What Can Identity Thieves Do With Your Personal Info and How Can You Protect Yourself?

How Does Identity Theft Happen?

Identity theft happens when someone steals personal information that they can use to imitate another person. Sometimes, people distinguish between identity theft—the act of stealing information—and identity fraud—using someone else's identity to commit a crime. But the terms are also commonly used interchangeably.

There are many ways that identity theft can happen:

• Data breaches: A data breach could expose your personal information, which the attackers might use or sell on the dark web.
• Lost or stolen possessions: Thieves could steal or opportunistically pick up your wallet, phone, mail or other documents or possessions that have your personal information.
• Malware: If malware, or malicious software, infects one of your devices, someone might be able to take control of the device to imitate you or snoop on anything you enter or send from the device.
• Unsecured browsing: If you use an unsecured Wi-Fi network or enter information into an unsecured or scam website, attackers could snoop on your activity or try to install malware onto your device.
• Phishing: Some criminals send phishing (email), smishing (text) and vishing (voice) messages to try to lure you into sharing your personal information. They might do this directly, by asking you to "confirm" your personal information, or as the first part of a multistep attack that includes a link that will download malware onto your device or send you to an unsecured website.
• Card skimming: Skimming devices can be attached to card readers to steal information from your debit and credit cards and make copies of your card.

Identity theft can also happen when a family member, friend or roommate steals or uses your personal information without your consent.

Learn more: Different Types of Identity Theft and Fraud

What Is Personally Identifiable Information?

Personally identifying information (PII) is information that can distinguish one person from someone else. Some PII, such as your Social Security number or biometric data, like a fingerprint or retina scan, can identify you directly. Other PII can help distinguish you, but it's only one piece of the puzzle. For example, you might share the same birthplace with many people, but it's unlikely that you share the same birthplace, name and date of birth with someone else.

Common types of personally identifiable information:

• Full name
• Home address
• Birth date
• Email address(es)
• Birthplace
• Phone number
• Social Security number (SSN)
• Mother's maiden name
• Biometric data
• Medical records
• Passport number
• Military credentials
• Vehicle identification numbers (VINs)
• Driver's license number
• Educational records or information
• Credit or debit card numbers
• Employment information
• Insurance information

The more pieces of PII an identity thief can obtain, the more likely they'll be able to imitate you and commit different types of identity fraud.

What Can Identity Thieves Do With Your PII?

Identity thieves can profit off your personal information in different ways, and some criminals specialize in one type of crime or attack. Here are some of the ways thieves can use your sensitive information.

Steal Your Identity

Identity thieves can use your personal information, such as your Social Security number, to impersonate you and carry out any number of illicit schemes. For example, criminals might be able to use your information to apply for government benefits, such as unemployment. They may also use your information to file a fraudulent tax return, making up numbers or information to guarantee they get a large refund.

Take Over Your Accounts

Criminals can try to take over your accounts, including bank, credit card, phone, ecommerce and loyalty program accounts. They can then try to steal anything of value, from directly transferring funds to using your gift cards or points. They could also try to change your password, email, username, phone number or PIN to make it difficult for you to quickly or respond to the compromise.

And, even if fraudsters don't take over your account, they might be able to persuade your card issuer to add them as an authorized user or your bank to mail them a checkbook. They can then use the card or checks to commit fraud.

Apply for New Accounts

Someone could apply for a new credit card, bank account or loan in your name. They might steal the new credit card out of your mailbox, or have the card or account information mailed to an address they control.

Get Medical Procedures

Medical identity theft can happen if someone steals or buys your identity and medical PII. The person might be able to use your health insurance to get medications or procedures, which can be dangerous if these fraudulent activities are added to your medical records.

Sell Your Data on the Dark Web

The dark web is a hidden part of the internet that's popular among criminals because activity there is difficult to trace. One of the illegal activities that happens on the dark web is the buying and selling of stolen consumer data. Your sensitive information could wind up on the dark web if you're the victim of a phishing attempt. Or, it could be sold there if you're impacted in a data breach.

Commit Other Types of Fraud

Although the identity crimes above are common ways that identity thieves and fraudsters use PII, it's not an exhaustive list—and some less common attacks can be just as scary.

For example, someone might take over your social media accounts and blackmail you by threatening to share personal or embarrassing information or pictures with your contacts. And there are cases of identity thieves fraudulently transferring home titles and then taking out mortgages against the victims' homes.

It's also important to be cautious whenever something feels amiss or too good to be true: Fraudsters continually create new scams and schemes.

Learn more: The Latest Scams You Need to Be Aware Of

How Do I Protect Myself From Identity Theft?

Protecting your PII can be ongoing and difficult, but there are several steps you can take to help you stay safe.

How to Protect Your Information Online

• Practice good password hygiene. Create unique and strong passwords for all your accounts, especially those with PII. A password manager can make this easier.
• Make it harder to hack your accounts. Enable multifactor authentication (MFA) to help keep your account secure even if some of your PII is compromised.
• Browse on secure networks. Don't log in to your accounts while using public Wi-Fi networks or someone else's device. If you need to use public Wi-Fi, consider using a virtual private network (VPN) to protect your privacy.
• Know the signs of phishing. Learn how to spot and avoid email spoofing and other online phishing attempts.

How to Protect Your Information Offline

• Safeguard your Social Security number. Never carry your Social Security card in your wallet or write your SSN on a form without double-checking that it's required.
• Secure your devices. Add passwords to all your devices and install system and software updates when they're available.
• Protect sensitive documents. Try to get the mail out of your mailbox right away. You should also shred documents that have PII before throwing them away.
• Don't fall for phishing attempts. Don't respond to text messages or phone calls that ask you to share PII. Even if it looks like the message is coming from a legitimate company or government agency, criminals can spoof their information to hide their identity.
• Defend against tax fraud. Request a free Identity Protection PIN from the IRS.

How Do I Know if My Identity Has Been Stolen?

Unfortunately, even if you follow every best practice for keeping your information safe, mistakes can happen or a data breach could leak your PII. These tips can help you quickly detect if your information has been exposed:

• Regularly check your account statements.
• Look for unexpected statements, bills or application rejection letters in the mail.
• Add transaction or balance notifications to your credit card and bank accounts.
• Sign up for free credit monitoring, which will alert you to new accounts and other activity on your report. You have the right to dispute information on your credit report that you believe is inaccurate.

Learn more: How to Check for Identity Theft

How Do I Report Identity Theft?

You can follow these steps to report identity theft, depending on the types of data stolen and the impact:

• Report the fraud to your creditors. If you notice unauthorized account activity or believe that your credit or other financial accounts are compromised, contact the impacted financial institutions right away. They can work with you to reverse transactions and secure your accounts.
• Notify other relevant organizations. Identity thieves can use your personal information to carry out any number of schemes, including applying for benefits, filing tax returns, applying for jobs or committing crimes. If you become alerted to any fraudulent activities using your information, contact the impacted companies, agencies or service providers to report the crime.
• File a report with the Federal Trade Commission (FTC). It's a good idea to notify the FTC using its IdentityTheft.org site. This will help you generate a report that you can present to organizations as you work to recover from the ID theft. The FTC site also creates a personalized recovery plan based on how you've been targeted.
• Consider reporting the ID theft to the police. It may be a good idea to report the identity theft to your local police department. They may wish to conduct their own investigation, and they may also be able to provide you with a police report that can aid you as you dispute fraudulent charges or accounts.
• Freeze your credit or place a fraud alert. You have the right to add a security freeze or fraud alert to your credit reports. Freezing your credit limits access to your reports, potentially blocking creditors from processing new applications in your name. A fraud alert notifies creditors that you may be the target of identity theft and instructs them to take additional steps to confirm your identity before extending offers for new credit.

Learn more: Steps to Take After Identity Theft

See if Your PII Is Already on the Dark Web

Data breaches have compromised many people's PII, and there's a good chance that your PII could wind up in a criminal's hands. You can check to see if your SSN, email or phone number are already on the dark web with a free dark web scan. You can also use Experian's personal privacy scan to see what PII people can find on the public web. And if you want to continually monitor various databases for your information, a program like Experian IdentityWorksSM can quickly alert you if your PII is found online.