Identity Theft and Internet Scams
Identity theft is the quiet disaster: by the time you notice, someone has already opened accounts, filed a tax return, or drained a card in your name. It rarely involves a dramatic hack — it's assembled from data you leaked, breaches you were caught in, and scams you almost didn't fall for. The defense is partly prevention and partly speed, because the difference between an annoyance and a year of cleanup is how fast you catch it.
How your identity gets taken
- Data breaches. Your details sit in dumps traded among criminals; you can't undo a breach, only limit what it unlocks.
- Phishing and scams. You're persuaded to hand over the details directly (see Phishing in the Age of AI).
- Account takeover. A reused password from one breach opens ten other accounts.
- Physical theft. Mail, wallets, and the photo of your license you texted someone.
The scams that lead the pack
Most identity theft starts as a scam. The current heavy hitters: the imposter scam (a "government agency," "bank fraud department," or "tech support" creating panic), the romance scam (months of trust, then an emergency that needs money), the job/overpayment scam (a check that bounces after you've wired the difference), and the investment/crypto scam ("pig butchering," where a long grooming period ends in a fake trading platform). The common thread is manufactured urgency or manufactured intimacy — both designed to switch off your skepticism.
Prevention that actually moves the needle
- Freeze your credit. The single most effective control, and it's free. A credit freeze at each of the three major bureaus stops new accounts from being opened in your name; thaw it briefly when you actually apply for credit. Do this even if you've never been a victim.
- Unique passwords + MFA so one breach doesn't cascade (see Passwords, Passkeys, and MFA).
- Guard the identity trifecta — full Social Security number, date of birth, and mother's maiden name. Question anyone who asks; most who "need" it don't.
- Shred financial mail; opt out of pre-approved credit offers.
- Reduce your exposure at data brokers (see Reclaiming Your Privacy).
Catch it early: monitoring
Prevention leaks, so watch for the aftermath. Review bank and card statements for small "test" charges. Read the free annual credit reports (stagger the three bureaus across the year for rolling coverage). Turn on transaction alerts. And treat any bill, collection notice, or tax rejection for something you didn't do as a fire alarm, not junk mail.
If it happens — the exact steps
- Go to IdentityTheft.gov (the FTC's official recovery site). It generates a personal recovery plan and an official affidavit — start here.
- Place a fraud alert and, ideally, a freeze with the three credit bureaus.
- Contact the fraud department of each affected bank or creditor; close or lock compromised accounts.
- Change passwords, starting with email and financial accounts.
- File a police report if there are known transactions or if a creditor requires one.
- Keep a dated log of every call and letter — recovery is a paperwork marathon, and records win disputes.
Stop before you give up the identity trifecta. Think of a credit freeze as a lock you leave on by default. Connect your accounts to alerts, so theft announces itself instead of hiding.