Identity Theft Statistics 2026: Reports, Losses and Trends

Identity theft statistics for 2026 show a common, under-reported crime increasingly fed by data breaches. The latest federal survey found 9% of US residents 16 or older, about 23.9 million people, were victims in one year. The FTC received 1,135,291 identity theft reports in 2024, its newest Data Book year. FBI identity theft complaints rose 48% in 2025, to 31,675. The nonprofit Identity Theft Resource Center counted 2,236 US data compromises in 2025 involving Social Security numbers. Below are the verified numbers, what each counts and what they mean for organizations.

Identity theft statistics at a glance

Every figure below was checked against the publisher's own report or page on 5 November 2026. The sources count different things (reports, complaints, survey estimates, breach notices), so read the "What it counts" column before comparing two rows.

Primary sources for each row are linked in the sections below and listed under Sources and References.

Where is the FTC's 2025 Data Book?

As of 5 November 2026, the FTC's Consumer Sentinel reports page still lists the 2024 Data Book, published in March 2025, as its newest edition. The FTC has released 2025 totals for fraud, but not a 2025 identity theft breakdown. In testimony to the Joint Economic Committee on 25 March 2026, the FTC said consumers filed 3 million fraud reports in 2025 and reported USD 15.9 billion in losses, up from 2.6 million reports and more than USD 12 billion in 2024. Those figures cover fraud, not identity theft, so this page uses the 2024 Data Book for every FTC identity theft number and will be updated when a newer Data Book appears.

Four sources, four different counts

Identity theft numbers disagree because each publisher counts a different unit. Mixing them produces claims like "every few seconds someone becomes a victim" that no single dataset supports.

The practical rule: use BJS for "how many people", the FTC for "what kind and where", the FBI for "what was lost in reported cybercrime", and the ITRC for "where the data comes from."

How common is identity theft?

The federal household survey: about 1 in 11 people a year

The best answer to "how common is identity theft" comes from the Bureau of Justice Statistics. Its Victims of Identity Theft, 2021 report, published in October 2023 and based on the Identity Theft Supplement to the National Crime Victimization Survey (fielded July to December 2021), found:

• 9% of US residents age 16 or older, about 23.9 million people, had been victims of identity theft in the prior 12 months.
• 22% had experienced identity theft at some point in their lifetime.
• For 76% of victims, the most recent incident involved misuse of only one type of existing account, such as a credit card or bank account.
• About 2% of people 16 or older experienced misuse of an existing email or social media account.
• 59% of victims had losses of USD 1 or more, which totaled USD 16.4 billion.
• Only 7% of victims reported the incident to police, while 67% contacted a credit card company or bank.

That 7% figure explains why report-based datasets are so much smaller than the survey estimate. Most identity theft is resolved with a bank or card issuer and never reaches the police, the FTC or the FBI.

Reports to the FTC: about 3,100 a day

The FTC's Consumer Sentinel Network is the largest US database of identity theft reports. It collects reports filed directly with the FTC (including through IdentityTheft.gov) and from other agencies and organizations. In 2024 it received 6,471,708 reports in total, and identity theft was the second-largest of 29 categories, behind credit bureaus and information furnishers (FTC Consumer Sentinel Network Data Book 2024).

The 2024 total works out to about 3,100 reports a day (1,135,291 over 366 days; our calculation). Reports more than doubled in 2020, peaked in 2021 and then fell back. The 2024 count was about 9% higher than 2023 (our calculation). The FTC stresses that its Data Book is based on unverified reports filed by consumers, not on a survey, and that Sentinel keeps reports for five years.

Complaints to the FBI: up 48% in 2025

The FBI's Internet Crime Complaint Center publishes the newest federal identity theft data. Its 2025 Internet Crime Report, released in April 2026, counted 1,008,597 complaints across all crime types and USD 20.9 billion in reported losses. IC3 defines identity theft as someone wrongfully obtaining and using personally identifiable information in a way that involves fraud or deception, and tracks personal data breaches as a separate category.

Identity theft complaints rose 48% year over year and reported losses rose about 7% (our calculations from IC3's three-year comparison tables). Personal data breach complaints, where a victim's sensitive data was exposed or used without authorization, were more than twice as common as identity theft complaints and carried about seven times the losses. These complaint counts are far smaller than the FTC's because most identity theft victims never file with the FBI.

The most common types of identity theft

Credit card fraud has been the most reported type of identity theft to the FTC in every year since 2022. Most of it is not someone using an existing card: of the 449,032 credit card reports in 2024, 406,110 involved a new account opened in the victim's name.

Source: FTC Consumer Sentinel Network Data Book 2024, pages 8 and 14. Consumers can report more than one type, and 14% of 2024 identity theft reports did, so the types add up to more than the total.

Two patterns matter for organizations. First, new-account fraud dominates: criminals use stolen personal data to open credit cards, loans, phone lines and utility accounts, which means the weak point is often an account-opening flow, not the victim's existing login. Second, email, social media and online payment account takeovers keep growing, and these start with stolen or reused credentials. Our account takeover statistics cover that side in depth. For card fraud losses, card-not-present fraud and e-skimming, see our credit card fraud statistics.

Medical identity theft is a small but serious slice of the FTC data. For PHI exposure, healthcare fraud and patient portal risk, see our separate analysis of medical identity theft statistics.

Identity theft losses

Identity theft losses are hard to total because each source measures something different:

• USD 16.4 billion in losses for the 59% of victims who lost money in 2021, according to the BJS survey. This is the only survey-based federal loss estimate.
• USD 185.8 million reported in IC3 identity theft complaints in 2025, plus USD 1.31 billion in personal data breach complaints.
• USD 15.9 billion in all fraud losses reported to the FTC in 2025. This figure covers fraud such as investment and imposter scams, not identity theft, and the FTC does not attach a dollar loss to its identity theft reports.

The gap between USD 185.8 million and USD 16.4 billion is not a contradiction. Complaint data captures only the small share of victims who report to the FBI, while the survey estimates losses across the whole population, including amounts later reimbursed by banks.

Identity theft by state

The FTC ranks states by identity theft reports per 100,000 residents. In 2024 the top five were Florida, Georgia, Nevada, Texas and Delaware. California filed the most reports in absolute terms (139,665) but ranked seventh by rate.

Source: FTC Consumer Sentinel Network Data Book 2024, page 21. Rates use 2023 US Census population estimates, and the ranking excludes reports from state-specific data contributors. States with equal rates are listed in the FTC's order. The District of Columbia (480 reports per 100,000 residents, 3,225 reports) and Puerto Rico (51 per 100,000, 1,649 reports) appear in the FTC table but are not ranked; at 480, DC's rate would sit between Georgia and Nevada.

A high rate does not prove a state has more criminals or weaker security. It reflects where victims live and how readily they report. Florida and Georgia also topped the FTC's 2024 ranking for fraud reports per capita, ahead of Delaware, Nevada and Maryland.

Identity theft among older adults

IC3 data shows older victims are filing more identity theft complaints and losing more. People 60 and older filed 5,359 identity theft complaints in 2025, up from 4,064 in 2024, and reported USD 48.5 million in losses, up from USD 28.5 million. They also filed 11,705 personal data breach complaints with USD 324.5 million in reported losses (FBI IC3 2025 Internet Crime Report, pages 47 and 48). Across all crime types, people 60 and older reported the largest losses of any age group in 2025, about USD 7.7 billion.

How data breaches and stolen credentials fuel identity theft

Identity theft starts with exposure. Personal data and credentials leak through data breaches, phishing, infostealer malware and password reuse, then get used to take over accounts, open new ones or build synthetic identities. This is where a consumer crime becomes an organizational security problem: much of the data that enables identity theft is stolen from companies.

Breaches increasingly expose the data that cannot be changed

The nonprofit Identity Theft Resource Center tracked a record 3,322 US data compromises in 2025, up 5% from 3,152 in 2024, with 278,827,933 victim notices (ITRC 2025 Annual Data Breach Report, released 29 January 2026). The ITRC reports that criminals have prioritized static identifiers over easily replaced data such as card numbers:

• Compromises involving Social Security numbers nearly doubled, from 1,146 in 2021 to 2,236 in 2025.
• Compromises involving driver's licenses rose from 456 to 1,094 over the same period.
• Compromises involving bank account data rose from 410 to 1,099.

A stolen card number can be cancelled in minutes. A Social Security number, date of birth and driver's license number stay useful for years, which is exactly what new-account fraud and synthetic identities need. Financial services was again the most breached industry, with 739 compromises. For breach volumes, causes and costs across all data types, see our data breach statistics.

People notified of a breach are more likely to be identity theft victims

Federal survey data links the two. In BJS's analysis of the 2021 survey, published in January 2024, 12% of people 16 or older had been told that an organization holding their data was breached in the prior year. Identity theft victims were twice as likely as nonvictims to have received such a notice (24% compared with 11%), and victims of multiple types of identity theft were the most likely of all (32%). The survey shows an association, not proof that a specific breach caused a specific theft, but it is the best federal evidence that breach exposure and identity theft travel together.

The ITRC's own survey of 1,040 consumers, run for its 2025 report, points the same way. Eighty percent had received a data breach notice in the past 12 months, and 88% of those reported at least one negative consequence afterward, including more phishing or scam attempts (53.7%), more spam or robocalls (49.2%) and an attempted takeover of an existing account (40.3%).

Stolen credentials turn into account takeover

Credentials are the shortest path from a breach to identity theft. The ITRC introduced a "previously compromised data" category in 2025 to track repackaged old breach data, including two releases involving about 16 billion records with no known victim notices, and warns that this recirculated data is effective for credential stuffing and account takeover. The FBI's 2025 report highlights account takeover fraud carried out by impersonating financial institution support staff, at about 4,700 complaints and USD 359.7 million in losses, and notes that its Recovery Asset Team saw a rise in account takeover cases in 2025, some involving 50 or more simultaneous ACH transfers to different banks.

For the numbers behind leaked logins, see our compromised credential statistics, our credential stuffing statistics and our analysis of infostealer malware and credential theft.

Synthetic identity fraud statistics

Synthetic identity fraud is the hardest identity crime to count, because often there is no single victim to file a report. The Federal Reserve, which convened a focus group of 12 fraud experts to define it, describes synthetic identity fraud as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain." A typical synthetic identity combines a real Social Security number, often one belonging to a child or an older adult who rarely checks credit, with an invented name and date of birth.

The Federal Reserve does not publish its own loss total. The figures below are industry estimates that the Fed cites on its FedPayments Improvement site, and they should be read as estimates:

• USD 20 billion in 2020. When the Fed released its Synthetic Identity Fraud Mitigation Toolkit on 8 February 2022, a Federal Reserve Bank of Boston executive said synthetic identity fraud resulted in an estimated USD 20 billion in losses for US financial institutions in 2020 (Federal Reserve press release).
• USD 35 billion in 2023. A Fed post on generative AI and synthetic identities, published 18 November 2024, says synthetic identity fraud "is estimated to have caused losses of $35 billion in 2023" (FedPayments Improvement).
• 1% to 3% of accounts. A September 2025 Fed post on new account fraud says some payments experts estimate synthetic identities make up 1% to 3% of bank and fintech accounts in the United States, and cites reported new account fraud losses of USD 6.2 billion in 2024 (FedPayments Improvement, 3 September 2025).

The Fed's 2026 material focuses on how AI is changing the problem. A June 2026 post explains that generative AI tools can now create synthetic identities and convincing supporting documents, submit applications for new bank and credit card accounts, attempt to defeat facial recognition and liveness checks during account opening, and run transactions across institutions to build credit history. It also notes that the personal data used to build these identities comes from sources including data breaches, public records and social media. That is the link back to the breach data above: every exposed Social Security number is raw material for a synthetic identity. For loss estimates, lender exposure, FinCEN filings and eCBSV data, see our full synthetic identity fraud statistics.

What the numbers mean for organizations that hold personal data

The statistics point to three places where an organization can break the chain between exposure and identity theft: the data it stores, the logins it protects and the accounts it lets people open. This checklist is DeepStrike's method guidance, not a requirement from any regulator.

1. Inventory static identifiers. List every system, bucket, backup and third party that stores Social Security numbers, driver's license numbers, dates of birth or bank details. Output: a data map with owners and a reason to keep each field, or a plan to delete or tokenize it.
2. Test external exposure of that data. Check internet-facing APIs, cloud storage and databases for unauthenticated access and broken object-level authorization, the flaws that leak records one ID at a time. Output: validated findings, not a scanner list.
3. Test login and recovery flows against credential abuse. Verify rate limiting, credential stuffing defenses, MFA enforcement, and password reset and session handling, because ITRC and IC3 data show account takeover follows breaches. Output: a pass or fail for each control on web and mobile.
4. Test account opening. For products that open accounts or extend credit, test identity verification, document upload handling, duplicate-identity checks and sign-up rate limits, since new-account fraud is the largest FTC identity theft category and synthetic identities target onboarding. Output: bypass paths with severity.
5. Check for your users' leaked credentials. Monitor breach and infostealer data for customer and employee credentials and force resets where needed. Output: reset and session-revocation records.
6. Retest after fixes. Confirm each fix closes the path rather than moving it. Output: a closed finding with evidence.

How we compiled these identity theft statistics

Selection. We used only primary sources: US federal agencies (FTC, FBI IC3, BJS, the Federal Reserve) and one nonprofit that publishes its own breach data (the Identity Theft Resource Center). Every figure was read on the publisher's page or report and checked on 5 November 2026. We excluded figures that appear only in vendor blogs or aggregator pages, and we did not use 2025 FTC identity theft counts that circulate online but do not appear in a published FTC Data Book or release.

Report years. IC3 and ITRC report titles name the data year (2025). The FTC Data Book 2024 covers calendar year 2024 and was published in March 2025. The BJS figures describe 2021 and were published in October 2023 and January 2024.

Calculations. Three figures are our own arithmetic from published numbers: about 3,100 FTC identity theft reports a day (1,135,291 divided by 366), the 48% rise in IC3 identity theft complaints (31,675 against 21,403) and the 7% rise in IC3 identity theft losses. All other numbers are quoted as published.

Limits. Report and complaint counts measure who chose to report, not how many people were victimized. The BJS survey is the only population estimate and is several years old. ITRC counts breaches and notices, not identity theft victims. Synthetic identity loss figures are industry estimates. No single figure on this page is a complete count of US identity theft.

Frequently asked questions

How common is identity theft?

About 9% of US residents age 16 or older, roughly 23.9 million people, experienced identity theft in a 12-month period, according to the Bureau of Justice Statistics' latest survey (2021 data, published October 2023). About 22% had experienced it at some point in their lives. The FTC received 1,135,291 identity theft reports in 2024, about 3,100 a day.

What is the most common type of identity theft?

Credit card fraud. The FTC received 449,032 credit card identity theft reports in 2024, and 406,110 of them involved a new account opened in the victim's name rather than misuse of an existing card. Loan or lease fraud and bank account fraud follow.

Which state has the most identity theft?

By rate, Florida, with 528 identity theft reports per 100,000 residents in the FTC's 2024 Data Book, followed by Georgia (517), Nevada (466), Texas (393) and Delaware (392). By total reports, California had the most, with 139,665.

Is identity theft increasing?

The newest federal data says yes. Identity theft complaints to the FBI rose 48% in 2025, to 31,675, and reported losses rose to USD 185.8 million. FTC identity theft reports rose about 9% in 2024 to 1,135,291, although they remain below the 2021 peak of 1,434,477.

How much money is lost to identity theft?

It depends on the source. The BJS survey estimated USD 16.4 billion in losses in 2021 across all victims. Complaints to the FBI listed USD 185.8 million in identity theft losses in 2025, plus USD 1.31 billion in personal data breach complaints. The USD 15.9 billion the FTC reported for 2025 covers fraud, not identity theft.

What are the latest synthetic identity fraud statistics?

The Federal Reserve cites industry estimates of USD 20 billion in synthetic identity fraud losses for US financial institutions in 2020 and USD 35 billion in 2023. Some payments experts quoted by the Fed estimate synthetic identities make up 1% to 3% of US bank and fintech accounts. The Fed's 2026 guidance warns that generative AI now automates identity creation, applications and liveness checks.

Do data breaches cause identity theft?

They supply much of the data it needs. BJS found identity theft victims were twice as likely as nonvictims to have received a data breach notice (24% compared with 11%), and the ITRC found 40.3% of people who got a breach notice saw an attempted takeover of an existing account. Compromises involving Social Security numbers nearly doubled between 2021 and 2025.

What can companies do to reduce identity theft from their systems?

Minimize and map the static identifiers they store, test the APIs and storage that hold them, harden login and recovery flows against credential stuffing and account takeover, and test account-opening flows for identity verification bypasses. Then retest after fixes.

Next steps

The numbers show a steady supply chain: breaches expose identifiers that cannot be changed, stolen credentials enable account takeover, and synthetic identities exploit account opening. Organizations cannot stop consumers from being targeted, but they can reduce how much usable data leaks from their systems and how easily stolen data works against their logins and sign-up flows.

If you want to know whether your APIs, login and recovery flows or account-opening process would hold up against these attacks, DeepStrike's penetration testing services provide manual testing with fix recommendations for every finding.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• Bureau of Justice Statistics, Victims of Identity Theft, 2021 (October 2023): https://bjs.ojp.gov/library/publications/victims-identity-theft-2021
• Bureau of Justice Statistics, Victims of Identity Theft, 2021, full report PDF: https://bjs.ojp.gov/document/vit21.pdf
• Bureau of Justice Statistics, Data Breach Notifications and Identity Theft, 2021 (January 2024): https://bjs.ojp.gov/data-breach-notifications-and-identity-theft-2021
• Federal Trade Commission, Consumer Sentinel Network Data Book 2024 (March 2025): https://www.ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf
• Federal Trade Commission, Consumer Sentinel Network Reports: https://www.ftc.gov/enforcement/consumer-sentinel-network/reports
• Federal Trade Commission, "FTC Testifies before the Joint Economic Committee on Agency's Efforts to Combat Fraud" (25 March 2026): https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud
• Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• Federal Reserve, FedPayments Improvement, Synthetic Identity Fraud: https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/
• Federal Reserve, "Federal Reserve Releases Synthetic Identity Fraud Mitigation Toolkit to Educate, Fight Fraud" (8 February 2022): https://fedpaymentsimprovement.org/news/press-releases/federal-reserve-releases-synthetic-identity-fraud-mitigation-toolkit-to-educate-fight-fraud/
• Federal Reserve, FedPayments Improvement, "When Synthetic Identities and Artificial Intelligence Collide" (18 November 2024): https://fedpaymentsimprovement.org/news/blog/artificial-intelligence-insights-added-to-synthetic-identity-fraud-mitigation-toolkit/
• Federal Reserve, FedPayments Improvement, "What's New With New Account Fraud?" (3 September 2025): https://fedpaymentsimprovement.org/news/blog/whats-new-with-new-account-fraud/
• Federal Reserve, FedPayments Improvement, "What Is Real? How AI Is Transforming Synthetic Identity Fraud" (17 June 2026): https://fedpaymentsimprovement.org/news/blog/what-is-real-how-ai-is-transforming-synthetic-identity-fraud/
• Identity Theft Resource Center (nonprofit), 2025 Annual Data Breach Report (29 January 2026): https://www.idtheftcenter.org/wp-content/uploads/2026/01/2025-ITRC-Annual-Data-Breach-Report.pdf
• Identity Theft Resource Center, 2025 Annual Data Breach Report press release (29 January 2026): https://www.idtheftcenter.org/post/2025-annual-data-breach-report-record-number-compromises/