Identity Theft: Recognizing It and Guarding Against It

What this means

Identity theftThe use of another person's personal identifying information to commit a crime, such as opening accounts or making charges in their name. is a crime, and the person whose information was taken is the victim of it, not the cause of it. That framing matters, because shame keeps victims quiet and quiet victims lose more.

What thieves want is personally identifiable informationDetails that can identify a specific person, such as a Social Security number, account numbers, date of birth, and login credentials.. Some pieces are far more damaging than others. A Social Security number, a bank or card number, and account login credentials are the high-value items, because they can be used to impersonate you to institutions that will act on that identity.

You do not need to know how these crimes are carried out. You need to recognize the situations in which information leaves your control. Consumer protection agencies describe several recurring patterns, and knowing the shape of them is the defense.

PhishingA message that impersonates a trusted organization to trick the recipient into revealing information or clicking a harmful link. messages arrive by email, text, or social media and appear to come from a bank, a school, a delivery service, or a game platform. They generate urgency and ask you to confirm something. The same approach by phone is often called vishing, and the caller may have some real detail about you that makes them sound legitimate.

Information also leaks without any interaction from you. A data breachAn incident in which information held by a company or institution is accessed by unauthorized parties. at a company you did business with can expose records you never mishandled. Physical documents matter too: mail, forms, and receipts contain identifiers, and discarded paperwork is a known source. Public places create exposure through people watching a screen or keypad. Public wireless networks are not private. And social media quietly supplies the answers to security questions, since birthdays, pet names, schools, and family members are the very things those questions ask about.

The defense is not one dramatic action. It is a set of habits: reveal identifiers rarely and only when you initiated the contact, verify independently before responding to any message that creates urgency, use strong distinct passwords with multi-factor authentication, secure your devices, and check your accounts often enough to notice something wrong early.

Why it matters

You already have an identity worth stealing. Young people are attractive targets precisely because they have clean records and rarely check for problems, which means a fraudulent account can go unnoticed for years and surface at the worst possible moment, such as a first apartment application or a first loan.

You are also making dozens of small disclosure decisions every week without registering them as decisions. Every form, every app permission, every quiz that asks for your first pet's name. Recognizing them as decisions is most of the work.

Try it

1. Working from consumer protection resources published by the Federal Trade Commission, the Consumer Financial Protection Bureau, or your state attorney general's office, build a class reference chart of the recognized categories of how personal information is obtained. Aim for at least six categories, each with a one-sentence description of what it looks like from the victim's side.
2. For each category, write the single defensive action that best counters it. One action per category, the strongest one.
3. Run a recognition drill. Your teacher will show a set of messages, some legitimate and some fraudulent, drawn from published examples in agency consumer alerts. For each, decide in fifteen seconds whether you would act on it, and write down the one detail that drove your decision.
4. Review the drill as a class. The valuable part is not your score. It is comparing which signals people relied on. Build a class list of the warning signs that actually turned out to be reliable.
5. Now the sensitive-information inventory. List every category of personal information about you that exists in the world: at school, at a doctor's office, in apps, on social media, on paper at home. Do not write the actual values, only the categories and where they live.
6. Rank those categories by how much damage their exposure would cause. Circle the top three. These are the ones your habits should be built around.
7. Audit your social media presence for security-question answers. Without posting anything new, identify what a stranger could learn about your birthday, schools, family members, pets, and hometown. Write down what you found, and one change you could make.
8. Build a mobile-finance safety checklist of at least eight items. Include device lock and biometric settings, app store source, app permissions, multi-factor authentication, avoiding financial transactions on public wireless networks, using the app instead of following links from messages, notification alerts for account activity, and what to do if the device is lost.
9. Research the reporting process. Using the FTC's identity theft resources, write down the steps a victim is advised to take and where they are advised to report. Keep this factual and sourced.
10. Write a one-page personal protection plan with three sections: what I will guard most closely, what I will verify before responding to, and what I will check regularly and how often.

Check yourself