Identity fraud vs. identity theft: What is the difference?

What is identity fraud? 

Identity fraud generally refers to the fraudulent use of someone’s personally identifying information — essentially, using another person's identity or existing accounts to commit theft or deception. In simple terms, identity fraud is what happens when a criminal already has access to your personal data (or account) and then uses that access for immediate (often financial) gain.

Examples of identity fraud

To illustrate, here are a few examples of identity fraud in action:

• Stolen card information for purchases. A criminal obtains your debit or credit card details (for instance, from a data breach) and uses them to make unauthorized purchases against your existing account. In this case, they aren’t opening a new account — they’re abusing the account they already have at their disposal.
• Account takeover via phishing. You unknowingly click a malicious link in an email message and enter your login credentials on a phony banking website. A fraudster then uses that data to log in to one of your banking accounts and withdraws money or makes transfers in your name. Here, your existing account access is what’s exploited, not identity per se. 
• Unauthorized SIM swap. A fraudster convinces your mobile carrier to switch your phone number to a new SIM card they control. This lets them intercept your security texts and calls, giving them access to your banking or email accounts (which often rely on your phone for verification). They can then perform fraudulent electronic fund transfers or change account settings, all while pretending to be you.

Each of these scenarios is identity fraud because the perpetrator is using stolen information to fraudulently access resources that already belong to the victim. There’s no need to create a new identity or account — the fraudster rides on the victim’s existing credit, funds, or services.

What is identity theft? 

Identity theft typically describes the initial act of stealing someone’s personally identifying information without their permission. It means someone gathers enough details about you — such as your full name, Social Security number, birth date, address, or financial account numbers — and then assumes your identity to commit fraud. In many cases, identity theft is a precursor to identity fraud: The thief steals your info (identity theft) and then uses it to impersonate you and steal money (identity fraud). However, the term "identity theft" usually emphasizes that the criminal is opening new accounts or initiating new services in your name rather than just hijacking existing accounts. Put simply, if someone uses your personal data to pretend to be you, especially to obtain credit, loans, benefits, or other services, that is identity theft. 

Examples of identity fraud

Identity theft comes in many different shapes and forms. Here are a few examples that show how cyber crooks steal identities to create new accounts or entitlements:

• Opening new credit lines or loans. A fraudster uses your Social Security number and personal details to apply for a new credit card or loan under your name. They run up charges or take the loan money and leave you to discover the unauthorized account later (often when your credit score drops or a bank contacts you about non-payment).
• Creating fake IDs or official documents. Using stolen personal data, a criminal obtains fraudulent identification — for example, they may use your name and SSN to get a driver's license with their own photo on it. This fake ID can then be used for various schemes, such as passing background checks or posing as you if they get in trouble with the law.
• Tax and benefits fraud. Identity thieves often target government filings. One common scheme is filing a tax return in your name to claim a refund before you do. Similarly, bad actors have used stolen identities to collect unemployment or other government benefits fraudulently. If you receive an IRS notice that someone already filed under your Social Security number, or you’re denied benefits because records show you “already” claimed them, it’s a sign your identity may have been stolen for this purpose.

In each of these cases, the perpetrators are using your personal information to create new obligations or claims in your name — whether it's a new debt, a fake ID, or a government payout. This is the hallmark of identity theft: your identity itself (your personal data and reputation) is being stolen and misused.

What is the difference between identity fraud and identity theft? 

By now, you may notice a lot of overlap between these two concepts. In truth, the line between "fraud" and "theft" is subtle. Both involve someone stealing personal information and misusing it for financial gain. In fact, authorities like the U.S. Department of Justice use identity theft and identity fraud as broad umbrella terms for any personal data misuse crime. For practical purposes, many people (and even laws) treat them interchangeably. However, identity fraud tends to involve misusing an existing account or credential, whereas identity theft tends to involve opening new accounts or lines of credit using stolen data. The consequences of identity theft and fraud for victims often overlap. Victims may lose money directly (funds stolen from accounts, or bills run up on new credit). They almost always suffer a hit to their credit score, since unpaid fraudulent debts or multiple credit inquiries appear on their credit reports. It can take dozens of hours and lots of stress to resolve the issue — contacting banks, credit bureaus, and even filing police reports to clear your name. 

Here is a quick overview of the main differences between identity theft and identity fraud.

Signs of identity theft and identity fraud 

Most of the warning signs for identity theft and identity fraud overlap, since any misuse of your identity will eventually leave traces. Here are some common signs of identity theft or fraud to watch for and what they might mean:

• Unexplained charges or withdrawals. You notice charges on your credit card or withdrawals from your bank account that you didn’t make. This is often the first sign of identity-related fraud. Any suspicious transactions on your statements should be investigated immediately
• Missing bills or mail: You stop receiving monthly statements or other mail you were expecting. If your credit card bills, bank statements, or even documents like utility bills don’t show up, it could mean a fraudster has changed your billing address to keep you in the dark
• New accounts or credit inquiries you don’t recognize. When you check your credit report, you find loans, credit cards, or hard inquiries for applications you never made. Unfamiliar accounts on your credit report are a strong indicator of identity theft — someone is opening new credit in your name. Likewise, if you get an unexpected “Welcome” letter or credit card for an account you never opened, take it seriously, even if the card never arrived in your mailbox.
• Debt collectors calling about debts you know nothing about. If collection agencies contact you about overdue accounts that you never opened, it’s a clear sign your identity has been used to obtain credit or services.
• Medical bills or insurance statements for unknown services. You receive a bill or an insurance benefits statement for medical treatment that you never received. This could indicate medical identity theft, where someone has used your identity to get medical care or prescriptions. It’s not only costly — it can also lead to errors in your health records if the impostor’s information gets mixed up with yours.
• Alerts for logins or password resets you didn’t initiate. You get a text with a two-factor authentication code, or an email about a login to your account, that you know you didn’t trigger. That might be a sign of active identity fraud (an account takeover attempt in progress).

If you notice any of these red flags, don’t ignore them. In fact, even if you just have a hunch something’s off, you can check if someone is using your identity by reviewing your credit reports, public records, and online accounts for unusual activity. Many of the warning signs above apply to both identity theft and fraud — they’re basically signs that your personal data is in the wrong hands. 

Legal consequences of identity fraud vs. identity theft 

From a legal standpoint, both identity theft and identity fraud are serious crimes in the U.S., and offenders can face severe penalties. There isn’t a neat separation of “identity theft” versus “identity fraud” in criminal charges — typically, a perpetrator will be charged under whichever specific laws apply to what they did. It practice, this means:

• Identity theft laws. Federal law (specifically, the Identity Theft and Assumption Deterrence Act of 1998) made it a distinct crime to knowingly use someone else’s identification without authorization to commit an unlawful act. Under 18 U.S.C. §1028(a)(7), committing identity theft — for example, using another person’s Social Security number or other personal data to commit fraud — can carry up to 15 years in prison, plus hefty fines and the forfeiture of any property obtained from the offense. Many states have their own identity theft statutes as well, typically treating these offenses as felonies (especially when large sums are involved).
• Identity fraud and related fraud crimes. There isn’t usually a separate statute titled “identity fraud” — instead, if someone uses a stolen identity to, say, defraud a bank, they will be prosecuted under the relevant fraud laws. Common charges include credit card fraud (18 U.S.C. §1029), bank fraud (18 U.S.C. §1344), mail fraud (18 U.S.C. §1341), wire fraud (18 U.S.C. §1343), or even computer fraud (18 U.S.C. §1030) for hacking-related identity theft. These are serious felonies. Bank fraud alone carries up to 30 years in federal prison. So if an identity thief uses your info to open credit cards and runs up charges, they might be charged with access device fraud and bank fraud. In short, criminals who engage in identity fraud schemes can face decades behind bars if convicted, depending on the scale of the fraud.

How to prevent identity theft or identity fraud 

Dealing with identity theft or identity fraud after the fact is time consuming and frustrating, so it’s best to prevent it from happening in the first place. The good news is that the preventive steps for both identity theft and identity fraud are essentially the same, since they both involve protecting your personal information and monitoring for misuse. Here are some of the most effective ways to safeguard your identity:

• Enable two-factor or multi-factor authentication (2FA/MFA). Add an extra layer of security to your online accounts beyond just a password. With two-factor authentication or multi-factor authentication enabled, even if a hacker steals your password, they would also need a second factor (like a code on your phone or a fingerprint) to gain access. This can impede many potential account takeovers. Make sure your email, banking, and social media accounts have 2FA turned on via an authenticator app or at least SMS codes. 
• Be cautious of phishing scams: Most cybercriminals don’t hack in the Hollywood sense — they trick you into giving them information. Phishing emails that look legitimate (often posing as your bank or some other well-known service) might ask you to "verify your account" and click a link. If you do, malware could be installed or you might provide cybercrooks with your login credentials. Always be skeptical of unsolicited communications asking for personal data. Don’t click links or download attachments from unknown sources. Similarly, watch out for phone and text scams — fraudsters often impersonate IRS agents, police, or company reps to con people into revealing Social Security numbers, account logins, or one-time passcodes.
• Secure your mail and personal documents. Sensitive documents in your mailbox or trash are literal gold for identity thieves. To prevent shoulder surfing and dumpster diving, use a locked mailbox if possible and remove mail on arrival. Destroy any papers that contain personal details (bank statements, credit card offers, medical bills, etc.). Also, store all important documents in a safe place at home.
• Monitor your credit reports and financial accounts regularly. Keeping a close eye on your financial footprint can help you catch fraud early. Review your bank statements and credit card bills every month for any charges you don’t recognize (even small ones). Also, take advantage of your free annual credit reports from Equifax, Experian, and TransUnion to spot any new accounts or inquiries you didn’t initiate.
• Use identity protection with built-in identity theft insurance. Dedicated identity theft protection services can continuously monitor your personal information and credit files, alerting you quickly if your data appears on the dark web, new accounts are opened in your name, or suspicious credit activity occurs. While they can’t stop every attempt at identity theft, they act as an early-warning system and often include expert help plus insurance-backed benefits to cover eligible recovery costs like legal fees, document replacement, or lost wages. A comprehensive option like NordProtect combines 24/7 dark web and credit monitoring, real-time alerts, and identity restoration support with generous coverage for many identity theft, online fraud, and cyber extortion incidents, giving you both proactive monitoring and a financial safety net if something does go wrong.
• Keep your devices and accounts secure. This is a catch-all tip that includes using strong, unique passwords and keeping your software updated. Use a password manager to generate and store complex passwords so you’re not reusing the same one everywhere. Enable security features like a device passcode or remote wipe on your smartphone in case it’s lost or stolen (so thieves can’t easily access your apps and data). Regularly update your computer and phone’s operating system and antivirus software — updates often patch security vulnerabilities that hackers exploit. Also, avoid using public Wi-Fi for sensitive activities. If you must, use a VPN to encrypt your connection. These tech habits reduce the risk that an identity thief can sneak into your accounts or steal data.

What to do in case of identity theft or identity fraud

Even with precautions, it’s possible to fall victim to identity theft or identity fraud — tens of millions of Americans do every year. If you suspect that your identity has been stolen or misused, act fast. The quicker you respond, the more you can limit the fallout. Here are the immediate steps to take when you discover signs of identity theft or fraud:

1. Contact the companies or financial institutions involved. If you see an unauthorized charge on a credit card, call your credit card issuer’s fraud department right away. If your bank account is compromised, notify your bank. Most banks have zero-liability policies for fraud, but you must report it promptly. Also, if a new account was opened in your name at, say, a retail store or lender, contact that company to alert them of the identity theft.
2. Place a fraud alert on your credit reports and check your credit. Contact one of the three major credit bureaus (Equifax, Experian, or TransUnion) and request an initial fraud alert on your credit file. This alert is free and lasts one year (you can renew it), and it instructs creditors to verify your identity carefully before opening new accounts. The bureau you contact will notify the other two bureaus, so one call does it. Once the alert is in place, get copies of your credit reports and review them for any other suspicious accounts or inquiries.
3. Report the identity theft to the FTC. Go to IdentityTheft.gov and report identity theft. You’ll answer some questions and end up with an official Identity Theft Affidavit and a personalized recovery plan. The affidavit is important — it’s an official document you can use to prove to businesses that the accounts or charges in question are fraudulent. Make sure to save or print your FTC report.
4. File a police report with your local law enforcement office. Next, consider filing a report with your local police department (especially if you know details of the fraud, or a creditor requires a police report). Go to the station and explain that your identity was stolen. Bring your FTC affidavit, a government ID, and any proof of the fraud. Get a copy of the police report. This, combined with the FTC affidavit, forms your Identity Theft Report under federal law.
5. Change passwords and secure your accounts. Immediately update your passwords on all affected accounts — and any other accounts that used the same password. This will cut off the fraudster’s access. Enable 2FA on the accounts if you haven’t already done so. Also check the account recovery information (like backup email address or phone number) to ensure the thief didn’t add their own.
6. Consider a credit freeze for extra protection. As mentioned, a credit freeze (security freeze) with each bureau will prevent anyone from accessing your credit file to open new accounts until you lift the freeze. It’s free to freeze and unfreeze your credit. This is a stronger measure than a fraud alert and will completely stop new credit fraud in your name.