April. IC3's 2025 report counted 31,675 identity theft complaints.
• 21 April. Javelin put 2025 new account fraud victims at 5.4 million, up 31 percent.
• 22 July. The ITRC's H1 2026 report counted 471,206,085 victim notices, above all of 2025.
• 4 August. Cifas's six month update showed identity fraud up 9 percent to 129,490 cases and unauthorized SIM swaps up 402 percent.

What do identity theft statistics show in the UK, Canada and worldwide?

No publisher counts identity theft worldwide, and rankings of fraud by country rest on other measures. The comparable national identity series come from the UK and Canada, while Eurostat's EU household series on internet security problems ends in 2019.

Table 3. Identity theft and identity fraud outside the US, by jurisdiction

Identity fraud was the largest UK case type in both Cifas periods, and 72 percent of all 2025 cases were linked to identity fraud or facility takeover. UK Finance's card ID theft fell for a second year from its 2023 peak. The CAFC logged 108,878 reports in 2024 but had processed 50,676 of them by the end of January 2025, so its counts are a snapshot (p. 5).

Read each market's source on its own terms. In the UK, 68 percent of identity fraud in the first half of 2026 hit bank accounts and plastic cards, so put the heaviest identity checks on those two products.

Identity theft facts: which types are most common?

Picture a fintech onboarding team, an illustrative case, that sorts last quarter's confirmed identity cases into two piles: found at application and found after a login. Set beside the public data, the split shows whether the team's gaps sit at onboarding or at access.

The public data points both ways. In the FTC's Data Book 2024, credit card misuse led the identity theft types with 449,032 reports, most of them new accounts opened in a victim's name (406,110 new account reports against 52,428 on existing accounts, pp. 8, 14). The card count is up from 393,446 in 2020 (p. 15). Among people who contacted the ITRC, existing account takeover made up 50 percent of misuse and new accounts 37.9 percent. Javelin estimates 5.4 million new account fraud victims and 6 million account takeover victims in 2025.

Table 4. Identity theft facts by type, newest edition of each source

None of these sources counts synthetic identity fraud separately, so it has no row in Table 4.

Most misuse is a new account or a takeover, so your checks sit at two moments: identity verification when the account opens, and a fresh check at every login after.

complead, formerly Sanction Scanner, is an AI native platform that scores onboarding and later transactions against one customer record. Its real time fraud prevention answers each request with approve, decline, review or step up, and a review holds the session for a person to decide.

Who are the victims of identity theft by age?

Identity theft reports peak at ages 30 to 39, while losses rise with age.

Table 5. Identity theft by age: FTC reports (Data Book 2024, p. 16; 86 percent of reports gave an age) and FBI IC3 complaints and losses (2025 Internet Crime Report, pp. 32, 33, 47, 48)

Both US counts peak in the same decade: 291,807 FTC reports and 6,498 IC3 complaints came from people aged 30 to 39, and the CAFC names 30 to 39 as the age most hit by identity fraud in Canada. Losses climb instead, to $48.5 million at 60 and over, where identity theft complaints rose from 3,010 in 2023 to 5,359; IC3 reports that age band in its section on elder fraud. In the UK, Cifas says most identity fraud victims are 61 and over, while the sharpest rise in the first half of 2026 came among 21 to 30 year olds (up 32 percent).

How many children have their identity stolen?

These sources count reports, not how many children are affected. The FTC received 21,420 identity theft reports from people 19 and under in 2024, and 11,569 were employment or tax related, the group's largest type (p. 16). Fraudulent employment made up 40 percent of misuse against minors among ITRC contacts, and IC3 logged 181 complaints and $510,553 in losses from people 17 or younger in 2025.

Which states report the most identity theft?

Per 100,000 residents, Florida led the FTC's 2024 state rates with 528 (115,840 reports), ahead of Georgia (517), Nevada (466), Texas (393) and Delaware (392) (p. 21).

Back at onboarding, hold any application that uses a minor's identity data for a second look before approval, and give account changes by customers 60 and over the same care, since that is where the losses run highest.

How much identity theft happens online, and through which channels?

No source gives one share of identity theft that happens online. The closest measures are the routes people describe: among ITRC contacts, unauthorized device access rose from 15.3 to 27.2 percent of compromises while scams fell from 43.1 to 36.1 percent.

Table 6. Identity theft channels, by source

What each route means for account controls:

• A new device on an existing account. Device access rose among ITRC contacts while scams fell, a cybercrime route that arrives with the right password.
• A request to share personal details. Scams built on social engineering still lead the ITRC routes.
• A SIM change. Cifas ties the 2026 rise to swaps used to intercept security codes and get past account protections.
• A taken over shopping account. Online shopping and payment account reports to the FTC grew in 2024, and Cifas counted UK online retail account takeovers up 84 percent in the first half of 2026.

A SIM change, a new device and changed contact details in one week can be a single takeover, and together they justify a step up check before the next payment.

How much does identity theft cost?

Identity theft costs between $185.8 million and $27.3 billion a year in the US, depending on who counts. The low figure is what people reported losing in IC3 identity theft complaints in 2025, up from $174.4 million in 2024; the high one is Javelin's survey estimate of traditional identity fraud losses for the same year. BJS put 2021 losses at $16.4 billion, with 59 percent of victims losing $1 or more.

Table 7. What identity theft costs, and what each figure measures

Two of the largest numbers are not identity theft losses. The FTC's $15.9 billion covers all reported financial fraud, and FinCEN's $212 billion is the suspicious activity named in 2021 filings.

Recovery costs time as well. Javelin counts 10.4 hours on average to resolve identity fraud in 2025, against 9.5 in 2023. Among ITRC contacts, 53 percent with no financial loss reached a resolution, against 9 percent of those with one.

If you quote one of these costs in a business case for identity controls, give its publisher and say what the money measures.

How do data breaches feed identity theft?

Breaches are one route to identity theft: 10.2 percent of compromises among ITRC contacts began with one, and the US count of compromises set a record in 2025.

Table 8. Data breaches and identity theft, by source

The ITRC counts notices, not people, so one person named in three breaches counts three times, and it revised its 2025 totals in the H1 2026 report. Financial services was the most breached sector in 2025, while the largest event of the first half of 2026 hit an education platform: the breach of Canvas at Instructure Holdings produced an estimated 275 million notices, 58 percent of the half year.

BJS found identity theft victims twice as likely as nonvictims to have been told of a breach in 2021. The survey shows an association only. In FinCEN's 2021 data, depository institutions made about 1.3 million of the identity related filings, 54 percent.

A breach notice rarely shows how the attack worked: 76 percent lacked the attack vector in the first half of 2026. When you learn your customers were named in one, treat them as higher risk for account changes, such as a new phone number or payee, for a set period.

Every number here keeps its publisher's word: the FTC, IC3 and BJS say identity theft, while Cifas and the CAFC say identity fraud. When the FTC files stolen personal details used to open a new card account as identity theft and a Cifas member files the same event as identity fraud, which word belongs in your fraud policy?

How these figures were checked. Every figure was read on 30 October 2026 in its publisher's own PDF or web page, and each page number given here is the printed page label. Surveys are labeled as surveys. No total comes from a secondary site, and since no FTC Data Book for 2025 was out on that date, 2024 is the FTC year shown. One Cifas table row that does not add up was left out; the daily figure is arithmetic on the FTC count. Fact check: Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay. Last reviewed: the publish date.