Table 1. Identity fraud at a glance: five types and the control that answers each.
| Type | Method | Who loses | Control |
|---|---|---|---|
| Account takeover | Takes over a real customer's existing account | The account holder | Device and behavior signals |
| New account or application fraud | Applies for credit or an account in a stolen name | The person named and the lender | Identity verification against external data |
| Synthetic identity | Mixes real and invented details | The lender | Social Security number checks against issuance and other applicants |
| Benefits and tax | Claims benefits, refunds or jobs in another name | The person named and the agency | Identity checks before payment |
| Document forgery | Shows an altered, forged or borrowed ID | The firm relying on it | Forensic document examination |
The FTC received 1,135,291 identity theft reports in 2024, 17.5 percent of all reports to its Consumer Sentinel Network and the second largest of its 29 report categories (FTC Data Book, March 2025, p. 7).
What is identity fraud, and what is identity theft?
Identity fraud is a form of fraud in which criminals use someone else's identity to deceive a bank, lender, shop or public body.
Report Fraud, the police service for reporting fraud that succeeded Action Fraud on 4 December 2025 (ONS, 23 July 2026), puts it this way: "Identity theft is when your personal details are stolen and identity fraud is when those details are used to commit fraud."
The US Justice Department uses both terms for every crime in which someone "wrongfully obtains and uses another person's personal data" through fraud or deception (DOJ).
Identity theft vs identity fraud: what is the difference?
Picture an identity thief who buys a stolen name, date of birth and address on Monday and applies for a credit card on Friday. In UK usage, Monday is identity theft and Friday is identity fraud: stealing details "does not, on its own, constitute identity fraud", says Report Fraud.
US federal rules do not split the week. 12 CFR 1022.3(h) defines identity theft as the fraud itself, committed or attempted with another person's identifying information.
Table 2. Identity theft, identity fraud and account takeover compared.
| Term | What happens | US word | UK word | Who is harmed | Example |
|---|---|---|---|---|---|
| Identity theft | Name, date of birth or address is taken | Identity theft | Identity theft | The person whose details are exposed | Documents taken from the trash (Report Fraud) |
| Identity fraud | Stolen details get credit, goods or money | Identity theft | Identity fraud | The person named, who gets the bills, and the firm deceived | A credit card opened in the victim's name |
| Account takeover | A criminal controls an existing account | Identity theft (the FTC counts existing card misuse) | Facility takeover, filed apart (Cifas) | The account holder | 78,387 UK cases in 2025 (Cifas) |
From Ufuk Gürdaş, reviewer of this entry: "Check which rulebook your reader works under before you use either word: US rules define identity theft as 'a fraud committed or attempted using the identifying information of another person without authority', so a US Red Flags program calls 'identity theft' exactly what a UK fraud team files as identity fraud."
Which regulations address identity theft and fraud, country by country?
Table 3. Identity theft and identity fraud rules by jurisdiction (texts read 20 October 2026; US rows are federal law only).
| Jurisdiction | Rule | What it covers | Maximum or duty |
|---|---|---|---|
| US | 18 U.S.C. 1028(a)(7) | Transferring, possessing or using another person's means of identification without lawful authority, to commit or aid a federal crime or a state felony | A fine, up to 15 years or both if $1,000 or more is obtained in a year, otherwise up to 5; up to 20 for drug trafficking, violence or a repeat offense; up to 30 for terrorism |
| US | 18 U.S.C. 1028A | Aggravated identity theft: using another person's means of identification during a listed felony | 2 years on top of the felony sentence, consecutive; 5 with a terrorism felony |
| US | 16 CFR 681.1, the Red Flags Rule | Written Identity Theft Prevention Program for covered accounts | Program duty |
| US | 31 CFR 1020.220 | Bank Customer Identification Program (CIP) | Program duty |
| England, Wales and Northern Ireland | Fraud Act 2006 s2 | Fraud by false representation | 10 years on indictment, a fine or both (s1(3)) |
| UK | Identity Documents Act 2010 s4 and s6 | Holding a false ID or another person's, with improper intention (s4) or without reasonable excuse (s6) | On indictment, 10 years (s4) or 2 years (s6), a fine or both |
| EU | GDPR Article 33(1) | Personal data breach notice to the supervisory authority, unless the breach is unlikely to put people at risk | Without undue delay and, where feasible, within 72 hours |
| India | IT Act 2000 s66C | Fraudulent or dishonest use of another person's electronic signature, password or other "unique identification feature" | Up to 3 years and a fine up to one lakh rupees |
Sections 1 to 9 of the Fraud Act apply in England and Wales and Northern Ireland only (s15(2)); the Identity Documents Act extends to all four UK nations (s14(4)). The GDPR lists "identity theft or fraud" among the damage a personal data breach can cause (recital 85).
How does identity fraud work, from social media and data breaches to forged documents?
Follow one stolen profile through four steps.
- Gather. Identity thieves use techniques the DOJ lists: watching someone type a card number, taking discarded or redirected mail, sending phishing emails that ask for identifying data and using computers to steal personal data in bulk. On social media platforms and other social networking sites, a birthday post on Facebook or Instagram gives away a date of birth. Cifas linked an 8 percent rise in identity fraud against victims under 21 in 2025 to their greater willingness to share personal information online (Fraudscape 2026, p. 3).
- Build. The pieces become a full set of personally identifiable information (PII), sometimes matched with a forged ID document.
- Use. The profile applies for credit, opens accounts or takes over existing ones.
- Cash out. In one FTC example red flag, a new credit account goes mostly on cash advances or goods easy to resell, or is left unpaid after one payment or none.
What are the common types of identity fraud, from account takeover to new account and application fraud?
- Account takeover. A criminal controls a real customer's compromised account; Cifas files this as facility takeover, apart from identity fraud.
- New account and application fraud. Application fraud is applying for credit, an account or a service with false information, also called account origination, account opening or account creation fraud. A stranger applying in a stolen identity (third party) commits identity fraud; Cifas files first party fraud, false details in the applicant's own name, as a false application (Fraudscape 2026, p. 7).
- Synthetic identity fraud. Real and invented details make up a person who does not exist.
- Benefits, tax, medical and insurance. The FTC's identity theft types include employment or tax and government documents or benefits; its "other" type includes insurance and medical services (Data Book, p. 14).
What do the latest identity theft statistics show?
Table 4. Identity theft statistics and facts from three primary sources.
| Figure | Scope | Year | Source and page |
|---|---|---|---|
| 1,135,291 | US identity theft reports to the FTC; 17.5% of all reports, second of 29 categories | 2024 | FTC Data Book, March 2025, p. 7 |
| 449,032 | US credit card identity theft reports, the top type | 2024 | FTC Data Book, p. 8 |
| 242,003 | UK identity fraud cases filed by Cifas members; 54% of 444,993 filings; down 3% | 2025 | Cifas Fraudscape 2026, pp. 2, 3 |
| 129,490 | UK identity fraud cases, January to June; up 9%; 59% of filings | 2026 | Fraudscape 2026 six month update, PDF p. 3 |
| 1.6 million | US Bank Secrecy Act reports tied to identity; 42% of 3.8 million; $212 billion in suspicious activity | 2021 | FinCEN Financial Trend Analysis, January 2024, p. 1 |
| 69% | Share of identity related reports in which attackers impersonated someone, about 1.7 million in FinCEN's typology set of 2.4 million (duplicates included) | 2021 | FinCEN, pp. 1, 3 |
These stats count different things, so study each source before you compare rates: FTC consumer reports, Cifas member filings, FinCEN suspicious activity reports. None measures how much identity theft happens worldwide. In the UK, identity fraud filings rose 9 percent in the first half of 2026, and impersonation at the victim's current address rose 12 percent (PDF p. 6). People over 61 were the most targeted impersonation victims in 2025, at 29 percent (p. 3).
Which institutions are most vulnerable to identity fraud?
Depository institutions filed 54 percent of FinCEN's identity related reports, about 1.3 million, and money services businesses 21 percent (p. 2). In Cifas's 2025 data, plastic cards made up 36 percent of identity fraud cases and bank accounts 26 percent (pp. 3, 4).
What are the red flags of identity fraud at onboarding?
The Red Flags Rule defines a red flag as "a pattern, practice, or specific activity that indicates the possible existence of identity theft" and gives 26 illustrative examples in Supplement A, which a firm may draw on for its covered accounts.
Table 5. Onboarding red flags from 16 CFR 681 Supplement A, the data that shows them and the control.
| Indicator (example number) | Data checked | Control |
|---|---|---|
| ID document looks altered or forged (5) | The document's security features | Forensic document examination |
| Photo or description does not match the applicant (6) | ID photo against the person presenting it | Face comparison or a second reviewer |
| Social Security number (SSN) not issued, or on the Death Master File (10) | SSN against official records | Data check before the account opens |
| Address or phone already on a fraudulent application, or fictitious (12, 13) | Internal and shared fraud records | Hold and review |
| SSN used by other applicants, or an address or phone shared by an unusually large number (14, 15) | Applications across the book | Link analysis for coordinated applications |
| Cannot answer questions beyond what a wallet or credit report holds (18) | Challenge answers | Step up verification |
How can companies detect and prevent identity fraud, from forensic document examination to data checks?
A bank's Customer Identification Program must enable it to "form a reasonable belief" that it knows each customer's true identity (31 CFR 1020.220(a)(2)). A financial institution or creditor with covered accounts must also run a written Identity Theft Prevention Program to detect, prevent and mitigate identity theft (16 CFR 681.1(d)).
Forensic document examination checks an ID document for tampering or forgery and compares its photo with the applicant, while data checks scan the application against external sources and other applications, which exposes a shared SSN or a coordinated batch.
complead, formerly Sanction Scanner, reads the device and the user's behavior, which no document shows, with its device and behavior analysis. It fingerprints the device even through a VPN, groups the accounts that share one device and scores each session with the signals behind the score. For the monitoring that follows onboarding, see how fraud detection works.
The DOJ tells victims to ask the companies where the fraud happened to close or freeze the accounts, change passwords and PINs, place a fraud alert with a credit bureau and report to the FTC at IdentityTheft.gov. UK victims outside Scotland use Report Fraud.
What role do RegTech tools and KYC checks play?
RegTech tools run these checks during onboarding, score the result against a risk model and route high risk applications to fraud teams. Identity checks sit inside KYC and customer due diligence (CDD), and KYB extends them to each ultimate beneficial owner (UBO) of a company; KYC requirements by country sets out the rules market by market. complead is an AI native platform for AML, KYC and fraud that gives each customer one risk score across onboarding, screening, monitoring, fraud and investigation.
For an onboarding team, the decision left open is which applicant data the system accepts on one source, and which sends the file to a reviewer.
Related terms
- Account takeover fraud. Controlling a real customer's existing account.
- Synthetic identity fraud. A new identity built from real and invented details.
- Credit card fraud. Unauthorized use of a card or its details.
- Benefit fraud. Claiming public benefits with false information.
- Impersonation fraud. Posing as a trusted person or organization.
