What Is Digital Identity Theft

Digital identity theft is the criminal act of illegally obtaining another person's personal information or online account credentials and impersonating that person. Stolen information includes email addresses, passwords, credit card numbers, social security numbers, and social media accounts.

Attackers use stolen information for financial fraud, unauthorized purchases, opening new accounts, and further identity theft. Unlike physical theft, victims often do not realize they have been targeted until significant damage has occurred.

Common Tactics and Attack Vectors

Digital identity theft is carried out by combining several techniques.

Phishing: Emails and text messages that impersonate a bank or a service provider lead the victim to a fake site and have them enter login or card details. It is often the entry point for impersonation.
Credential stuffing: Credentials leaked in past data breaches are used to log in to accounts where the same password was reused.
Social engineering: The attacker contacts customer support posing as the victim and abuses the account recovery process to take the account over.
Malware: A keylogger or an information stealer is planted on the victim's device to capture typed passwords and the credentials saved in the browser.
SIM swapping: The attacker poses as the victim to the mobile carrier and moves the phone number to a SIM under their own control, defeating SMS verification and taking over accounts.

These techniques are rarely used on their own; they are usually combined. Information obtained through phishing becomes the basis for a social engineering call, and access is escalated step by step.

What to Do If You Become a Victim

Once you notice that you are a victim of digital identity theft, a fast response keeps the damage from spreading.

Change passwords immediately: Change the password of the compromised account and of every other account where you used the same password.
Contact your financial institutions: If fraudulent card use is suspected, ask the card issuer to suspend the card and reissue it.
Recover your accounts: For accounts that were taken over, contact the support desk of each service and go through its recovery procedure.
File a report: Report the case to the police or to a cybercrime contact point. The record of that report is sometimes required later in procedures with card issuers or insurers.
Check your credit records: Ask the credit reporting agencies that operate in your country to disclose your own records, and check whether loans, card contracts, or application inquiries you do not recognize have been registered. Many agencies also accept a statement from the individual, so a risk of theft or fraudulent use can be noted in advance.

Prevention and Daily Habits

Reducing the risk of digital identity theft comes down to building up everyday security habits.

Turn on two-factor authentication: Enable it on your important accounts. Codes received by SMS can be bypassed through SIM swapping, and one-time codes from an authenticator app also go through in adversary-in-the-middle phishing, where the fake site relays what you type straight to the real one. Passkeys and security keys are bound to the domain of the service, so they cannot be used on a fake site.
Use a password manager: Generate and store a unique, complex password for every service so that reuse disappears.
Limit how much personal information you publish: Review the visibility of your social media profile, your posts, and your contact list. A date of birth, the school you attended, or a pet's name is easily used as the answer to a security question.
Stay wary of phishing: Do not click links in suspicious emails or messages. Reach legitimate services by typing the address yourself or from a bookmark.
Watch for data breaches: Use a service such as Have I Been Pwned to check periodically whether your email address appears in leaked data.

Stolen information is resold and is sometimes used only after a delay. That is why the damage tends to surface late, and why procedures with financial institutions and with individual services end up running in parallel for a long time. Locking in the measures that keep working once they are set up (two-factor authentication and a password manager) makes the later burden smaller.

To learn more about this topic, see Digital Identity Theft: How It Happens and How to Protect Yourself.

Common Misconceptions

I'm not famous, so I won't be targeted for identity theft: Digital identity theft is carried out indiscriminately. Attackers use automated tools to test millions of credentials leaked from data breaches, regardless of the individual's fame or wealth.
If your identity is stolen, changing your password solves the problem: Changing your password is only the first step. Details that cannot be changed the way a password can, such as your name, address, or date of birth, may be abused for a long time. Japan's Individual Number is an exception: when it is deemed to have leaked and to be at risk of misuse, the head of the municipality assigns a new number at the person's request or on its own authority (Act on the Use of Numbers, Article 7, Paragraph 2). You need to act on the assumption that such information stays fixed, for example by requesting disclosure of your own records from credit reporting agencies and by contacting your financial institutions.

Digital Identity Theft