Identity theft is one of the most frequently reported consumer crimes in the United States. In 2024, the Federal Trade Commission received more than 1.1 million identity theft reports, part of 6.5 million fraud-related complaints filed that year.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 Industry research estimated total identity fraud losses at $27.2 billion in 2024, a 19 percent jump over the year before. And those figures capture only what gets reported; many victims never file with any agency at all.
How Many Reports Are Filed Each Year
The FTC runs the Consumer Sentinel Network, a database that collects fraud and identity theft complaints from consumers and shares them with law enforcement agencies across the country.2Federal Trade Commission. Consumer Sentinel Network In 2024, that network logged roughly 1,135,000 identity theft reports out of 6.5 million total consumer reports.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 Roughly one in six consumer complaints to the FTC involves identity theft, making it one of the single largest categories the agency tracks.
The raw material for identity theft comes largely from data breaches. The Identity Theft Resource Center recorded 3,152 publicly reported data compromises in 2024.3Identity Theft Resource Center. 2025 Annual Data Breach Report – Record Number of Compromises Since the organization began tracking breaches in 2005, it has cataloged more than 25,000 incidents that collectively exposed an estimated 79 billion records.4Identity Theft Resource Center. ITRC 2025 Annual Data Breach Report A single large corporate breach can expose tens of millions of records at once, and that stolen data circulates on illicit markets for months or years before it turns up as a fraudulent account on someone’s credit file.
Total losses reported to the FTC across all forms of consumer fraud topped $12.5 billion in 2024. Victims often don’t notice the problem until an unfamiliar account shows up on a credit report or the IRS flags a duplicate tax filing. Because of that lag, the actual number of identity theft incidents in any given year almost certainly runs higher than the report count suggests.
The Most Common Types of Identity Theft
Not every form of identity theft is equally common. Credit card fraud dominates the numbers. In 2024, credit card identity theft generated roughly 449,000 complaints to the FTC, covering both unauthorized charges on existing accounts and entirely new accounts opened in someone else’s name.5Federal Trade Commission. Consumer Sentinel Network Data Book 2024 The sheer volume of online card transactions keeps this category at the top year after year.
The next most common categories, by 2024 report volume:
- Loan or lease fraud, with about 176,000 reports. Victims typically find out when an unfamiliar personal loan or vehicle lease shows up on their credit profile, sometimes only after a collections agency calls.
- Bank account fraud, with about 115,000 reports. New accounts opened fraudulently or unauthorized withdrawals from existing ones.
- Employment or tax-related fraud, with about 87,000 reports. Someone uses a stolen Social Security number to get hired or to file a return claiming a refund.
- Phone or utilities fraud, with about 83,000 reports. Service accounts opened in the victim’s name.
- Government documents or benefits fraud, with about 70,000 reports. This category spiked during the pandemic-era wave of unemployment insurance fraud and has since declined, though it remains a persistent problem.
Medical Identity Theft
One form that doesn’t always surface cleanly in FTC data is medical identity theft, where someone uses your health insurance information or Social Security number to obtain care. It’s particularly dangerous because it can alter your permanent medical records, potentially introducing incorrect blood types, allergies, or diagnoses. The American Health Information Management Association has warned that the cascading effects can compromise both finances and actual medical care. Where credit card fraud usually surfaces within a billing cycle, medical identity theft can go undetected for years.
Who Gets Targeted Most
Adults in their 30s file the most identity theft reports with the FTC, accounting for roughly a quarter of all cases. This group tends to carry heavy digital transaction loads, established credit histories worth exploiting, and enough financial activity to create multiple points of exposure. Adults in their 20s follow closely behind.
Older adults face a different threat profile. Seniors are more often targeted by medical identity theft, tax-related scams, and benefit diversion schemes. They may not discover the fraud until they try to access Medicare benefits or file a tax return and learn someone has already claimed their refund. While older victims file fewer total reports, research consistently shows their per-incident losses are higher, often because the schemes reach retirement savings or benefit payments that are harder to recover.
Active-duty military members carry elevated risk as well. Service members deploy for long stretches without regular access to bank statements or credit reports. Their steady paychecks and security clearances also make them attractive targets. The FTC lets active-duty personnel place free active-duty alerts on their credit files, which require creditors to take extra verification steps before opening new accounts.
Why the Numbers Keep Climbing
The upward trend isn’t accidental. Data breaches keep supplying fresh material, and the shift to digital applications for credit cards, loans, and government benefits gives criminals more ways to use stolen information without ever showing up in person. Fraud detection has improved, but so have the tools available to perpetrators. VPNs and residential proxy networks can make someone applying for a credit card from overseas appear to be sitting at the victim’s home address. Banks now analyze IP metadata and geographic mismatches as part of screening, but the arms race between detection and evasion continues.
Volume also drives down the price of stolen data. A Social Security number, date of birth, and mother’s maiden name can be purchased for a few dollars on dark web marketplaces, which puts identity theft within reach of a wide range of criminals rather than only sophisticated operations. Until breach prevention catches up to breach frequency, the report totals are unlikely to fall.
What to Do If It Happens to You
Given how common identity theft is, the practical question for most people is what to do when it hits. The FTC’s IdentityTheft.gov portal generates a recovery plan tailored to your situation, with pre-filled letters and forms for creditors and credit bureaus. The core steps:
- Place a fraud alert or credit freeze. You have the right to a free security freeze with each of the three major credit bureaus, which blocks new creditors from pulling your report and effectively stops anyone from opening new accounts in your name. The bureau must place the freeze within one business day of a phone or online request.6Federal Trade Commission. Fair Credit Reporting Act – Section 605A
- File an FTC identity theft report. It serves as your official record of the crime and is accepted by credit bureaus, creditors, and many financial institutions when you dispute fraudulent accounts.
- Dispute the fraudulent accounts. When you notify a credit bureau of inaccurate information, it must investigate and resolve the dispute within 30 days. If the bureau can’t verify the information, it must delete it.7Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
- File a police report. Some creditors and insurers ask for one on top of the FTC report. Most agencies provide reports at no cost to identity theft victims.
Recovery is where identity theft grinds people down. Each fraudulent account usually needs separate disputes with the creditor and each credit bureau. Tax-related cases can delay a refund by months while the IRS untangles duplicate filings. Medical identity theft may require contacting every provider whose records were touched. Victims spent an average of 10 hours resolving the aftermath in 2024, but that average masks enormous variation: a single unauthorized credit card charge might take an afternoon, while a case involving several account types can stretch across months of paperwork.
How much of the loss you personally absorb also depends on the type of account. Federal law caps liability for unauthorized credit card charges at $50, and most major issuers waive even that under zero-liability policies.8Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Debit card fraud is riskier, because under Regulation E your liability grows the longer you wait to report it, from $50 within two business days up to unlimited losses after 60 days.9Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers Reporting quickly is the single most valuable thing you can do once you spot a problem.