Identity Theft and Fraud

Background

Identity theft is the act of stealing someone’s personal information, while identity fraud is the use of that stolen information to commit fraud. American adults lost a total of $43 billion to identity fraud in 2023. In response to these significant losses, laws and regulations have incorporated consumer protections to address identity theft. For example, all states and the District of Columbia have enacted data breach notification laws so that consumers are aware when their personal information has been compromised. In addition, federal law provides consumers with consumer protections related to credit files compiled by the three major credit bureaus (see also Credit Reports and Scores). Consumers have the right to:

  • review their credit file from each major credit reporting agency once a year for free,
  • correct inaccuracies in their credit files, and
  • place a fraud alert, a security freeze, or both in their credit files.

As hackers have gotten more sophisticated, it has become more critical to have robust systems for detecting fraud. Although criminals use artificial intelligence (AI) to commit fraud, AI can also be used to identify fraud. The technology allows computers to review patterns in an individual’s spending habits and then flag deviations from expected behavior. This can block identity fraud in real time, protecting both consumers and businesses.

IDENTITY THEFT AND FRAUD: Policy

IDENTITY THEFT AND FRAUD: Policy

Consumer protections

Federal policymakers should strengthen protections and enforcement against identity theft and identity fraud. This includes increasing the security of information and databases of businesses that maintain extensive databases of consumer information, such as federally regulated financial institutions.

Policymakers and the private sector should use fair and accurate artificial intelligence tools to protect against identity fraud and improve cybersecurity (see also Scams and Fraud and Artificial Intelligence).

State and local policymakers should strengthen protections against identity theft in areas in which they have jurisdiction. This includes enhanced penalties and enforcement.

State and local policymakers should provide greater resources and training for law enforcement personnel to improve their response to victims. They should also create and implement interjurisdictional programs to share information related to identity theft crimes and apprehend criminals.

Financial education programs should include training about the dangers of posting personally identifying information on social networking sites.