Identity theft is often read as the harmless step before the real crime. Federal law has punished knowingly possessing another person's identifying data with criminal intent since 2004, and in England, Wales and Northern Ireland the Fraud Act 2006 punishes holding data for use in a fraud.
Identity theft is the taking of someone's personal details. Identity fraud is their use to obtain credit, money, goods or an account, a form of fraud.
Which of the two a case is decides its team, statute and report, the identity half of fraud detection and prevention.
What is the difference between identity theft and identity fraud?
The difference is the moment of use. Identity theft is complete once another person's data is in the wrong hands; identity fraud begins when that data is presented to a firm to deceive it.
Table 1. One identity from taking to discovery (firm roles illustrative)
| Stage | Input | Output | Who decides at the firm |
|---|---|---|---|
| Take | Credentials, card numbers or personal details | A copy of another person's data | Security and privacy: was customer data acquired? |
| Hold or sell | The copied data | A file kept, sold or passed to an accomplice | Nobody yet, unless an alert or freeze reaches the firm |
| Use | The data presented to a firm | An application, a login, a payment or a claim | Onboarding or fraud: accept, step up or decline |
| Discovery | A dispute, returned mail or a victim's report | A case, a report and a record | Fraud investigator or BSA officer: file, block, disclose |
Data gets taken through a phishing message that asks for credentials, a breach of a firm's systems, an insider who copies customer records, or a skimmer on a card reader. Between taking and use it may change hands. FinCEN's review of 2021 Bank Secrecy Act reports describes attackers who "generate illicit proceeds from the sale of stolen credentials" or use them to open accounts and apply for credit (p. 8).
FinCEN also sorts identity related reports by the step the attacker beat: impersonation at validation, 69 percent of 2.4 million reports; circumvention of verification, 13 percent and $39 billion; and compromise of authentication, the use of stolen credentials to get into an account. Compromise was the costly one, 18 percent of reports but 32 percent of the suspicious amount, $112 billion (FinCEN Financial Trend Analysis, January 2024, Figure 3, p. 11).
Where does US federal law draw the line?
Before any use. 18 U.S.C. 1028(a)(7) makes it a crime to knowingly transfer, possess or use another person's means of identification "without lawful authority", with intent to commit, or in connection with, any violation of federal law or a state or local felony. Paragraph (7) dates from 30 October 1998 and "possesses" from 15 July 2004.
Aggravated identity theft, 18 U.S.C. 1028A, applies the same three verbs "during and in relation to" a listed felony such as wire fraud and adds two years.
US regulations use the term for the fraud itself: the SEC's 17 CFR 248.201 and the CFTC's 17 CFR 162.30 define identity theft as "a fraud committed or attempted" with another person's identifying information. So in US usage both stages are identity theft, and the statute tells them apart by verb.
What did Dubin v. United States change?
In Dubin v. United States (8 June 2023) a company manager had overbilled Medicaid on a claim bearing a patient's Medicaid number. The Supreme Court held that a means of identification is used "in relation to" a felony when "this use is at the crux of what makes the conduct criminal" (p. 131); with fraud, the deception goes to "who" is involved, not how or when a service was provided (pp. 123, 132). The Court vacated and remanded.
The opinion's three examples of classic identity theft map the stages: going through someone's trash takes possession, a bank employee who "passes along customer information to an accomplice" transfers it, and getting into that person's bank account is use (p. 126). A 2009 Supreme Court ruling also requires proof that the defendant knew the identification "belonged to another person".
The who or how test also separates identity fraud from transaction fraud. Identity fraud lies about who is acting, transaction fraud about the payment itself, and a stolen card used to buy goods does both.
How does UK law treat identity theft and identity fraud?
No UK Act names identity theft: a legislation.gov.uk search for the phrase returned eight instruments on 30 October 2026, all of EU origin. UK law charges each stage under its own offense:
- Getting in. Computer Misuse Act 1990 section 1, unauthorized access, up to two years on indictment.
- Obtaining the data. Data Protection Act 2018 section 170, obtaining personal data "without the consent of the controller"; selling data obtained that way is a further offense, and both carry a fine only (s196).
- Holding it for a fraud. Fraud Act 2006 section 6, possessing "any article for use in the course of or in connection with any fraud", up to five years in England, Wales and Northern Ireland; making or supplying one, section 7. Section 8 says an article "includes any program or data held in electronic form".
- Using it. Fraud by false representation, section 2 of the same Act.
Picture 10,000 records copied from a lender's server (an illustration). Breaking into the server falls under section 1, taking the records without the lender's consent under section 170, keeping them for loan applications under section 6, and the first application is fraud by false representation.
EU law names the harm: Directive (EU) 2019/713 requires member states to give victims of cashless payment fraud "committed by misusing personal data" advice and a list of support institutions (Article 16(1)). India is closer to the US: section 66C of its IT Act 2000, "Punishment for identity theft", punishes dishonest use of another person's password or electronic signature.
What do identity theft and identity fraud look like in a real case?
On 6 July 2026 the US Attorney's Office for the Middle District of Florida announced a plea that shows both stages and an earlier identity fraud. According to the plea agreement, Lexus Inez Lewis got a job in Citibank's fraud department in 2022 "by using another person's identity", identity fraud at hiring. From about November 2022 to April 2023 the employee used that position to obtain customers' credit card numbers, a taking by an insider, and used them for goods, travel and other people's rent. That is the use. The plea covers wire fraud and aggravated identity theft, with a consecutive two year minimum and a $463,619 forfeiture; no sentencing date was set at the plea.
The common types of identity fraud belong to the use stage and differ by what the data opens: an existing account in account takeover, a new account in application fraud, and a benefits or insurance payout in claims fraud. A synthetic identity built on a real person's Social Security number uses that person's means of identification, so the knowledge test above applies. Criminals who invent every detail use no other person's identity, and first party fraud, false details in the applicant's own name, involves no identity theft.
How does credit card fraud differ from identity theft?
Credit card fraud is a use: a card or its number is charged without authority. It is also identity theft when the number belongs to a real customer, because 1028 counts an access device, defined in 18 U.S.C. 1029(e), as a means of identification. The Citibank charges were both.
Is account takeover identity theft?
In US usage, yes. Account takeover uses taken credentials on an existing account, the step FinCEN calls compromise, and the SEC and CFTC definitions make any fraud with another person's identifying information identity theft. FinCEN's examples include unauthorized wire and peer to peer transfers (p. 8).
Which duties does each stage trigger for a firm?
The taking starts breach duties; the use starts fraud and suspicious activity duties, often for another team. Every institution holding customer data is vulnerable at the first stage, and every one that opens accounts or pays out at the second.
Table 2. Identity theft and identity fraud by what the firm must do (owning teams illustrative)
| Identity theft (the taking) | Identity fraud (the use) | |
|---|---|---|
| US offense | 18 U.S.C. 1028(a)(7), possessing or transferring | 1028(a)(7) use; 1028A beside bank or wire fraud |
| UK offense | Computer Misuse Act s1; DPA 2018 s170; Fraud Act s6 | Fraud Act s2 |
| First signal | A breach, a bureau alert or a credit freeze | A mismatch at onboarding, a takeover pattern, a disputed charge |
| Owning team | Security and privacy | Fraud and financial crime |
| Clock | Breach notice: without undue delay (UK GDPR); 30 days (FTC Safeguards Rule, Regulation S-P) | Bank SAR: 30 calendar days from detection, 60 without a suspect |
| Victim's request | A fraud alert of at least a year | A bureau block in 4 business days; the firm's records in 30 days |
Breach clocks start when data is acquired, used or not. UK GDPR Article 34(1) requires telling affected people "without undue delay" when a breach is likely to put them at high risk, and recital 75 lists "identity theft or fraud" among those risks. A financial institution under the FTC's Safeguards Rule must notify the FTC within 30 days of discovering that unencrypted information on 500 or more consumers was acquired without authorization.
Under Regulation S-P an SEC covered institution notifies affected individuals within 30 days.
Fraud clocks start at detection of the use: a bank files a suspicious activity report within 30 calendar days, or 60 when no suspect is identified (31 CFR 1020.320(b)(3)).
Say your bank learns on 2 March that a customer list was copied, and on 20 March sees an account opened in one of those names (illustrative dates). The breach review starts on 2 March and the SAR clock on 20 March. The two files have different owners.
How do firms detect identity theft and identity fraud?
Companies detect identity theft from signs that someone else holds the data, and identity fraud from what it is used for. The examples in 16 CFR 681, Supplement A cover both; the onboarding checks that prevent identity fraud are in the identity fraud entry.
Red flags that the data has been taken
- A fraud or active duty alert on the consumer report (item 1). A bureau has been warned.
- A notice of credit freeze (item 2). The consumer has locked the file.
- A notice of address discrepancy (item 3). The bureau holds another address.
Red flags that the data is being used
- A new card or added user soon after a change of address (item 19). Contact details moved first.
- A long inactive account suddenly used (item 22). Judged against the account's usual pattern.
- Mail returned while transactions continue, or statements not arriving (items 23, 24). Someone else has the address.
- Notice of unauthorized charges or a fraudulent account (items 25, 26). Someone outside saw it first.
Items 19 to 26 need monitoring after onboarding; checking the ID document itself is a separate control.
complead, formerly Sanction Scanner, watches the use stage: its device and behavior analysis scores each session from before login to payment and shows which signals drove the score, and its fraud prevention engine returns approve, decline, review or step up. A session held for review goes to an analyst, who decides.
What role do RegTech tools play at each stage?
RegTech tools mostly test the use. Identification under KYC, and KYB for companies, check who is presenting the data at onboarding. AML screening runs each name against sanctions and PEP lists, which tells the firm whose name was presented; the identity checks show whether that person is the one presenting it. Signs of the taking still come from outside, in bureau alerts and breach notices.
What should victims of identity theft do, and where do they report it?
US credit reporting law protects the victim at both stages. At the taking, anyone who suspects being a victim, or about to become one, can ask a bureau for a fraud alert of at least a year (FCRA section 605A). At the use, the bureau blocks fraudulent entries within four business days (section 605B), and a firm that dealt with the impostor gives the victim its records within 30 days on request (section 609(e)).
To report identity fraud or theft, US victims go to the FTC at IdentityTheft.gov. In England and Wales they use Report Fraud, the City of London Police's reporting service since 4 December 2025, when it took the place of Action Fraud (ONS).
New in 2026 on both sides of the line
- 5 February 2026. The Data (Use and Access) Act 2025 added investigating crime to the DPA section 170(2)(a) defenses.
- April 2026. The FBI's IC3 2025 report counted 67,456 personal data breach complaints and 31,675 identity theft complaints for 2025, against 64,882 and 21,403 for 2024 (p. 25), rises of 4 and 48 percent.
- 3 June 2026. Smaller SEC covered institutions came under the amended Regulation S-P notice, larger ones having started on 3 December 2025 (89 FR 47688).
- 6 July 2026. The Citibank plea above.
Fraud and privacy leads are left with the stretch in between. When a customer's data has been taken but not yet used, someone has to say which file opens first, the breach notice or the fraud case, and which team holds it until the first use shows up.
How this page was checked. Every source linked above was opened on 30 October 2026, chief among them 18 U.S.C. 1028, 1028A and 1029, the Dubin opinion, the SEC and CFTC Red Flags definitions, sections 6 to 8 of the Fraud Act 2006, section 170 of the Data Protection Act 2018, FinCEN's identity Financial Trend Analysis of January 2024 and the Middle District of Florida release of 6 July 2026. Fact checker: Ufuk Gürdaş, Compliance Specialist. Last reviewed: the publish date.
