Identity cloning: Definition, dangers, and how to avoid it

What is identity cloning?

Identity cloning is a sophisticated subtype of identity theft in which someone fraudulently obtains another person’s personal information and then impersonates the victim in all aspects of life. In other words, the perpetrator tries to create a convincing replica of the victim’s identity – using their name, Social Security number, date of birth, and other details – as a false persona for themselves. The clone might take over the victim’s daily identity: using the victim’s information to get a job, rent or buy housing, receive medical care, or even commit crimes, all under the victim’s name. This goes beyond typical financial identity theft – it’s about living as the victim.

Identity cloning vs. identity theft

While identity cloning is a type of identity theft, it has unique characteristics that set it apart from more common identity theft fraud schemes. Some key differences include:

• Breadth of impersonation: General identity theft often involves stealing personal data to commit specific fraud (like running up charges on someone’s credit card or opening a loan in their name). In identity cloning, the thief takes over every aspect of the victim’s identity – not just financial accounts, but potentially their work identity, medical identity, and legal identity.
• Motive: Typical identity thieves are in it for financial gain – they use your personal information to get money, goods, or benefits. On the other hand, identity cloners are often motivated by concealment or long-term use of a clean identity.
• Detection and timing: Victims of financial identity theft might notice red flags relatively quickly – such as unauthorized bank charges or credit alerts. In contrast, victims of identity cloning often remain unaware for a long time because the imposter strives to pose as them seamlessly. It may only come to light through unusual events – for instance, discovering income on your tax return that you never earned or getting a notice that “you” failed to pay taxes in a state you never lived in.

In short, all identity cloning is identity theft, but not all identity theft reaches the level of cloning.

How does identity cloning work?

Identity cloning works much like identity theft. It usually starts with a thief collecting bits of your personal data – your full name, Social Security number, birth date, maybe a copy of a driver’s license photo – pulled from data breach dumps, phishing emails, stolen mail, or discarded paperwork. 

Next, the imposter knits those pieces into a credible profile, often creating a synthetic identity by attaching a real SSN (sometimes belonging to a child or a deceased person) to an invented name or address so routine database checks raise no red flags.

Armed with that profile, the perpetrator applies for legitimate documents – state IDs, a driver’s license, even a passport. Once all the documents are sorted out, many cloners move to a new city, reroute mail, and build everyday records — pay stubs, tax returns, utility bills — so every background check reinforces the stolen persona. 

The scheme can persist for decades: According to an Associate Press report, Matthew David Keirans lived as “William Woods” for nearly thirty years, holding a hospital IT job and securing loans totaling more than $200,000 before DNA evidence exposed the cloned identity in 2024. 

Signs of identity cloning

Detecting identity theft or cloning early is challenging because the whole point is to operate in your name without tipping you off. However, there are red flags and warning signs of stolen identity:

• Unfamiliar financial activity: Identity theft victims often first spot trouble when a thief drains a bank account or uses a stolen credit card number for online purchases. So keep an eye out for fraud alerts or bank notifications about transactions you never made. Frequent unexplained alerts from your bank or credit card company – or seeing purchases on your statements that you don’t recognize – could indicate someone is spending money as “you.”
• Suspicious new accounts or credit changes: Check all three major credit bureaus for fraudulent accounts – spotting them early is the fastest way to prevent identity theft from snowballing. Signs of cloning can include finding accounts you never opened, loans you never applied for, or sudden drops in your credit score for no apparent reason. 
• Bills or debt collections for unknown services: Remember, the Identity Theft Resource Center warns that debt collectors increasingly pursue people whose identity was stolen in a data breach. Receiving bills or collection notices for things you didn’t buy or services you never used is a major red flag. For example, calls from debt collectors for debts you know nothing about or medical bills for treatments you never had may mean someone is using your identity to obtain goods or services. Likewise, not receiving expected bills or mail could indicate that an identity thief changed the mailing address on your accounts.
• Tax or government benefit irregularities: The Internal Revenue Service sees thousands of tax related identity theft cases every year, many tied to a single identity thief who filed under someone else’s Social Security number. One common sign is discovering tax issues, such as a notice from the IRS that you failed to report income from an employer you’ve never worked for or that your Social Security number was used to file multiple tax returns. If you find that you cannot file your taxes because someone already filed under your SSN, that’s a strong indicator of identity theft or cloning.
• Official actions or legal trouble: In severe cases, you might encounter legal repercussions for another’s actions. For instance, being surprised by a warrant for your arrest or tickets in your name for offenses you didn’t commit can signal that someone has assumed your identity to break the law. Many victims of criminal identity cloning only find out when they’re pulled over for a minor traffic issue and suddenly face an unexpected warrant.

Dangers of identity cloning

Having any form of your identity stolen is no picnic, but identity cloning is especially dangerous because of the scope of the harm it can cause. The personal toll of identity cloning can be devastating. Financially, a clone can ruin your credit and rack up huge debts in your name. They might empty your bank accounts, charge up credit cards, or take out loans and never repay them, leaving you with collections and a wrecked credit score. 

Victims may spend countless hours cleaning up fraudulent debts and correcting their credit reports. But the damage isn’t just financial. Because an identity clone assumes every aspect of your identity, they can entangle you in legal and reputational troubles. You could be wrongly blamed for the imposter’s actions. A stark example is William Woods’s case, which we highlighted earlier: the real Woods was arrested and even confined to a mental institution when authorities mistook him for the identity thief who had stolen his name. Victims of identity theft or cloning may have to prove who they truly are to police or courts if the impersonator committed crimes or civil offenses. Clearing one’s name can be a long, stressful process. 

Meanwhile, the emotional distress is significant: imagine the shock of finding out someone else has married, worked, or even been medically treated as you. Victims often feel violated and unsafe, knowing someone out there has their entire identity. The recovery process – contacting agencies, filing reports, monitoring accounts – can dominate a victim’s life for months or years.

And the ripple effects of identity theft or cloning don’t stop with individuals. In the U.S., many businesses, including lenders and retailers, have lost substantial sums to scammers using stolen or cloned identities to obtain credit and goods. 

Employers can also be victims: a person hired under a false identity might commit theft, embezzlement, or fraud, leaving the business to deal with the financial and legal fallout. Some cases even involve imposters posing as licensed professionals – like doctors or pilots – exposing clients and companies to serious risk. 

Businesses that unknowingly employ someone using stolen Social Security numbers or professional credentials can face compliance violations, insurance issues, or lawsuits. 

Moreover, identity clones can bypass background checks, potentially hiding criminal histories. If high-level employees are impersonated, it can result in business email compromise or payroll fraud. When identity theft or cloning leads to data breaches, customers unsurprisingly lose trust, damaging a company’s reputation.

According to the Bureau of Justice Statistics, victims of identity theft lost more than $16.6 billion in direct financial losses in 2024.

How can you protect yourself against identity cloning?

While no one can eliminate the risk, there are many practical steps you can take to significantly reduce the chances of falling victim to identity cloning (and identity theft in general). Good security habits and proactive monitoring go a long way. Here are some effective measures to protect your identity:

• Secure your personal data: Limit how and where you share personally identifiable information. Provide your Social Security number or driver’s license only when necessary. Be cautious about what personal details you post on social media (such as your, full birthdate, address, or mother’s maiden name) that could help someone impersonate you. Also, secure physical documents – keep your passport, SSN card, birth certificate, and other sensitive documents in a safe place, and remember to shred or otherwise destroy any documents that contain personally identifiable information such as your full name, address, or financial information.
• Use strong passwords and MFA on accounts: Secure your online accounts to prevent hackers from stealing data that could facilitate identity cloning or theft. Use long, unique passwords for each account and enable multi-factor authentication on email, banking, and other sensitive logins. Strong passwords and MFA make it much harder for criminals to break into your accounts, preventing them from gathering sensitive data or hijacking your identity through your email or online profiles. Consider using a reputable password manager such as NordPass to generate and store complex passwords.
• Keep your devices and networks secure: Identity cloners can also gather personal info through malware or network snooping. Protect your devices with up-to-date security software and install updates promptly for your operating system and apps because those updates often patch security vulnerabilities. Avoid using public Wi-Fi for sensitive tasks (or use a VPN on public networks) to prevent eavesdropping. These cybersecurity basics help ensure thieves can’t easily steal your data.
• Monitor your financial accounts and credit: Early detection of suspicious activity is key. Reviewing monthly account statements and bank statements can reveal unauthorized transactions on an existing account long before they hit your credit reports. Also, check your credit reports regularly – you can get a free report from each bureau annually. Look for accounts or inquiries you don’t recognize, which could be a sign someone opened credit in your name. Many banks and credit cards offer free alerts or apps that notify you of large transactions or new account activity – enable these alerts. 
• Consider a credit freeze: A highly effective preventive step is to place a credit freeze with the three major credit bureaus (Experian, Equifax, TransUnion) when you’re not actively seeking new credit. A credit freeze blocks anyone from pulling your credit report to open new accounts unless you temporarily lift the freeze. This means that even if an identity thief has your SSN and personal info, they’ll be unable to open a new loan or credit card in your name while the freeze is in place.
• Be vigilant against phishing and scams: Many identities are cloned starting with a phishing email, scam call, or text that tricks the victim into giving up personal data. Be skeptical of unsolicited communications asking for sensitive info or login credentials. Never click suspicious links or give out personal data via email/phone unless you have verified the requester’s legitimacy.
• Consider identity theft protection services: Services like NordProtect offer identity and credit monitoring that can help by alerting you to signs of identity theft that you might otherwise miss. They can monitor things like if your SSN or personal info pops up on the dark web, if new accounts are opened in your name, or if there are changes to your credit file. On top of that NordProtect also includes recovery help if you become a victim.

What should you do if your identity was cloned?

If you discover that your identity has been cloned or stolen, it’s important to act fast. Identity theft recovery can be complex, but taking it step by step will help you regain control and limit the damage. Here are the key steps to take if you suspect or confirm that you’re a victim of identity cloning:

• Document and gather evidence: Begin by collecting all information related to the fraud. Make a list of all affected accounts and charges – for example, fraudulent credit card transactions, new loans or accounts in your name, bills for services you didn’t use. Save bank statements, credit reports, collection notices, or any other proof of identity cloning or theft.
• File a report with the FTC: The Federal Trade Commission operates identitytheft.gov – a one-stop website for reporting identity theft. Report identity theft and be as detailed as possible about what happened. The FTC report is important because it creates an official record of the crime and provides you with documentation you’ll need to show creditors and law enforcement. After filing, download or print a copy of the FTC report for your records.
• Notify credit bureaus and place a fraud alert (or freeze): Contact the three major credit bureaus (Equifax, Experian, TransUnion) to place a fraud alert on your credit file. Better yet, as mentioned above, initiate a credit freeze with each bureau to block any new credit entirely. Also, request copies of your credit reports – review them carefully for any fraudulent accounts or inquiries.
• File a police report: Contact your local police to file an official police report about identity cloning. Provide them with a copy of the FTC Identity Theft Report and any evidence you gathered. Filing a police report creates another official record, which can help with disputing charges and proving your innocence in any criminal matters.
• Notify other government agencies if necessary: Depending on what the identity clone did with your information, you may need to alert additional agencies:
  • If your Social Security number was misused (such as for employment, tax fraud, or benefits.), contact the IRS and Social Security Administration.
  • If your driver’s license or another government ID was stolen or used by the imposter, notify your state DMV. They may issue a new license/ID number and watch for duplicate licenses.
  • If the thief committed crimes as “you,” inform law enforcement in that jurisdiction and consider consulting legal counsel.
• Follow up and monitor your identity going forward: Recovery from identity cloning is an ongoing process. Even after you’ve reported and disputed everything, stay vigilant. Continuously monitor your credit reports and financial statements in the coming months for signs of new fraud. Verify that fraudulent accounts are indeed closed and debts discharged. If you had any personal logins compromised, change all your passwords and ensure your devices are secure. It’s also wise to take advantage of any identity theft protection offered. In some cases, the thief might attempt to use your info again, so early detection of any new activity is crucial.