Identity theft: Difference between revisions

{{shortShort description|Deliberate use of someone else's identity, usually as a method to gain a financial advantage}}

{{About|the concept of identity theft|the 2004 film|Identity Theft (film)|the 2013 film|Identity Thief|the 1953 film|Stolen Identity (film)}}

'''Identity theft''', is'''identity piracy''' or '''identity infringement''' occurs when someone uses another's personal identifying information, like their name, identifying number, or [[credit card number]], without their permission, to commit fraud or other crimes. The term ''identity theft'' was coined in 1964.<ref>{{cite web|date=September 2007|title=Oxford English Dictionary online|url=http://dictionary.oed.com/cgi/entry/50111220/50111220se23|access-date=27 September 2010|publisher=Oxford University Press}}</ref> Since that time, the deliberatedefinition useof identity theft has been legally defined throughout both the U.K. and the [[United States|U.S.]] as the theft of personally identifiable information. Identity theft deliberately uses someone else's [[personally identifiable information|identity]], usually as a method to gain a financial advantageadvantages or obtain credit and other benefits in the other person's name,.<ref>Synthetic ID Theft [http://www.unc.edu/~dubal/idtheft/synthetic.htm Cyber Space Times] {{webarchive |url=https://web.archive.org/web/20151009122632/http://www.unc.edu/~dubal/idtheft/synthetic.htm |date=9 October 2015 }}</ref><ref>{{Cite documentSSRN |title=Identity Theft: Making the Known Unknowns Known |last=Hoofnagle|first=Chris Jay |date=13 March 2007 |ssrn = 969441}}</ref> and perhaps to the other person's disadvantage or loss. The person whose identity has been assumedstolen may suffer adverse consequences,<ref name="BloombergIdentityTheftEssay">{{cite webnews |author=Drew Armstrong | url=https://www.bloomberg.com/news/articles/2017-09-13/my-three-years-in-identity-theft-hell | title=My Three Years in Identity Theft Hell | newspaper=Bloomberg.com | publisher=Bloomberg | date=13 September 2017 |isbn= | archive-url=https://web.archive.org/web/20170919142519/https://www.bloomberg.com/news/articles/2017-09-13/my-three-years-in-identity-theft-hell | archive-date=19 September 2017 | access-date=20 September 2017 }}</ref> especially if they are falsely held responsible for the perpetrator's actions. Identity theft occurs when someone uses another's personally identifying information, like their name, identifying number, or [[credit card number]], without their permission, to commit fraud or other crimes. The term ''identity theft'' was coined in 1964.<ref>{{cite web |url=http://dictionary.oed.com/cgi/entry/50111220/50111220se23 |title=Oxford English Dictionary online|date=September 2007 |publisher=Oxford University Press|accessdate=27 September 2010 }}</ref> Since that time, the definition of identity theft has been statutorily defined throughout both the U.K. and the United States as the theft of personallyPersonally identifiable information, generally includingincludes a person's name, date of birth, social security number, driver's license number, bank account or credit card numbers, [[Personal_identification_numberPersonal identification number|PINs]], [[electronic signature]]s, fingerprints, [[password]]s, or any other information that can be used to access a person's financial resources.<ref>See, e.g., {{cite web|title=Wisconsin Statutes, Sec. 943.201. Unauthorized use of an individual's personal identifying information or documents.|url=https://docs.legis.wisconsin.gov/statutes/statutes/943/III/201|website=Wisconsin State Legislature|accessdateaccess-date=19 July 2017}}</ref>

Determining the link between [[data breach]]es and identity theft is challenging, primarily because identity theft victims often do not know how their personal information was obtained,. According to a report done for the andFTC, identity theft is not always detectable by the individual victims, according to a report done for the [[Federal Trade Commission|FTC]].<ref>Federal Trade Commission – 2006 Identity Theft Survey Report, p. 4</ref> [[Identity fraud]] is often but not necessarily the consequence of identity theft. Someone can steal or misappropriate personal information without then committing identity theft using the information about every person, such as when a major data breach occurs. A US[[Government Accountability Office|U.S. Government Accountability Office]] study determined that "most breaches have not resulted in detected incidents of identity theft".<ref>{{cite web |url=http://www.gao.gov/new.items/d07737.pdf |title=Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown |author= |date= |work=Highlights of GAO-07-737, a report to congressional requesters |publisher=gao.gov |accessdateaccess-date=22 September 2010}}</ref> The report also warned that "the full extent is unknown". A later unpublished study by [[Carnegie Mellon University]] noted that "Most often, the causes of identity theft is not known", but reported that someone else concluded that "the probability of becoming a victim to identity theft as a result of a data breach is ... around only 2%".<ref>{{cite web |url=http://www.heinz.cmu.edu/research/241full.pdf |title=Do Data Breach Disclosure Laws Reduce Identity Theft? |author=Sasha Romanosky |date= |work=Heinz First Research Paper |publisher=heinz.cmu.edu |accessdateaccess-date=2009-05-27 |archive-date=2012-01-20 |archive-url=https://web.archive.org/web/20120120001255/http://www.heinz.cmu.edu/research/241full.pdf |url-status=dead }}</ref> MoreFor recentlyexample,{{when|date=January 2020}} an association of consumer data companies noted thatin one of the largest data breaches ever,which accounting foraffected over four million records, it resulted in only about 1,800 instances of identity theft, according to the company whose systems were breached.{{cncitation needed|date=JanuaryMay 20202021}}

Chief Technology Officer of security at [[Microsoft]], said, "Interested in credit card theft? There's an app for that."<ref>{{Cite web|last=Giles|first=Jim|title='Credit card theft? There's an app for that'|url=https://www.newscientist.com/article/mg20527524-300-credit-card-theft-theres-an-app-for-that/|access-date=2021-03-19|website=New Scientist|language=en-US}}</ref> This statement summed up the ease with which these hackers are accessing all kinds of information online. The new program for infecting users' computers was called [[Zeus (malware)|Zeus]];, and the program is so hacker-friendly that even an inexperienced hacker can operate it. Although the hacking program is easy to use, that fact does not diminish the devastating effects that Zeus (or other software like Zeus) can do toon a computer and the user. For example, the article stated that programs like Zeus can steal credit card information, important documents, and even documents necessary for [[homeland security]]. If thea hacker were to gain this information, it would mean nationwide identity theft or even a possible terrorist attack. The [[Integrated Threat Assessment Centre|ITAC]] sayssaid that about 15 million Americans had their identity stolen in 2012.<ref>[https://www.bjs.gov/content/pub/pdf/vit12.pdf Victims of Identity Theft, 2012] BJS</ref>

Sources such as the [[Non-profit]] [[Identity Theft Resource Center]]<ref>{{cite web |url=http://www.idtheftcenter.org/ |title=Identity Theft Resource Center website |author= |date= |publisher=idtheftcenter.org |accessdate= }}</ref> sub-divide identity theft into five categories:

* Financial identity theft (using another's identity to obtain credit, goods, and services)

Identity theft may be used to facilitate or fund other crimes including [[Illegalillegal immigration]], [[terrorism]], [[phishing]] and [[espionage]]. There are cases of identity cloning to attack [[payment system]]s, including online credit card processing and [[medical insurance]].<ref>{{cite web |url=http://www.worldprivacyforum.org/medidtheft_consumertips.html |title=Medical Identity Theft: What to Do if You are a Victim (or are concerned about it) }}, World Privacy Forum</ref>

In this situation, the identity thief impersonates someone else in order to conceal their own true identity. Examples are [[illegal immigrant]]s hiding their illegal status, people hiding from [[creditor]]s or other individuals, and those who simply want to become "[[Anonymity|anonymous]]" for personal reasons. Another example is ''posers'', a label given to people who use someone else's photos and information on social networking sites. Posers mostly create believable stories involving friends of the real person they are imitating. Unlike identity theft used to obtain credit which usually comes to light when the debts mount, concealment may continue indefinitely without being detected, particularly if the identity thief is able tocan obtain false credentials in order to pass various authentication tests in everyday life.

When a criminal fraudulently identifies themselves to police as another individual at the point of arrest, it is sometimes referred to as "Criminal Identity Theft." In some cases, criminals have previously obtained state-issued identity documents using credentials stolen from others, or have simply presented a [[fake ID]]. Provided the subterfuge works, charges may be placed under the victim's name, letting the criminal off the hook. Victims might only learn of such incidents by chance, for example by receiving a court summons, discovering their driversdriver's licenses are suspended when stopped for minor traffic violations, or through [[background check]]s performed for employment purposes.

It can be difficult for the victim of a criminal identity theft to clear their record. The steps required to clear the victim's incorrect [[criminal record]] depend inon which jurisdiction the crime occurred and whether the true identity of the criminal can be determined. The victim might need to locate the original arresting officers and prove their own identity by some reliable means such as fingerprinting or DNA testing, and may need to go to a court hearing to be cleared of the charges. Obtaining an [[expungement]] of court records may also be required. Authorities might permanently maintain the victim's name as an alias for the criminal's true identity in their criminal records databases. One problem that victims of criminal identity theft may encounter is that various [[data aggregators]] might still have the incorrect criminal records in their databases even after court and police records are corrected. Thus it is possible that a future background check willmay return the incorrect criminal records.<ref>{{cite web |url=http://www.privacyrights.org/fs/fs17g-CrimIdTheft.htm |title=Privacy Rights Clearinghouse |url-status=dead |archive-url=https://archive.today/20120921/http://www.privacyrights.org/fs/fs17g-CrimIdTheft.htm |archive-date=21 September 2012 |df= }} - "Fact Sheet 17g: Criminal Identity Theft: What to Do ifIf It Happens to You "</ref> This is just one example of the kinds of impact that may continue to affect the victims of identity theft for some months or even years after the crime, aside from the psychological trauma that being 'cloned' typically engenders.

A variation of identity theft whichthat has recently become more common is ''synthetic identity theft'', in which identities are completely or partially fabricated.<ref>[http{{Cite web|url=https://www.leagle.com/decision/2009567417bbr150_1566 In re Marie A. COLOKATHIS, Catherine Bauer, M.D., Plaintiff v. Marie Colokathis, 417 B.R. 150 (2009)] {{webarchive 2009567417bbr1501566|urlarchiveurl=https://web.archive.org/web/20150719051854/http://www.leagle.com/decision/2009567417bbr150_1566|url-status=dead|title=In Re Colokathis &#124; 417 B.R. 150 (2009)|archive-date=19 July 2015 |website=Leagle}}</ref> The most common technique involves combining a real [[social security number]] with a name and birthdate other than the ones that are simply associated with the number. Synthetic identity theft is more difficult to track as it doesn't show on either person's credit report directly but may appear as an entirely new file in the [[credit bureau]] or as a subfile on one of the victim's credit reports. Synthetic identity theft primarily harms the creditors who unwittingly grant the fraudsters credit. Individual victims can be affected if their names become confused with the synthetic identities, or if negative information in their subfiles impacts their credit ratings.<ref>{{cite web |url=http://www.bankrate.com/brm/news/pf/identity_theft_20070516_a1.asp |title=Detecting synthetic identity fraud |accessdateaccess-date=21 September 2008 |last=McFadden |first=Leslie |date=16 May 2007 |work=Bankrate.com |pages=1–2 |doi= |quote= }}</ref>

{{seeSee also|Medical privacy}}

Privacy researcher Pam Dixon, the founder of the World Privacy Forum,<ref>{{Cite web|url=https://www.worldprivacyforum.org/|title=World Privacy Forum|website=www.worldprivacyforum.org|accessdate=25 December 2023}}</ref> coined the term medical identity theft and released the first major report about this issue in 2006. In the report, she defined the crime for the first time and made the plight of victims public. The report's definition of the crime is that medical identity theft occurs when someone seeks medical care under the identity of another person. Insurance theft is also very common, if a thief has your insurance information and or your insurance card, they can seek medical attention posing as yourself.<ref>{{Cite web|url=http://www.igrad.com/articles/8-types-of-identity-theft|title=Get to Know These Common Types of ID Theft|website=iGrad|access-date=29 September 2016}}</ref> In addition to risks of financial harm common to all forms of identity theft, the thief's medical history may be added to the victim's [[medical record]]s. Inaccurate information in the victim's records is difficult to correct and may affect future insurability or cause doctors relyingto onrely theon misinformation to deliver inappropriate care. After the publication of the report, which contained a recommendation that consumers receive notifications of medical data breach incidents, California passed a law requiring this, and then finally [[Health Insurance Portability and Accountability Act|HIPAA]] was expanded to also require medical breach notification when breaches affect 500 or more people.<ref>{{cite web|url=http://www.worldprivacyforum.org/medicalidentitytheft.html|title=The Medical Identity Theft Information Page|author=|date=|publisher=World Privacy Forum|access-date=26 November 2012|url-status=dead|archive-url=https://archive.today/20130416062351/http://www.worldprivacyforum.org/medicalidentitytheft.html|archive-date=16 April 2013|df=}}</ref><ref>{{cite web |url=http://www.idtheftcenter.org/artman2/publish/v_fact_sheets/Fact_Sheet_130_A_Correcting_Misinformation_on_Medical_Records.shtml |title=Correcting Misinformation on Medical Records |author= |date= |publisher=Identity Theft Resource Center |accessdate= |archive-url=https://web.archive.org/web/20130123025205/http://www.idtheftcenter.org/artman2/publish/v_fact_sheets/Fact_Sheet_130_A_Correcting_Misinformation_on_Medical_Records.shtml |archive-date=23 January 2013 |url-status=dead }}</ref> Data collected and stored by hospitals and other organizations such as medical aid schemes is up to 10 times more valuable to cybercriminals than credit card information.

Child identity theft occurs when a minor's identity is used by another person for the impostor's personal gain. The impostor can be a family member, a friend, or even a stranger who targets children. The Social Security numbers of children are valued because they do not have any information associated with them. Thieves can establish lines of credit, obtain driver's licenses, or even buy a house using a child's identity. This fraud can go undetected for years, as most children do not discover the problem until years later. Child identity theft is fairly common, and studies have shown that the problem is growing. The largest study on child identity theft, as reported by Richard Power of the [[Carnegie Mellon]] Cylab with data supplied by [[AllClear ID]], found that of 40,000 children, 10.2% were victims of identity theft.<ref>{{Cite web|url=https://www.foxbusiness.com/features/government-turns-spotlight-on-child-id-theft-problem|title=Government Turns Spotlight on Child ID Theft Problem|date=12 January 2016|website=CreditCards.com|language=en-US|access-date=22 April 2019}}</ref>

The [[Federal Trade Commission]] (FTC) estimates that about nine million people will be victims of identity theft in the United States per year. It was also estimated that in 2008; 630,000 people under the age of 19 were victims of theft. This then gave themthe victims a debt of about $12,799 which was not theirs.<ref name=":5">{{Cite web|url=http://link.galegroup.com/apps/doc/A317310399/AONE?u=sunybuff_main&sid=AONE&xid=8502170b.|title=Protecting and defending a young person in foster care from financial identity theft|last=Clemente|first=Jean|date=Feb 2010|website=|access-date=}}</ref>

Not only are children in general big targets of identity theft but children who are in foster care are even bigger targets. This is because they are most likely moved around quite frequently and their SSN is being shared with multiple people and agencies. Foster children are even more victims of identity theft within their own familyfamilies and other relatives. Young people in foster care who are victims of this crime are usually left alone to struggle and figure out how to fix their newly formed bad credit.<ref name=":5" />

The most common type is financialof identity theft, whereis someone wantsrelated to gainfinance. economicalFinancial benefitsidentity in someone else's name. Thistheft includes gettingobtaining creditscredit, loans, goods, and services, while claiming to be someone else.<ref>{{cite web |url=http://www.idtheftcenter.org/Identity-Theft/what-is-financial-identity-theft.html |title=What is Financial Identity Theft |author= |date= |publisher=ID Theft Center |accessdateaccess-date=3 December 2014}}</ref>

One of the major identity theft categories is '''tax-related identity theft'''. The most common method is to use a person's authentic name, address, and [[Social Security Number]] to file a tax return with false information, and have the resulting refund direct-deposited into a bank account controlled by the thief. The thief in this case can also try to get a job and then their employer will report the income of the real taxpayer, this then results in the taxpayer getting in trouble with the IRS.<ref name=":03">{{Cite web|url=https://www.citrincooperman.com/infocus/identityIn-theftFocus-tax-andResource-financial-considerationCenter|title=IdentityIn Theft;Focus TaxResource andCenter Financialfrom Consideration|last=|first=|date=Citrin Cooperman &#124; Ideas That Count|website=www.citrincooperman.com|access-dateaccessdate=25 December 2023}}</ref>

The 14039 Form to the [[Internal Revenue Service|IRS]] is a form that will help one fight against a theft like tax theft. This form will put the IRS on alert and someone who believed they have been a victim of tax -related theft will be given an Identity Protection Personal Identification Number (IP PIN), which is a 6 digit code used in replacereplacing of aan SSN for filing tax returns.<ref name=":03" />

Identity thieves typically obtain and exploit [[personally identifiable information]] about individuals, or various credentials they use to authenticate themselves, in order to impersonate them. Examples include:

The acquisition of personal identifiers is made possible through serious breaches of [[privacy]]. For consumers, this is usually a result of them naively providing their personal information or login credentials to the identity thieves (e.g., in a [[phishing attack]]) but identity-related documents such as credit cards, bank statements, utility bills, checkbooks, etc. may also be physically stolen from vehicles, homes, offices, and not the least [[letterboxes]], or directly from victims by pickpockets and bag snatchers. Guardianship of personal identifiers by consumers is the most common intervention strategy recommended by the [[US Federal Trade Commission]], [[PhoneBusters|Canadian Phone Busters]] and most sites that address identity theft. Such organizations offer recommendations on how individuals can prevent their information from falling into the wrong hands.

Identity theft can be partially mitigated by ''not'' identifying oneself unnecessarily (a form of information security control known as risk avoidance). This implies that organizations, IT systems, and procedures should not demand excessive amounts of personal information or credentials for identification and authentication. Requiring, storing, and processing personal identifiers (such as [[Social Security number]], [[national identification number]], driver's license number, credit card number, etc.) increases the risks of identity theft unless this valuable personal information is adequately secured at all times. Committing personal identifiers to memory is a sound practice that can reduce the risks of a would-be identity thief from obtaining these records. To help in remembering numbers such as social security numbers and credit card numbers, it is helpful to consider using mnemonic techniques or memory aids such as the [[Mnemonic major system|mnemonic Major System]].

Identity thieves sometimes impersonate dead people, using personal information obtained from death notices, gravestones, and other sources to exploit delays between the death and the closure of the person's accounts, the inattentiveness of grieving families, and weaknesses in the processes for credit-checking. Such crimes may continue for some time until the deceased's families or the authorities notice and react to anomalies.<ref>[http://www.idtheftcenter.org/Fact-Sheets/fs-117.html IDtheftcenter.org<!-- Bot generated title -->] {{webarchive|url=https://web.archive.org/web/20160417074200/http://www.idtheftcenter.org/Fact-Sheets/fs-117.html|date=17 April 2016}}, Identity Theft Resource Center Fact Sheet 117 Identity Theft and the Deceased - Prevention and Victim Tips.</ref>

In recent years{{When|date=September 2018}}, commercial identity theft protection/insurance services have become available in many countries. These services purport to help protect the individual from identity theft or help detect that identity theft has occurred in exchange for a monthly or annual membership fee or premium.<ref>{{cite web |url=http://www.nextadvisor.com/identity_theft_protection_services/compare.php |title=Identity Theft Protection Services |access-date=2008-12-16 |archive-date=2012-09-07 |archive-url=https://archive.today/20120907/http://www.nextadvisor.com/identity_theft_protection_services/compare.php |url-status=dead }} retrieved on 16 December 2008</ref> The services typically work either by setting fraud alerts on the individual's credit files with the three major credit bureaus or by setting up [[credit report monitoring]] with the credit bureauxbureau. While identity theft protection/insurance services have been heavily marketed, their value has been called into question.<ref>{{cite web |url=http://www.pcworld.com/article/145077/identitytheft_protection_what_services_can_you_trust.html |title=Identity-Theft Protection: What Services Can You Trust? }} PC World.com, retrieved on 16 December 2008</ref>

Identity theft is a serious problem in the United States. In a 2018 study, it was reported that 60 million Americans' identities had been wrongfully acquired.<ref name=":02">{{Cite book|url=https://purl.fdlp.gov/GPO/gpo90910|title=Protecting Children from Identity Theft Act: report (to accompany H.R. 5192) (including cost estimate of the Congressional Budget Office).|lastlast1=United States|last2=Congress|last3=House|last4=Committee on Ways and Means|date=2018|language=Englishen}}</ref><ref name=":02" /> In response, some new bills have been implemented to improve security, under advisement from the [[Identity Theft Resource Center]], some new bills have been implemented to improve security such as requiring electronic signatures and social security verification.<ref name=":02" />

There are severalSeveral types of identity theft that are used to gather information, one of the most common types occurs when consumers make online purchases.<ref name=":12" /> A study was conducted with 190 people to determine the relationship between the constructs of fear of financial losses and reputational damages.<ref name=":12">{{Cite journal|lastlast1=Gašper|firstfirst1=Jordan|last2=Robert|first2=Leskovar|last3=Miha|first3=Marič|date=1 May 2018|title=Impact of Fear of Identity Theft and Perceived Risk on Online Purchase Intention|url=https://doaj.org/article/f1b7b6fe687348f994d559d57e6d46c1|journal=Organizacija|language=en|volume=51|issue=2|issn=1581-1832}}</ref> The conclusions of this study revealed that identity theft was a positive correlation with reputable damages.<ref name=":12" /> The relationship between perceived risk and online purchase intention were negative.<ref name=":12" /> The significance of this study reveals that online companies are more aware of the potential harm that can be done to their consumers, therefore they are searching for ways to reduce the perceived risk of consumers and not lose out on business.

In their May 1998 testimony before the United States Senate, the [[Federal Trade Commission]] (FTC) discussed the sale of Social Security numbers and other personal identifiers by credit-raters and data miners. The FTC agreed to the industry's self-regulating principles restricting access to information on credit reports.<ref>{{cite web |url=http://www.ftc.gov/os/1998/05/identhef.htm |title=Testimony before the Subcommittee on Technology, Terrorism and Government Information |url-status=dead |archive-url=https://archive.today/20120801/http://www.ftc.gov/os/1998/05/identhef.htm |archive-date=1 August 2012 |df= }}, Committee of the Judiciary, United States Senate 20 May 1998 pp 5,6</ref> According to the industry, the restrictions vary according to the category of customer. Credit reporting agencies gather and disclose personal and credit information to a wide business client base.

Poor stewardship of personal data by organizations, resulting in unauthorized access to sensitive data, can expose individuals to the risk of identity theft. The Privacy Rights Clearinghouse havehas documented over 900 individual data breaches by US companies and government agencies since January 2005, which together have involved over 200 million total records containing sensitive personal information, many containing social security numbers.<ref>[{{Cite web|url=http://www.privacyrights.org/ar/ChronDataBreaches.htm A Chronology of Data Breaches<!-- Bot generated title -->] {{webarchive|archive-url=https://web.archive.org/web/20100613183200/http://www.privacyrights.org/ar/ChronDataBreaches.htm|url-status=dead|title=A Chronology of Data Breaches<!-- Bot generated title -->|archive-date=13 June 2010}}</ref> Poor corporate diligence standards which can result in data breaches include:

Using various types of [[biometric]] information, such as [[fingerprint]]s, for identification and authentication has been cited as a way to thwart identity thieves, however, there are technological limitations and privacy concerns associated with these methods as well.

There is an active market for buying and selling stolen personal information, which occurs mostly in [[darknet market]]s but also in other [[black market]]s.<ref>{{cite book |last1=Holt |first1=Thomas J. |last2=Smirnova |first2=Olga |last3=Chua |first3=Yi-Ting |title=Data thieves in action : examining the international market for stolen personal information |date=2016 |publisher=Palgrave Macmillan |isbn=978-1-137-58904-0}}</ref> People increase the value of the stolen data by aggregating it with publicly available data, and sell it again for a profit, increasing the damage that can be done to the people whose data was stolen.<ref>{{cite news |last1=Rossi |first1=Ben |title=The ripple effect of identity theft: What happens to my data once it's stolen?|url=https://www.information-age.com/ripple-effect-identity-theft-what-happens-my-data-once-its-stolen-123459795/ |work=Information Age |date=8 July 2015}}</ref>

In March 2014, after it was learned two passengers with stolen passports were on board [[Malaysia Airlines Flight 370]], which went missing on 8 March 2014,. itIt came to light that [[Interpol]] maintains a database of 40 million lost and stolen travel documents from 157 countries, which itInterpol makes available to governments and the public, including airlines and hotels. The Stolen and Lost Travel Documents (SLTD) database, however, is littlerarely used. ''Big News Network'' (which is based in the [[UAE]],) observedreported that Interpol Secretary -General [[Ronald Noble|Ronald K. Noble]] told a forum in [[Abu Dhabi]] in the previous month this was the case., "The bad news is that, despite being incredibly cost -effective and deployable to virtually anywhere in the world, only a handful of countries are systematically using SLTD to screen travelers. The result is a major gap in our global security apparatus that is left vulnerable to exploitation by criminals and terrorists,." Noble is quoted as saying.<ref name="InterpolSLTD">{{cite news|title=Airlines and governments not checking stolen passports register|url=https://www.telegraph.co.uk/news/worldnews/asia/malaysia/10686319/Interpol-warned-of-danger-posed-by-stolen-passports.html |accessdatearchive-url=https://ghostarchive.org/archive/20220112/https://www.telegraph.co.uk/news/worldnews/asia/malaysia/10686319/Interpol-warned-of-danger-posed-by-stolen-passports.html |archive-date=2022-01-12 |url-access=subscription |url-status=live|access-date=11 September 2014|newspaper=The Daily Telegraph}}{{cbignore}}</ref>

In [[Australia]], each state has enacted laws that deal with different aspects of identity or fraud issues. Some states have now amended relevant criminal laws to reflect crimes of identity theft, such as the Criminal Law Consolidation Act 1935 (SA), Crimes Amendment (Fraud, Identity and Forgery Offences) Act 2009, and also in Queensland under the Criminal Code 1899 (QLD). Other states and territories are in states of development in respect of regulatory frameworks relating to identity theft such as Western Australia in respect of the Criminal Code Amendment (Identity Crime) Bill 2009.

Likewise, each state has enacted theirits own privacy laws to prevent the misuse of personal information and data. The Commonwealth ''Privacy Act'' is applicableapplies only to Commonwealth and territory agencies, and to certain private -sector bodies (where, for example, they deal with sensitive records, such as medical records, or they have more than $3 million in turnover PA).

{{quoteBlockquote|Everyone commits an offenceoffense who knowingly obtains or possesses another person's identity information in circumstances giving rise to a reasonable inference that the information is intended to be used to commit an indictable offenceoffense that includes fraud, deceit, or falsehood as an element of the offenceoffense.

is guilty of an indictable offenceoffense and liable to imprisonment for a term of not more than five years; or is guilty of an offenceoffense punishable on summary conviction.}}

{{quoteBlockquote|(1) Everyone commits an offenceoffense who fraudulently personates another person, living or dead,

is guilty of an indictable offenceoffense and liable to imprisonment for a term of not more than 10 years; or guilty of an offenceoffense punishable on summary conviction.}}

For the private sector, the purpose of the Personal Information Protection and Electronic Documents Act ( 2000, c. 5 ) (known as PIPEDA) is to establish rules to govern the collection, use, and disclosure of personal information; except for the provinces of Quebec, Ontario, Alberta and British Columbia where provincial laws have been deemed substantially similar.

In France, a person convicted of identity theft can be sentenced up to five years in prison and fined up to [[euro|€]]75,000.<ref>{{citeCite web |url=http://www.journaldunet.com/juridique/juridique040309.shtml |title=JournaldunetUsurpation d'identité : la loi ou la technique pour se protéger ?|website=www.journaldunet.com|accessdate=25 December 2023}}</ref>

Under HK Laws. Chap 210 ''Theft Ordinance'', sec. 16A Fraud:

{{quoteBlockquote|(1) If any person by any deceit (whether or not the deceit is the sole or main inducement) and with '''intent to defraud''' induces another person to commit an act or make an omission, which results either-

Under theThe ''Personal Data (Privacy) Ordinance'', it(PDPO) establishedregulates the postcollection, of Privacy Commissioner for Personal Datause and mandateretention how muchof personal information onein can collect,Hong retain and destructionKong. This legislationIt also provides citizens the right to request information held by businesses and the government to the extent provided by this law. The PDPO establishes the [[Office of the Privacy Commissioner for Personal Data]] which enforces the law and advises on the use of personal data.

Under the Information Technology Act 2000 Chapter IX Sec 66C:

{{quoteBlockquote|SECTION 66C

Whoever, fraudulently or dishonestly makes use of the electronic signature, password, or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to rupees one [[lakh]].<ref>{{cite web |url=http://nicca.nic.in/pdf/itact2000.pdf |title=The Information Technology Act 2000 |access-date= |accessdate=2013-08-20 |archive-url=https://web.archive.org/web/20130724123617/http://nicca.nic.in/pdf/itact2000.pdf |archive-date=2013-07-24 |url-status=dead }}</ref>}}

Social networking sites are one of the most famous spreaders of ''posers'' in the online community, giving the users the freedom to placepost any information they want without any verification that the account is being used by the real person.{{clarify|date=April 2021}}

The Philippines, which ranks eighth in the numbers of users of [[Facebook]] and other social networking sites (such as [[Twitter]], [[Multiply (website)|Multiply]] and [[Tumblr]]), has been known as a source of various identity theft problems.<ref>[{{Cite web|url=https://www.techunblocked.org/2015/06/facebook-users-by-country-wise.html List Of Facebook Users By Country Wise Top Ranking 2016] {{webarchive |archive-url=https://web.archive.org/web/20160310213502/https://www.techunblocked.org/2015/06/facebook-users-by-country-wise.html|url-status=dead|title=List of Facebook Users by Country Wise Top ranking 2016 - Tech Unblocked|archive-date=10 March 2016 }}</ref> Identities of those people who carelessly put personal information on their profiles can easily be stolen just by simple browsing. There areSome people who meet online, get to know each other through the free Facebook chat, and exchange of messages that then leads to sharing ofshare private information. Others get romantically involved with their online friends thatand theyend tendup to givesharing too much information (such as their social security number, bank account and even personal basic information such as, home address, and company address).

This phenomenon leadleads to the creation of Senate Bill 52:the [[Cybercrime Prevention Act of 2010.<ref>[https://www.scribd.com/document/59428205/Senate-Bill-52-Cyber-Crime-Prevention-Act Full Text of Senate Bill 522012]] (Proposing the Cybercrime PreventionRepublic Act ofNo. 201010175)] {{webarchive |url=https://web.archive.org/web/20160816172609/https://www.scribd.com/document/59428205/Senate-Bill-52-Cyber-Crime-Prevention-Act |date=16 August 2016 }}</ref> Section 2 of this billact states that it recognizes the importance of [[communication]] and [[multimedia]] for the development, exploitation, and dissemination of information{{clarify|date=April 2021}}, but violators will be punished by the law through imprisonment or a fine upwards of Php200₱200,000, but not exceeding 1 million₱1,000,000, or (depending on the damage caused, or) both (Section 7).

Sweden has had relatively few problems with identity theft. This is because only Swedish [[identity document]]s have beenwere accepted for identity verification. Stolen documents are traceable by banks and somecertain other institutions{{which|date=April 2021}}. TheBanks banks have theare dutyrequired to check the identity of peopleanyone withdrawing money or getting loans. If a bank gives money to someone using an identity document that has been reported as stolen, the bank must take thethis loss. Since 2008, any EU passport is valid in Sweden for identity checkverification, and Swedish passports are valid all over the EU. This makes it harder to detect stolen documents, but still banks in Sweden still must ensure that stolen documents are not accepted.

Other types of identity theft have become more common in Sweden. One common example is ordering a credit card to someone who has an unlocked letterbox and is not home induring the daytime. The thief steals the letter with the credit card and then the letter with the code, which typically arrives a few days later. Usage of a stolen credit card is harddifficult in Sweden, since an identity document or a PIN code it is normally demanded. If thea shop does not demand thateither, it must take the loss from accepting a stolen credit cardscard. The methodpractice of observing someone using thetheir credit card's PIN code, stealing the credit card, or [[skimming (credit card fraud)|skimming]] it, and then using the credit card, has become more common.

Legally, Sweden is an open society. [[Freedom of information legislation|The Principle of Public Access]] saysstates that all information (e.g. addresses, incomes, taxes) kept by public authorities must be available for anyone, except in certain cases. Specifically(for example, anyone'sthe address,addresses income,of taxespeople etc.who are availableneed to anyonehide are restricted). This makes fraud easier (the address is restricted only for people who needs to hide).

ThereUntil was2016, untilthere 2016were no legallaws banthat specifically againstprohibited using someone's identity. Instead, there were only onlaws theregarding any indirect damagedamages caused. ToImpersonating impersonate someoneanyone else for financial gain is a kind[[type of [[fraud]], which is described in the [[Criminal Code]] ({{lang-langx|sv|brottsbalken}}). ToImpersonating impersonate someoneanyone else to discredit someonethem by breakinghacking into their social media accounts and provoke,{{clarify|date=April 2021}} is considered [[libel]]. However, but thatit is harddifficult to sentenceconvict someone forof committing this crime. AIn late 2016, a new law was introduced late 2016 which partially banned undetermined{{clarify|date=April 2021}} identity usage.<ref>[{{Cite web|url=http://rkrattsdb.gov.se/SFSdoc/16/160485.PDF |title=SFS 2016:485 Lag om ändring i brottsbalken]|accessdate=25 December 2023}}</ref>

In the United Kingdom, personal data is protected by the [[Data Protection Act 1998]]. The Act covers all personal data which an organization may hold, including names, birthday and anniversary dates, addresses, and telephone numbers, etc.

Under [[English law]] (which extends to [[Wales]] but not to [[Northern Ireland]] or [[Scotland]]), the [[Deception (criminal law)|deception]] offences under the [[Theft Act 1968]] increasingly contend with identity theft situations. In ''R v Seward'' (2005) EWCA Crim 1941,<ref>{{citeCite web |url=http://www.bailii.org/ew/cases/EWCA/Crim/2005/1941.html |title=Seward, R. v Seward ([2005)] EWCA Crim 1941 (11 July 2005)|accessdate=25 December 2023}}</ref> the defendant was acting as the "front manfrontman" in the use of stolen credit cards and other documents to obtain goods. He obtained goods to the value of £10,000 for others who are unlikely ever to be identified. The Court of Appeal considered a sentencing policy for deception offenses involving "identity theft" and concluded that a prison sentence was required. Henriques J. said at para 14: "Identity fraud is a particularly pernicious and prevalent form of dishonesty calling for, in our judgment, deterrent sentences."

Statistics released by [[CIFAS]] - The (UK's Fraud Prevention Service) show that there were 89,000 victims of identity theft in the UK in 2010 and 85,000 victims in 2009.<ref>{{cite web |url=http://www.cifas.org.uk/identity_fraud |title=CIFAS: your identity }}, CIFAS</ref> This compared with 2009 where there were 85,000 victims.<ref>{{cite web |url=http://id-theft-uk.blogspot.com/2010/02/uk-fraud-prevention-agency-say-id-theft.html |title=UK Fraud Prevention Agency Say ID Theft Increase of 32% in 2009 |access-date=2010-02-03 |archive-date=2012-07-01 |archive-url=https://archive.today/20120701/http://id-theft-uk.blogspot.com/2010/02/uk-fraud-prevention-agency-say-id-theft.html |url-status=dead }}, Identity Theft UK Blog, 3 February 2010</ref>{{Unreliable source?|date=December 2015}}</ref> Men in their 30s and 40s are the most common UK victims.<ref>{{cite web |url=http://blog.protectmyid.co.uk/index.php/the-most-likely-victims-of-identity-fraud-men-in-their-late-30s-and-early-40s/ |title=The most likely victims of identity fraud: men in their late 30s and early 40s |url-status=dead |archive-url=https://archive.today/20120708/http://blog.protectmyid.co.uk/index.php/the-most-likely-victims-of-identity-fraud-men-in-their-late-30s-and-early-40s/ |archive-date=8 July 2012 |df= }}, Protect MY ID Blog, 21 January 2011</ref>{{Unreliable source?|date=December 2015}}</ref> and identityIdentity fraud now accounts for nearly half of all frauds recorded.<ref>{{cite web |url=http://www.cifas.org.uk/press_release_twentyeleven_c |title=Fraudscape: report reveals the UK's fraud landscape in 2010 }}, CIFAS</ref>

{{seeSee also|Identity theft in the United States}}

The increase in crimes of identity theft led to the drafting of the Identity Theft and Assumption Deterrence Act.<ref>{{cite web |url=http://www.ftc.gov/os/statutes/itada/itadact.htm |title=FTC.gov |url-status=dead |archive-url=https://archive.today/20120801/http://www.ftc.gov/os/statutes/itada/itadact.htm |archive-date=1 August 2012 |df= }}, Public Law 105-318, 112 Stat. 3007 (30 October 1998)</ref> In 1998, The Federal Trade Commission appeared before the United States Senate.<ref>{{cite web |url=http://www.ftc.gov/os/1998/05/identhef.htm |title=Prepared Statement of the Federal Trade Commission on "Identity Theft" |url-status=dead |archive-url=https://archive.today/20120801/http://www.ftc.gov/os/1998/05/identhef.htm |archive-date=1 August 2012 |df= }}, 20 May 1998</ref> The FTC discussed crimes which exploit consumer credit to commit loan fraud, [[mortgage fraud]], lines-of-credit fraud, [[credit card fraud]], commodities and services frauds. The Identity Theft Deterrence Act (2003)[ITADA] amended [https://www.law.cornell.edu/uscode/text/18/1028A- U.S. Code Title 18, § 1028] ("Fraud related to activity in connection with identification documents, authentication features, and information"). The statute now makes the possession of any "means of identification" to "knowingly transfer, possess, or use without lawful authority" a federal crime, alongside unlawful possession of identification documents. However, for federal jurisdiction to prosecute, the crime must include an "identification document" that either: (a) is purportedly issued by the United States, (b) is used or intended to defraud the United States, (c) is sent through the mail, or (d) is used in a manner that affects interstate or foreign commerce. ''See'' {{usc|18|1028}}(c). Punishment can be up to 5, 15, 20, or 30 years in federal [[prison]], plus fines, depending on the underlying crime per {{usc|18|1028}}(b). In addition, punishments for the unlawful use of a "means of identification" were strengthened in § 1028A ("Aggravated Identity Theft"), allowing for a consecutive sentence under specific enumerated felony violations as defined in § 1028A(c)(1) through (11).<ref>Doyle, Charles. (2013). [https://fas.org/sgp/crs/misc/R42100.pdf Mandatory Minimum Sentencing: Federal Aggravated Identity Theft.] {{webarchive |url=https://web.archive.org/web/20161011031227/https://fas.org/sgp/crs/misc/R42100.pdf |date=11 October 2016 }} Washington, D.C.: [[Congressional Research Service]].</ref>

If charges are brought by state or local law enforcement agencies, different penalties apply dependingto depend on the state.

Six Federal agencies conducted a joint task force to increase the ability to detect identity theft. Their joint recommendation on "red flag" guidelines is a set of requirements on financial institutions and other entities which furnish credit data to credit reporting services to develop written plans for detecting identity theft. The FTC has determined that most medical practices are considered creditors and are subject to requirements to develop a plan to prevent and respond to patient identity theft.<ref>Michael, Sara {{cite web |url=http://www.physicianspractice.com/index/fuseaction/newsletterArticles.view/articleID/87.htm |title=Getting Red Flag Ready |access-date=2009-07-02 |archive-date=2012-09-11 |archive-url=https://archive.today/20120911/http://www.physicianspractice.com/index/fuseaction/newsletterArticles.view/articleID/87.htm |url-status=dead }} PhysiciansPractice.com, 21 May 2009. Retrieved 2 July 2009.</ref> These plans must be adopted by each organization's Boardboard of Directorsdirectors and monitored by senior executives.<ref>[http://www.ftc.gov/os/fedreg/2007/december/071213factafurnisheraccuracy.pdf 72 Fed. Reg. 70944 ] {{webarchive |url=https://web.archive.org/web/20130217151554/http://www.ftc.gov/os/fedreg/2007/december/071213factafurnisheraccuracy.pdf |date=17 February 2013 }} (PDF). Retrieved 29 January 2008.</ref>

Identity theft complaints as a percentage of all fraud complaints decreased from 2004- to 2006.<ref name="autogenerated1">[{{Cite web|url=http://www.ftc.gov/bcp/edu/microsites/idtheft/downloads/clearinghouse_2006.pdf Law Enforcement Contact1 January 1 December 31, 2001] {{webarchive |urlarchiveurl=https://web.archive.org/web/20080911044319/http://www.ftc.gov/bcp/edu/microsites/idtheft/downloads/clearinghouse_2006.pdf|url-status=dead|title=Law Enforcement Contact1 January 1 December 31, 2001|archive-date=11 September 2008 }}</ref> The Federal Trade Commission reported that fraud complaints in general were growing faster than ID theft complaints.<ref name="autogenerated1" /> The findings were similar in two other FTC studies done in 2003 and 2005. In 2003, 4.6 percent of the US population said they were a victim of ID theft. In 2005, that number had dropped to 3.7 percent of the population.<ref name=SR_1>[http{{cite web| title=Federal Trade Commission – Identity Theft Survey Report| url=https://www.ftc.gov/bcpsites/edudefault/micrositesfiles/idtheftdocuments/downloadsreports/synovate_reportfederal-trade-commission-identity-theft-program/synovatereport.pdf| publisher=[[Federal Trade Commission]]| date=September 2002| access-date=5 January 2024}}</ref><ref>{{webarchiveCite web|url=https://webwww.archiveftc.orggov/webreports/20080516094455/httpfederal-trade-commission-2006-identity-theft-survey-report-prepared-commission-synovate|archiveurl=https://wwwweb.ftcarchive.govorg/bcpweb/edu20080911044311/microsites/idtheft/downloads/synovate_report.pdf |date=16 May 2008 }}</ref><ref>[http://www.ftc.gov/os/2007/11/SynovateFinalReportIDTheft2006.pdf |url-status=dead|title=Federal Trade Commission: 2006 Identity Theft Survey Report: Prepared for the Commission by Synovate|date=1 (November 2007)] {{webarchive |url=https://web.archive.org/web/20080911044311/http://www.ftc.gov/os/2007/11/SynovateFinalReportIDTheft2006.pdf |-date=11 September 2008|website=Federal Trade Commission}}</ref> The Commissioncommission's 2003 estimate was that identity theft accounted for some $52.6 billion of losses in the preceding year alone and affected more than 9.91 million Americans;<ref>{{cite web |url=http://www.ftc.gov/opa/2003/09/idtheft.shtm |title=FTC.gov<!-- Bot generated title --> |url-status=dead |archive-url=https://archive.today/20120731/http://www.ftc.gov/opa/2003/09/idtheft.shtm |archive-date=31 July 2012 |df= }}, releases Survey of Identity Theft in U.S. 27.3 Million Victims in past 5 Years, Billions in Losses for Businesses and Consumers</ref> the figure comprises $47.6 billion lost by businesses and $5 billion lost by consumers.

According to the [[Bureau of Justice Statistics|U.S. Bureau of Justice Statistics]], in 2010, 7% of US households experienced identity theft - up from 5.5% in 2005 when the figures were first assembled, but broadly flat since 2007.<ref name="Bureau of Justice Statistics">{{cite web | url=http://bjs.gov/content/pub/pdf/itrh0510.pdf | title=Identity Theft Reported by Households, 2005-2010 | publisher=Bureau of Justice Statistics | year=2011 | accessdateaccess-date=24 June 2013}}</ref> In 2012, approximately 16.6 million persons, or 7% of all U.S. residents age 16 or older, reported being victims of one or more incidents of identity theft.<ref>Harrell, Erika and Lynn Langton. (2013). [http://www.bjs.gov/content/pub/pdf/vit12.pdf Victims of Identity Theft, 2012.] {{webarchive |url=https://web.archive.org/web/20160907043423/http://www.bjs.gov/content/pub/pdf/vit12.pdf |date=7 September 2016 }} Washington, D.C. [[United States Department of Justice|U.S. Department of Justice]], [[Bureau of Justice Statistics]].</ref>

At least two states, [[California]]<ref>{{cite web |url=http://www.privacyprotection.ca.gov/ |title=California Office of Identity Protection |access-date=2009-01-08 |archive-date=2012-08-05 |archive-url=https://archive.today/20120805/http://www.privacyprotection.ca.gov/ |url-status=dead }}</ref> and [[Wisconsin]]<ref>{{citeCite web |url=httphttps://privacydatcp.wi.gov/ Pages/Programs_Services/IdentityTheft.aspx|title=Wisconsin'sDATCP OfficeHome ofIdentity PrivacyTheft Protection|website=datcp.wi.gov|accessdate=25 December 2023}}</ref> have created an Office of Privacy Protection to assist their citizens in avoiding and recovering from identity theft.

In 2009, Indiana created an Identity Theft Unit within their Office of Attorney General to educate and assist consumers in avoiding and recovering from identity theft as well as assist law enforcement in investigating and prosecuting identity theft crimes.<ref>{{cite web|url=http://www.in.gov/legislative/ic/code/title4/ar6/ch13.pdf |title=ArchivedIndiana copyGeneral Assembly |access-date=3 October 2013 |url-status=live |archive-url=https://web.archive.org/web/20131004215445/http://www.in.gov/legislative/ic/code/title4/ar6/ch13.pdf |archive-date=4 October 2013 |df= }}</ref><ref>{{cite web |url=http://www.in.gov/attorneygeneral/2853.htm |title=Attorney General: ID Theft Prevention |publisher=In.gov |date=6 December 2013 |accessdateaccess-date=24 January 2014 |archive-date=11 January 2014 |archive-url=https://web.archive.org/web/20140111062848/http://www.in.gov/attorneygeneral/2853.htm |url-status=dead }}</ref>

In Massachusetts in 2009-20102009–2010, Governor [[Deval Patrick]] made a commitmentcommitted to balancebalancing consumer protection with the needs of small business owners. His Office of Consumer Affairs and Business Regulation announced certain adjustments to Massachusetts' identity theft regulations that maintain protections and also allowsallow flexibility in compliance. These updated regulations went into effect on 1 March 2010. The regulations are clear that their approach to data security is a risk-based approach important to small businesses and might not handle a lot of personal information about customers.<ref>[http://www.mass.gov/?pageID=ocatopic&L=3&L0=Home&L1=Consumer&L2=Identity+Theft&sid=Eoca "Consumer Identity Theft"]. Commonwealth of Massachusetts, 2010 {{webarchive |url=https://web.archive.org/web/20111105045936/http://www.mass.gov/?pageID=ocatopic&L=3&L0=Home&L1=Consumer&L2=Identity+Theft&sid=Eoca |date=5 November 2011 }}</ref><ref>[http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf "Frequently Asked Question Regarding 201 CMR 17.00"] {{webarchive |url=https://web.archive.org/web/20110811054640/http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf |date=11 August 2011 }}, Commonwealth of Massachusetts, Office of Consumer Affairs and Business Regulation, 3 November 2009</ref>

The [[Internal Revenue Service|IRS]] has created{{when|date=August 2017}} the IRS Identity Protection Specialized Unit to help taxpayers' who are victims of federal tax-related identity theft.<ref>{{cite web|title=Taxpayer Guide to Identity Theft|url=https://www.irs.gov/newsroom/article/0,,id=251501,00.html|work=IRS.gov|publisher=US Internal Revenue Service|accessdateaccess-date=29 June 2012 }}</ref> Generally, the identity thief will use a stolen SSN to file a forged tax return and attempt to get a fraudulent refund early in the filing season. A taxpayer will need to fill out Form 14039, [https://www.irs.gov/pub/irs-pdf/f14039.pdf ''Identity Theft Affidavit''].<ref>{{cite web|title=Form 14039|url=https://www.irs.gov/pub/irs-pdf/f14039.pdf|work=IRS website|publisher=US Internal Revenue Service|accessdateaccess-date=29 June 2012}}</ref><ref name="ALERT: Beware of Phishing Scam Mentioning TAS">{{cite web | url=http://www.taxpayeradvocate.irs.gov/Individuals/Identity-Theft | title=ALERT: Beware of Phishing Scam Mentioning TAS | publisher=Taxpayer Advocate | access-date=18 December 2014 | url-status=dead | archive-url=https://web.archive.org/web/20141218162516/http://www.taxpayeradvocate.irs.gov/Individuals/Identity-Theft | archive-date=18 December 2014 | df= }}</ref>

As for the future of medical care and Medicaid, people are mostly concerned about [[cloud computing]]. The addition of using cloud information within the United States medicare system would institute easily accessible health information for individuals, but that also makes it easier for identity theft. Currently, new technology is being produced to help encrypt and protect files, which will create a smooth transition to cloud technology in the healthcare system.<ref>Hyde, J. (2017). Preventing Identity Theft and Strengthening the American Health Care System. Policy & Practice (19426828), 75(5), 26–34.</ref>

Many states followed California's lead and enacted mandatory [[data breach notification laws]]. As a result, companies that report a data breach typically report it to all their customers.<ref>{{cite web |url=http://www.naag.org/states-offer-data-breach-protection.php |title=States Offer Data Breach Protection |url-status=dead |archive-url=https://archive.today/20120913/http://www.naag.org/states-offer-data-breach-protection.php |archive-date=13 September 2012 |df= }}</ref>

Surveys in the US from 2003 to 2006 showed a decrease in the total number of identity fraud victims and a decrease in the total value of identity fraud from US$47.6 billion in 2003 to $15.6 billion in 2006.{{citation needed|date=May 2021}} The average fraud per person decreased from $4,789 in 2003 to $1,882 in 2006. A Microsoft report shows that this drop is due to statistical problems with the methodology, that such survey-based estimates are "hopelessly flawed" and exaggerate the true losses by orders of magnitude.<ref>{{cite web|url=http://research.microsoft.com/pubs/149886/SexLiesandCybercrimeSurveys.pdf |title=Sex, Lies and Cybercrime Surveys |publisher=Microsoft |date=15 June 2011 |accessdateaccess-date=11 March 2015}}</ref>

The 2003 survey from the Identity Theft Resource Center<ref>{{citeCite web |url=httphttps://www.idtheftcenter.org /|title=IDtheftcenter.orgHome Page|website=ITRC|accessdate=25 December 2023}}</ref> found that:

In a widely publicized account,<ref>{{cite web |url=http://www.privacyrights.org/cases/victim9.htm |title=Verbal Testimony by Michelle Brown |url-status=dead |archive-url=https://archive.today/20120921/http://www.privacyrights.org/cases/victim9.htm |archive-date=21 September 2012 |df= }}, July 2000, U.S. Senate Committee Hearing on the Judiciary Subcommittee on Technology, Terrorism and Government Information{{spaced ndash}}"Identity Theft: How to Protect and Restore Your Good Name"</ref> Michelle Brown, a victim of identity fraud, testified before a U.S. Senate Committee Hearing on Identity Theft. Ms. Brown testified that: "over a year and a half from January 1998 through July 1999, one individual impersonated me to procure over $50,000 in goods and services. Not only did she damage my credit, but she escalated her crimes to a level that I never truly expected: she engaged in drug trafficking. The crime resulted in my erroneous arrest record, a warrant out for my arrest, and eventually, a prison record when she was booked under my name as an inmate in the Chicago Federal Prison."

In the United Kingdom, the Home Office reported that identity fraud costs the UK economy £1.2 billion annually<ref>{{cite web |url=http://www.identitytheft.org.uk/ |title=What is Identity theft? |author=Home Office |date=26 May 2004 |publisher=identitytheft.co.uk |accessdateaccess-date=27 September 2010 |author-link=Home Office }}</ref> (experts believe that the real figure could be much higher)<ref>{{cite web |url=httphttps://identity-theft.weeblybestidprotection.com/whatguides/10-isways-to-it.htmlprevent-identity-theft/ |title=Free help, tips and advice on avoiding and dealing with Identity Theft |authorwebsite= bestidprotection.com|date=9 |publisher=identity-theft.weebly.comFebruary |accessdate=2022 }}</ref> although privacy groups object to the validity of these numbers, arguing that they are being used by the government to push for introduction of [[British national identity card|national ID cards]]. Confusion over exactly what constitutes identity theft has led to claims that statistics may be exaggerated.<ref>{{cite web |url=http://www.schneier.com/blog/archives/2005/11/identity_theft.html |title=Identity Theft Over-Reported |author=Bruce Schneier |access-date= |publisher= |accessdate=30 June 2006 |author-link=Bruce Schneier }}</ref>

An extensively reported<ref>{{cite news |url=https://www.bbc.co.uk/news/technology-13726085 |title=Hi-tech crime and sexual partner surveys 'biased' |author= |date= 10 June 2011|work= |publisher= BBC|accessdate= }}</ref><ref>{{cite news |url=http://www.economist.com/node/21532263 |title=Measuring the black web |date= 15 October 2011|newspaper= The Economist}}</ref> study from Microsoft Research<ref>{{cite web |url=http://research.microsoft.com/pubs/149886/SexLiesandCybercrimeSurveys.pdf |title=Sex, Lies and Cybercrime Surveys |first1=D. |last1=Florencio |first2=C. |last2=Herley |date=June 2011 |publisher= Proc. WEIS|accessdate=}}</ref> in 2011 finds that estimates of identity theft losses contain enormous exaggerations, writing that surveys "are so compromised and biased that no faith whatever can be placed in their findings."

* {{annotated link|Spamming}}{{div col end}}

* {{annotated link|Equifax#May-JulyMay–July 2017 security breach|2017 Equifax security breach}}

* {{cite news|title=Transcript of Attorney General Alberto R. Gonzales and FTC Chairman Deborah Platt Majoras Announcing the Release of the President's Identity Theft Task Force |date=23 April 2007 |url=http://www.usdoj.gov/ag/speeches/2007/ag_speech_0704231.html |archive-url=https://archive.today/20070911112747/http://www.usdoj.gov/ag/speeches/2007/ag_speech_0704231.html |url-status=dead |archive-date=11 September 2007 |work=US Department of Justice |pages= |access-date=24 April 2007

* {{cite news |url= https://abcnews.go.com/US/wireStory/woman-prison-time-total-identity-theft-18809034 |title=Woman Gets Prison Time in 'Total Identity Theft' - ABC News |first=Hegeman |last=Roxana |work=ABC News |date=25 March 2013 |accessdateaccess-date=27 March 2013}}