Criminal identity theft: What it is, how it occurs, and how to prevent it

What is criminal identity theft? 

Criminal identity theft is a type of fraud that involves using someone’s personal information (like their name, Social Security number, or date of birth) to commit a crime or evade law enforcement. Such identity theft can result in a criminal record being tied to your name. It can also lead to arrest warrants or denied employment opportunities. Victims often face lengthy legal processes to clear their name, along with emotional stress and damage to their reputation.

How does criminal identity theft occur? 

Criminal identity theft happens when someone uses stolen personal information to commit crimes in your name. Criminals use various tactics to obtain this information and exploit it for impersonation. Once scammers access your details, they may impersonate you during an arrest or create fake identification documents in your name.

Let’s look at the most common tactics identity thieves use to access personal information.

Data breaches

When companies, hospitals (cases of medical identity theft have been reported), or government agencies suffer data breaches, the personal information of thousands — sometimes even millions — of people may be exposed. Criminals often buy or trade this data on the dark web and use it to impersonate victims.

Malware infections

Malware is malicious software designed to damage your device or gain unauthorized access to your system. If your computer or phone is infected, a hacker can access sensitive details like login credentials, scanned documents, or even messages that reveal your date of birth or address. Scammers can then use this information to impersonate you or forge fake IDs.

Malware often spreads through phishing emails, bogus ads, and fake security warnings. These tactics are meant to confuse and push you to take action, like clicking links or downloading files, which can lead to malware infections.

Credit card skimming

While often associated with financial fraud, credit card skimming can lead to broader identity theft. Skimmers are small, hidden devices placed on ATMs or gas pumps that capture your card information. When combined with other personal data, your card details could be part of a larger profile used to commit criminal identity theft. 

Synthetic identity theft

Synthetic identity theft blends real information (like a legitimate SSN) with fake details (such as a fake name or birthdate) to create an entirely new identity. These synthetic identities are often used to commit fraud, obtain loans, or even commit crimes under a made-up name. 

Wi-Fi snooping

Public Wi-Fi networks (like those in coffee shops or airports) can be unsafe. Cybercriminals can intercept data you send over unsecured connections, such as login credentials or scanned IDs. If you’ve accessed sensitive services (like email or banking apps) on a public network, your identity could be stolen without your knowledge.

Social engineering

Social engineering involves attackers psychologically manipulating people into revealing confidential information. Let’s take a look at some examples of social engineering tactics.

• Phishing — fake emails or websites tricking you into entering sensitive data.
• Vishing — voice phishing, where a caller impersonates a trusted entity, like someone from your bank or government.
• Impersonation scams — someone pretends to be a relative, coworker, or official to get personal information.

Once criminals gather enough of your data, they can use it during an arrest or investigation to pass themselves off as you.

Legal consequences of criminal identity theft

Criminal identity theft is a felony offense under federal and most state laws. Convictions can lead to long prison sentences, especially if the crime involves fraud, tax evasion, or large financial losses. Fines can reach tens of thousands of dollars.

Because these crimes frequently cross state lines, they may trigger federal charges under laws like the Identity Theft and Assumption Deterrence Act. That means victims and defendants alike can be pulled into multi-jurisdictional legal proceedings. To secure a conviction, prosecutors must prove that the accused knowingly used stolen information with the intent to defraud. 

Aside from criminal penalties, perpetrators may face civil lawsuits. Victims can sue for damages, including lost wages, legal expenses, and emotional distress, even if the perpetrator avoids jail time.

Signs that you may be a victim of criminal identity theft

​​Because criminal identity theft often goes unnoticed until it causes serious harm, it’s important to stay alert for these signs that indicate you may be a victim of criminal identity theft:

• Unexpected court summons or arrest warrants under your name
• Being denied a job due to a failed background check with unfamiliar charges
• Notifications of a criminal record in a jurisdiction you’ve never visited
• Receiving mail or documents related to crimes, fines, or charges you didn’t commit (as a result of tax identity theft or employment identity theft).
• Law enforcement stopping you based on someone else’s offense history
• Unfamiliar entries in your public record or online background checks

If any of these red flags show up, take action immediately. Contact a legal professional or legal aid service to discuss your concerns and what you can do about them.

What to do if you’re a victim of criminal identity theft

If you discover that someone has used your identity to commit a crime, act quickly and follow these critical steps:

1. Create an identity theft report. Visit IdentityTheft.gov and provide detailed information about the misuse. This step instantly generates an identity theft report and a personalized identity theft recovery plan.
2. File a police report. Bring your identity theft report, a government-issued photo ID, proof of address, and any relevant documents (like arrest warrants or court notices) to your local police department. Request a certified copy of the police report.
3. Place a fraud alert and request free credit reports. Contact one of the credit bureaus (Equifax, Experian, or TransUnion) and ask for a 90-day fraud alert to warn potential creditors. You’re entitled to a free annual credit report from all three major bureaus.
4. Consider an extended fraud alert or credit freeze. With your identity theft report, request a seven-year extended fraud alert. Optionally, you can place a credit freeze to block all access to your credit report until you lift it.
5. Review and dispute fraudulent information. Obtain your credit reports from all three bureaus. Identify and challenge any unfamiliar accounts, debts, or inquiries, then send a dispute explaining which entries are fraudulent, along with copies of your police report and identity theft report.
6. Notify creditors and businesses. Contact financial institutions where fraudulent activity occurred. Ask them to close any illegitimate accounts, remove charges, and confirm in writing that you’re not liable. Provide them with copies of your identity theft report.
7. Alert the IRS and Social Security Administration (SSA). If you suspect your SSN was used for a crime, work, or tax return, file an identity theft affidavit (IRS Form 14039) and notify the SSA. Provide copies of your police and identity theft reports.
8. Keep detailed documentation. Save all forms, letters, and contact records, including dates and who you spoke to. Keep certified mail receipts and copies of all submitted documents.
9. Consider identity theft protection services. After you’ve taken the essential steps to report the fraud and secure your information, consider exploring services to help monitor your accounts and support recovery. Using an identity protection service can give you peace of mind by alerting you to suspicious activity early on.

If you’d like to learn more, you can take a look at our guide on what to do if your identity is stolen.

How can victims of criminal identity theft clear their records?

Clearing your name is possible, but it requires time, documentation, and legal persistence. Follow these steps to clear your records after criminal identity theft:

• Work with a criminal defense attorney to challenge false charges and arrest records.
• Petition the court for a record correction or expungement once identity theft is proven.
• Submit fingerprint evidence, police reports, and identity verification documents to support your case.
• File an identity theft affidavit through your local law enforcement agency, if available.

The process of clearing your record can be complicated, but it’s not impossible. Using the right channels and acting immediately can help manage the damages caused by identity theft.

A service like NordProtect helps provide support during recovery through an identity theft recovery service, which includes access to a dedicated identity restoration case manager. NordProtect users may receive up to $1 million to cover qualifying identity theft recovery costs, including legal fees and document replacement, subject to a $100 deductible.

How can you prevent criminal identity theft? 

Preventing criminal identity theft begins with smart, consistent habits and the right protective tools. Start by using strong, unique passwords across your accounts and enabling two-factor authentication wherever possible. Avoid using public Wi-Fi for sensitive activities. If you need to connect while on the go, protect yourself with a trusted VPN. 

At home, be sure to shred any documents that contain personal information before discarding them. You should also limit how much personal data you share online, especially details like your full birthdate or home address, which can be used to impersonate you. 

To stay ahead of threats, monitor your credit regularly for any unfamiliar activity, and check your criminal record annually to catch any false entries early. You may also want to consider identity theft insurance to give you peace of mind.

For added protection, consider using NordProtect, an all-around identity theft protection service that offers 24/7 dark web monitoring, credit monitoring services with immediate notifications, and actionable security alerts. These features allow you to respond before a criminal has the chance to use your identity.