Identity Theft Trends 2026: Statistics and Prevention
Identity theft rates in the U.S. have continued to rise through 2026, with cybercriminals using new AI-driven methods for committing fraud. Learn more about the most common types of identity theft this year and how to protect yourself and your data from unauthorized use.
Identity Theft Statistics and Key Trends for 2026
According to the Identity Theft Resource Center’s 2026 Trends in Identity Report, the most prevalent types of data compromises that could result in identity theft this year were scams involving shared personal information and unauthorized device access. For the first time, unauthorized device access surpassed scams as the primary threat for adults aged 35 to 64. The most common types of data compromises include:
- Scams involving shared personal information: 36.1%
- Unauthorized device access: 27.2%
- Physical items stolen: 16.4%
- Data breaches: 10.2%
- Personal information on the dark web: 3.7%
- Other: 6.4%
As for types of identity misuse, nearly half of identity theft cases involved existing account takeovers, while others involved the creation of new accounts, fraudulent employment, IRS misuse, and crimes committed using victims’ personal information. Fraudulent employment became the most common type of identity misuse among children and dependents. Additionally, only 9% of victims who experienced financial loss reported being able to reach a resolution.
AI-Assisted Impersonation and Social Engineering
AI technology enables the creation of convincing synthetic content such as social media profiles, personalized conversations, videos, and audio. This content is becoming harder to detect and easier to make, allowing criminal actors to commit fraud against individuals, businesses, and financial institutions.
Criminals may use generative AI to create more convincing emails, text messages, documents, customer-support conversations, images, or voice impersonations. In 2025, the FBI’s Internet Crime Complaint Center identified more than 22,000 AI-related complaints and approximately $893 million in associated losses.
Deepfakes and Forged Identity Evidence
Detecting manipulated photographs, identity documents, videos, and biometric submissions has become crucial in the current digital landscape. NIST’s updated Digital Identity Guidelines include controls to address forged media and injection attacks, underscoring the growing need for deepfake-resistant identity verification.
Account Takeover Fraud
Stolen passwords, phishing, credential stuffing, compromised email accounts, malicious account-recovery requests, and intercepted authentication codes can enable criminals to seize existing financial, retail, email, or social media accounts. The FBI highlighted approximately 4,700 account-takeover complaints involving $359.7 million in reported losses during 2025.
Impersonation Scams Designed to Collect Identity Information
Cybercriminals may pose as banks, government agencies, employers, technology companies, law enforcement personnel, delivery services, or relatives to collect victims’ identity information and use it to access their accounts. Their immediate objective may be stealing money, personal information, credentials, or authentication codes. FTC data shows more than one million imposter scam reports and $3.5 billion in reported losses in 2025.
Social Media as a Starting Point for Identity-Related Fraud
Fake profiles, deceptive advertisements, compromised accounts, direct messages, investment groups, and marketplace listings can be used to establish trust or direct consumers to phishing sites. Nearly 30% of consumers reporting a fraud loss in 2025 said the contact began on social media, resulting in approximately $2.1 billion in reported losses.
Who is Most at Risk of Identity Theft?
Anyone can be affected by identity theft, but certain traits may increase a person’s exposure or lead to more severe consequences. Older adults often experience larger financial losses. In the FBI’s 2025 data, people aged 60 and older reported approximately $7.75 billion in internet-crime losses—more than any other listed age category.
FBI data also shows that the most common crime types by age group are extortion for people under 30 and phishing or spoofing for people 30 and over. Older adults over age 60 may also be more easily victimized by cryptocurrency scams. The highest identity theft rates happened to 30-49-year-olds, though identity theft complaint numbers nearly doubled for people aged 60 and up from 2023 to 2025.
What Are the Most Common Warning Signs of Identity Theft?
If you believe your identity may be compromised, keep an eye out for suspicious financial, credit, tax, medical, employment, and account activity, such as:
Unexpected Bills or Collection Notices
Invoices, debt-collection calls, medical bills, utility balances, or loan notices associated with unfamiliar transactions or accounts.
Missing Mail or Unexpected Address Changes
Disappearing statements, new account letters, replacement cards, or address change confirmations.
Login and Password-Reset Alerts
Notifications about unfamiliar devices, password changes, changes to recovery addresses, new authentication methods, or repeated login attempts.
Mobile Service Suddenly Stops
An unexpected loss of calls or texts may indicate a SIM swap or an unauthorized account change and should be reported to the carrier immediately.
How Can You Prevent Identity Theft in 2026?
You can help prevent identity theft in 2026 by freezing your credit if you see suspicious account activity, using unique passwords and multifactor authentication, and securely disposing of all sensitive documents.
Freeze Your Credit With All Three Credit Bureaus
Freezing your credit restricts outside access to your credit file, making it harder for criminals to open new credit accounts in your name. Freezes are free to place and lift, but consumers must contact Equifax, Experian, and TransUnion separately.
Use Multifactor Authentication
Enable multi-factor authentication on your accounts whenever possible, including your email, financial, tax, social media, retail, healthcare, and mobile provider accounts. This provides an additional barrier when a password is compromised.
Use Unique Passwords and a Password Manager
Use long, unique passwords for every account and a reputable password manager rather than memorizing or reusing variations of the same password.
Securely Dispose of Sensitive Documents
Shred any physical documents containing personal, medical, financial, tax, or account information before disposal. The FTC specifically recommends shredding items such as expired identification, credit reports, and outdated financial records.
Obtain an IRS Identity Protection PIN
An IRS IP PIN is a six-digit number that helps prevent someone else from filing a federal tax return using the consumer’s Social Security number or Individual Taxpayer Identification Number.
Freeze a Child’s Credit
Parents and guardians should consider freezing their children’s credit, particularly after a breach involving a school, healthcare provider, government program, or family account. This can prevent unauthorized actors from opening accounts in your child’s name.
What Should You Do Immediately After Identity Theft?
Immediately after learning you have been affected by identity theft, lock or close compromised accounts, stop pending transactions, and freeze your credit with the three major credit bureaus. Then, report the theft to IdentityTheft.gov, the federal government’s central resource for reporting identity theft and obtaining a personalized recovery plan, checklists, and sample letters.
What Legal Rights Do Identity Theft Victims Have?
Depending on the state they live in, consumers have different sets of protections from identity theft. Consumers also have federally protected rights under the Fair Credit Reporting Act, which allows identity theft victims to place fraud alerts and security freezes on credit files, obtain free copies of credit reports, block fraudulent data from credit reports, and more. Consumers may also have legal options if a data breach or company negligence led to their identity being stolen.
The Right to Dispute Inaccurate Information
Consumers may dispute inaccurate credit report information with both the consumer reporting company and the business that supplied it. The organizations generally must investigate and correct qualifying inaccuracies.
The Right to Extended Fraud Protections
Qualifying victims with an Identity Theft Report may request a seven-year extended fraud alert and additional free credit reports.
The Right to Obtain Fraudulent Transaction Records
Section 609(e) of the Fair Credit Reporting Act generally requires covered businesses to provide identity-theft victims with relevant application and transaction records within 30 days after receiving a qualifying written request.
Stay Informed and Protect Your Identity in 2026
With the proliferation of AI technologies such as deepfakes, the risk of identity theft continues to rise in 2026, especially for older adults. It’s important for consumers to stay proactive in protecting their personal information and understanding their rights. View our active news feed to learn more about ongoing data breaches and other data privacy concerns that may lead to identity theft.