Identity theft explained: what can be done with just your name

A few years ago, I thought identity theft only happened to older people or in the kind of high-stakes plots you’d see in action movies. That changed when it happened to my relative – and I got to witness the impact firsthand, from the victim’s perspective. It made me realize just how easily anyone can fall prey to identity theft, even regular people who think they have nothing to worry about. And when it strikes, the consequences can escalate quickly.

My relative was traveling abroad for the holidays with his wife and kids. Everything seemed routine – they landed, picked up a rental car, and drove to their holiday home to settle in. But just a few hours later, law enforcement arrived and arrested him on the spot. He was accused of being an internationally wanted criminal.

Fortunately, the situation was resolved by the next morning. It turned out his identity had likely been compromised – possibly when he handed over his passport during the car rental process. Authorities had mistaken him for someone else using his stolen details. Still, I can only imagine the fear and confusion he and his family must have experienced in that moment.

Identity theft can take many forms, and my relative’s case is just one example. In most situations, this type of crime unfolds entirely online – without the victim ever leaving their home. As someone working in cybersecurity, I became determined to dig deeper into how identity theft happens, what information criminals actually need, and how surprisingly little it takes for them to cause real harm.

What can be done with just your name

In my relative’s case, scammers may have duplicated his passport data, creating a forged identity document with his name and details. That fake identity was later used by someone involved in criminal activity. When international law enforcement flagged the impersonator, the system linked the identity back to my relative’s real information – leading to his mistaken arrest.

However, in some cases, even something as basic as your full name can open the door to identity theft. Consider this scenario: a threat actor stumbles across your name in a leaked database or public website. Using open-source intelligence (OSINT) techniques, they cross-reference it with publicly available data – like social media profiles, company staff pages, or data broker listings. In minutes, they may uncover your email address, phone number, location, and employer.

With that foundation, attackers can launch targeted phishing campaigns, impersonate you online, or exploit weak account recovery processes at service providers. Sometimes, your name can be used to create fake profiles for scams, access pre-approved credit offers, or impersonate you in social engineering attacks aimed at your workplace or contacts.

If that sounds worrying, the best defense against identity theft is understanding it and learning techniques that can help you protect yourself. Now, let’s start by looking at the core of identity theft.

Understanding identity theft

Identity theft is a crime of using a person’s sensitive information – their name, address, credit card or medical details, social security number, or access to online accounts – to pretend to be them and gain something from it. Usually, criminals are after draining a person’s bank accounts, committing crimes in their name, or opening new lines of credit (crypto accounts or loans).

What’s even more concerning is that identity theft cases often go unnoticed until the damage is already done, according to Experian. Without active credit monitoring, the fraudsters can pretty much empty the bank account until they’re denied a loan. You might not notice it for months if they don’t steal huge amounts of money.

Scammers are now after employers

Contrary to popular belief, seniors aren’t the main victims of identity theft. The majority of reported cases are between the ages of 30 to 39. That’s because, in recent years, scammers have switched tactics, focusing more on employers than private individuals. Over 50% of these cases now begin at the workplace, claims Allstate Identity Protection’s report.

By law, businesses are required to store massive amounts of personal data on their employees, including Social Security numbers and addresses. Many of them don’t have robust cybersecurity infrastructures, so they record this data in digital formats that can be accessed via the Internet, leaving the backdoor for cybercriminals.

For fraudsters, stealing people’s data typically involves two steps: collecting and then exploiting it. To debunk their schemes, let’s go over the first step – collecting data.

Behind the identity theft schemes

Most data thieves lurk online, constantly searching for alleyways to exploit online services and user activities. Less often, they act offline, like in my relative’s case. However, these cases still occur, so on a broader scale, identity theft can be categorized based on the methods used to gather personal information – either online or offline.

Online data gathering

Even a single click on a flashy ad or filling out a form to downloadable content can lead to identity theft. Criminals employ various methods to get their hands on people’s personal data, sometimes even combining them. Here are the most common methods they use to gather data online:

• Phishing, smishing, vishing. In these types of thefts, scammers pose as legitimate organizations and try to deceive people to extract their data. Phishing works via email letters, smishing is done via text message, and vishing involves a person calling on the phone.
• Data breaches. Massive user data leaks often stem from corporate data breaches, where large volumes of personal information are stored and exposed. Once compromised, this data is typically sold in bulk on the dark web, with the exact contents varying based on the nature of the breached organization. Some of these breaches – like a supermassive Mother of all Breaches or the more recent one exposing 16 billion passwords – were uncovered by the Cybernews research team.
• Malware. A range of malicious software – such as RATs, stealers, keyloggers, and spyware – is commonly used for data theft. Infections typically occur through phishing emails, malicious downloads, or visits to compromised websites. Once deployed, this malware can steal browser data, collect saved passwords, record what you type, and watch what you're doing on your device in real-time.
• Social media scraping. Threat actors often deploy scraping bots to harvest personal information from social media platforms – details like full names, locations, relationship status, employment history, and even family member names. This data is then leveraged in targeted phishing campaigns and social engineering attacks to increase effectiveness.

Offline data gathering

While most identity thefts take place online, offline methods are still a significant threat. These methods include stealing people's wallets and mail or attaching data-capturing devices to ATMs to steal sensitive details. Here are some examples of how criminals gather data offline:

• Skimming. Criminals attach hidden data-capturing devices to ATMs, payment terminals, or gas pumps to steal credit/debit card information during legitimate transactions.
• Mail theft. Physical theft of personal mail can expose sensitive documents, including bank statements, new credit cards, and other financial or identity-related information.
• Loss or theft of a wallet. Stolen wallets give thieves direct access to personal data such as credit cards, driver's licenses, and government-issued IDs.
• Dumpster diving. Threat actors search residential or commercial trash for discarded documents – like bills, bank statements, or pre-approved credit offers – that may contain valuable personal information.

What happens when scammers get your data

If the threat actor successfully gathers data, the next step is impersonating the victim. This is the final step before reaping the fruits of their crime, so they use various methods to secure their success. Here's what can be done with personal data once stolen:

• Financial identity theft. Often the most damaging form, it can involve criminals draining bank accounts, opening and maxing out credit cards, or taking out loans in the victim's name – particularly quick loans that require less stringent identity verification. The result can be serious debt and a ruined credit score.
• Criminal identity theft. Occurs when a criminal uses someone else's identity during a crime or arrest. This can result in the victim facing legal consequences, failing background checks, or being wrongfully fined or prosecuted.
• Tax identity theft. Fraudsters use a victim's personal information – often including their Social Security number – to file false tax returns and claim refunds. This can lead to the victim's legitimate return being rejected by the IRS.
• Synthetic identity theft. A more sophisticated tactic where attackers combine real and fake information to create a new, fictitious identity. For example, they may use a real SSN with fabricated name and address details. While this often harms financial institutions, it can also negatively impact the real person tied to the SSN.
• Child’s identity theft. Children's Social Security numbers are especially attractive due to their clean credit histories. Criminals may use them to open accounts, apply for loans, or access government benefits – often remaining undetected for years until the child grows up and applies for credit.

Identity theft is costing millions in the US

If you’re wondering about the size of this problem, it’s best to look at the latest statistics. As per 2023 Cyber Safety Insights Report, India was the country most affected by identity theft in 2022, with over 27 million cases. The second place belongs to the US, with over 13 million cases. However, if you look at population percentage, the US is actually winning in identity theft cases.

According to the Federal Trade Commission, in 2024, there were over 1.1 million reports of identity theft, with credit card misuse being the most common form. Separately, the FTC received approximately 2.6 million reports of fraud. Victims of identity theft alone lost millions of dollars over the course of the year.

Identity theft and fraud are significant concerns in the US, with massive financial losses in 2024. Unfortunately, the number was at an all-time annual high of $12.7 billion last year. These numbers signal that data thieves are getting clever and using more effective methods.

Protecting yourself from identity theft

The majority of identity thefts have dire consequences. However, they can be prevented by keeping cybersecurity hygiene. I’ve compiled a list of the most effective practices that can help you not only avoid identity thefts but combat all kinds of threats online:

• Use a strong password. An easy to guess or compromised password is an easy target for cybercriminals. Make sure your password is unique and contains uppercase and lowercase letters, numbers, and symbols. And don’t write it down in visible places or share it with others.
• Enable two-factor authentication. This secures your data with an additional lock. Even if your password is compromised, no one will be able to log into your account without authentication from your device.
• Don’t overshare sensitive data. Sharing personal information such as full name, address, or phone number can help cybercriminals collect your data and use it to access your accounts.
• Regularly monitor accounts. Keeping track of your accounts helps to quickly identify suspicious activity or unauthorized transactions. If you notice something suspicious, contact relevant institutions.
• Use secure connections. Public networks are unsecured and generally unsafe, leaving many security loopholes that cybercriminals can exploit. If you can’t access a private network, use a VPN. It encrypts an internet connection and creates a secure tunnel for data.
• Learn about phishing scams. Understanding how phishing attacks work and what tactics are used can help you prepare effective countermeasures. So, educating yourself on this topic is always a good practice.

Final remarks

Anyone can fall victim to identity theft – especially online. Cybercriminals use a range of tactics to get their hands on your personal data, from posing as legitimate organizations to exploiting large-scale data breaches. Once they have your information, they can impersonate you, open fraudulent accounts, and – in many cases – drain your bank account.

Identity theft remains a serious and growing problem in the United States and India, among other countries. This trend highlights a troubling reality: cybercriminals are becoming more sophisticated, and their methods harder to detect.

The best way to protect yourself is by practicing good cybersecurity hygiene. That includes using strong, unique passwords, enabling two-factor authentication, keeping software up to date, and regularly monitoring your financial accounts. While no method is foolproof, these basic precautions can significantly reduce your risk of identity theft – and spare you from its potentially devastating consequences.