How Criminal Identity Theft Occurs: An In-Depth Look

As a cyber security expert with over a decade of experience, I‘ve seen firsthand the devastating impact that identity theft can have on individuals and organizations. While financial identity theft gets the most attention, one of the most damaging and distressing forms is criminal identity theft. This is where a thief uses someone else‘s personal information in connection with a crime, resulting in a false criminal record being attached to the victim‘s name.

The Scope of the Problem

The latest statistics paint a disturbing picture of the growing threat of identity theft:

• There were over 1.4 million reports of identity theft filed with the FTC in 2022, up 27% from 2021
• Identity theft losses hit a record $24 billion in 2022, according to Javelin‘s Identity Fraud Study
• 17% of identity theft victims in 2022 had their information used for non-financial crimes
• The FBI‘s Internet Crime Complaint Center (IC3) received over 38,000 reports of identity theft in 2022 with losses of $277 million
• 1,862 data breaches were reported in 2022, up 60% from 2021, exposing over 422 million sensitive records

Source: FTC Consumer Sentinel Network Reports 2017-2022

How Do Criminals Steal Identities?

There are numerous ways that identity thieves can get their hands on victims‘ personal information, such as:

Data Breaches – Massive breaches at retailers, financial institutions, healthcare providers and government agencies have exposed billions of sensitive records in recent years. Hackers often sell this stolen data on the dark web to other criminals.

Some of the biggest recent breaches include:

• T-Mobile (2021): 54 million customers‘ data stolen
• Robinhood (2021): 7 million customers‘ personal info accessed
• Volkswagen/Audi (2021): 3.3 million customers‘ data exposed
• Florida Healthy Kids (2022): 3.5 million people‘s data exposed

Phishing and Social Engineering – Criminals trick people into revealing sensitive info by impersonating trusted entities. Methods include:

• Phishing emails purporting to be from government agencies, banks, retailers
• SMS phishing ("smishing") using urgent text messages to lure victims
• Voice phishing ("vishing") scams impersonating fraud departments, tech support
• Malicious social media messages with links to fake login pages
• Fraudulent online job postings used to harvest info from applications/resumes

The FBI‘s IC3 received 300,497 complaints of phishing/smishing/vishing scams in 2022 with over $50 million in losses.

Malware – Malicious software like keyloggers, spyware, and trojans can capture usernames, passwords, credit card numbers, and other sensitive data from infected computers and mobile devices. Common infection vectors include:

• Email attachments and malicious links
• Malvertising (malware delivered through online ads)
• Unpatched software vulnerabilities
• Fake software updates and scam apps
• Compromised or malicious websites

The AV-TEST Institute registers over 450,000 new malware programs every day, many designed to steal identities and financial info.

Insider Threats – Employees may steal customer or co-worker data from company databases to sell on the black market or use for fraud. Healthcare, financial services, and government are common targets. The Ponemon Institute found that insider threats have increased 44% since 2020 with an average cost per incident of $15 million.

Mail Theft – Stealing mail from unlocked boxes or filing change-of-address forms remains a popular way for criminals to get credit cards, checks, tax documents or other sensitive info. The USPS reported over 299,000 complaints of mail theft in 2021, up from 40,000 in 2017.

Source: Palo Alto Networks 2022 Incident Readiness Report

How Do Criminals Use Stolen Identities?

Once criminals have a stolen identity, they can use it in various ways when questioned by police or going through the court system:

Presenting a Fake/Stolen ID – Criminals may hand over a victim‘s driver‘s license or other ID to try to avoid traffic tickets or arrests ending up on their own record. In a survey by the National Association for Public Health Statistics and Information Systems, 16% of respondents reported having their driver‘s license used by an imposter.

Posing as the Victim When Arrested – Identity thieves have been known to verbally provide a victim‘s name, SSN and birthdate to police when arrested so that charges are brought against the wrong person.

Using the Stolen Identity in Court – Criminals may continue using the false identity in court appearances and legal proceedings, even pleading guilty to crimes in the victim‘s name. This results in wrongful criminal convictions and records that can be difficult for victims to expunge.

Signs You‘re a Victim of Criminal Identity Theft

Criminal identity theft can be hard to detect, but some warning signs include:

• Unknown arrests, prosecutions or convictions found on criminal background checks
• Getting denied for jobs, housing or other opportunities due to an undisclosed criminal record
• Receiving court notices, warrants or subpoenas for cases you‘re not involved in
• Having your driver‘s license suspended for violations you didn‘t commit
• Being detained by police for crimes you didn‘t perpetrate

What to Do If You‘re a Victim

If you suspect your identity was used in a crime, quick action is essential to clear your name and mitigate damage:

1. File police reports – Report the fraud to both your local police and the agency where the crime occurred. Get copies of the reports.

2. Freeze your credit – Contact all three credit bureaus to place freezes and prevent new accounts from being opened in your name. Also place a fraud alert.

3. Notify the court – Contact the court where false charges were filed and explain the situation. You may need to appear in court with evidence proving fraud.

4. Inform financial institutions – Alert your banks, credit card issuers, and other entities of the theft. Close any compromised accounts and dispute fraudulent charges.

5. Hire an attorney – Consider hiring a lawyer specializing in identity theft cases to help navigate the legal system, clear your record, and pursue damages.

6. Report to the FTC – File an official identity theft report at IdentityTheft.gov. This affidavit helps when dealing with credit bureaus, creditors, and debt collectors.

7. Check data breach sites – See if your info was exposed in a known breach at HaveIBeenPwned.com. If so, take extra precautions and stay vigilant.

8. Review all accounts and records – Go through credit reports, social media, online accounts, court records and background checks for signs of fraudulent activity.

Protecting Against Criminal Identity Theft

While no one is immune from identity theft, taking proactive measures can greatly reduce your risk:

Safeguard your personal information – Be very selective about sharing your SSN, driver‘s license number, birthdate and other sensitive details. Shred unneeded documents with personal info before discarding.

Use strong authentication – Ensure all online accounts have long, complex passwords that are unique for each site. Even better, use a password manager to securely create and store passwords. Enable multi-factor authentication wherever available.

Beware of phishing attempts – Treat unsolicited messages requesting personal data with caution. Rather than clicking links, navigate directly to official company websites to verify the legitimacy of requests.

Update software regularly – Keep your operating system, browser, and other programs updated with the latest security patches. Enable automatic updates if possible.

Use security software – Install reputable antivirus/anti-malware software on all devices and perform regular scans. Consider a comprehensive security suite that includes a VPN, firewall, and web protection.

Opt out of data brokers – Data broker sites aggregate and sell huge amounts of personal info from public records and other sources. Removing your profile makes it harder for criminals to get the info needed for identity theft. Deletion services like DeleteMe and Privacy Bee can handle the opt-out process for you.

Monitor your credit and accounts – Review your credit reports from all three bureaus at least annually. Check bank and credit card statements every month for suspicious activity.

Consider identity theft protection – For extra peace of mind, you may want to sign up for a service that monitors your credit and scans for misuse of your personal info online. Reputable providers include:

• Aura: Monitors credit, bank accounts, SSN, home title; includes $1M insurance, VPN, password manager, antivirus. Family plans available.
• IdentityForce: Monitors credit, dark web, payday loan applications; offers $1M insurance, tax refund fraud alerts, social media scans.
• IDShield: Monitors credit, court records, dark web, social media; provides $1M insurance, 24/7 fraud support, password manager.

When comparing identity protection services, look for features like:

• Triple-bureau credit monitoring
• Dark web and data breach monitoring
• Financial account monitoring
• Identity theft insurance ($1 million or more)
• Restoration and recovery assistance
• Family or business plans if needed

Staying Vigilant is Key

Identity theft criminals are always adapting their tactics, so constant vigilance is needed to keep your personal data secure.

As more of our lives move online, implementing strong digital hygiene practices is a must. Using complex passwords, enabling multi-factor authentication, being wary of phishing attempts, regularly updating devices, and using a VPN on public Wi-Fi can go a long way in protecting your identity.

It‘s also wise to limit what personal information you share on social media and other public sites. Revealing your full birthdate, addresses, maiden names, pet names, and other details make it easier for fraudsters to piece together a profile that can be used to impersonate you.

Consider signing up for a reputable identity theft protection service for 24/7 monitoring and added peace of mind. Having experts on your side who can quickly spot misuse of your identity and help you recover can be invaluable.

By staying informed about the latest trends in identity theft and implementing multiple layers of security, you can significantly reduce the risk of becoming a victim. Catching criminal identity theft quickly is key to minimizing damage to your record and reputation. But by being proactive, you can stop identity thieves in their tracks before they upend your life.