Am I at risk of identity theft?

In short: Identity-theft risk increases when names, addresses, birth dates, account details, or government identifiers are exposed together. Check known breaches and public broker listings, then protect the accounts and records connected to what you find.

What identity theft cost Americans in 2024

The Federal Trade Commission published its Consumer Sentinel Network Data Book for 2024 in early 2025. Three numbers worth memorizing:

• $12.5 billion in total fraud losses, up roughly 25% from 2023.
• 6.5 million total consumer reports across all fraud categories.
• 1.1 million identity-theft reports specifically, one of the highest single-year volumes the FTC has logged.

The categories that grew fastest were impersonation scams (people pretending to be government agencies, banks, or known businesses) and investment fraud (especially crypto-themed). Both rely on the attacker knowing enough about you (name, address, family, employer) to seem credible.

That knowledge has to come from somewhere. Increasingly, it comes from a data broker or a breach.

How brokers and breaches feed identity theft

Identity theft used to require effort. A stolen wallet. A phishing email written by a human. A dumpster-dived utility bill. Today it requires a search.

Three pipelines feed the modern identity-theft market:

1. Data brokers: people-search companies publish your name, address, phone, age, relatives, and previous addresses on the open web. Anyone can search. Some make it free; others charge a few dollars per lookup. See how brokers operate.
2. Data breaches: when a company gets hacked, the data leaks. The 2024 National Public Data breach exposed 2.9 billion records including Social Security numbers, addresses, and family relationships, covering most living US adults. NPD filed for bankruptcy in October 2024 rather than face victim restitution.
3. Dark-web aggregators: collected from past breaches, broker scrapes, and credential-stuffing dumps. Known leak databases now catalog billions of compromised accounts across roughly a thousand publicly disclosed breaches.

An identity thief doesn't pick a person and then research them. They search for a name with matching exposure and work with whoever turns up. The less of your data is exposed, the less you stand out. That's something you can change.

The five categories of identity theft

"Identity theft" is a single label for very different attacks. The FTC's 2024 Consumer Sentinel breakdown:

• Credit-card fraud. Opening new lines or charging existing ones. The largest single category in 2024. Recovery is usually fast: file a fraud report, the bank reverses the charge.
• Loan or lease fraud. Personal loans, auto loans, or apartment leases opened in your name. Recovery is slower. You may not know until a debt collector calls.
• Government-benefits fraud. Unemployment, tax refunds, and Social Security filings in your name. The IRS reported over a million suspicious tax returns flagged in 2024.
• Medical identity theft. Using your insurance to obtain treatment or prescriptions. Recovery is the slowest. Your medical records get co-mingled with the thief's. Insurers limit how often you can correct this.
• Synthetic identity fraud. Combining real data (often a child's Social Security number) with fabricated data to create a new identity that passes credit checks. Children are the fastest-growing target group because they don't check credit until 18.

What to do if you've been hit

Recovery is procedural, not improvisational. The FTC publishes a free recovery plan at IdentityTheft.gov. The general sequence:

1. Same day. Call the company where the fraud happened. File a fraud report. Freeze the affected account.
2. Same day. Place a free fraud alert with Equifax, Experian, or TransUnion (one notifies the other two automatically). Lasts one year.
3. Within 24 hours. Report at IdentityTheft.gov. The FTC issues a recovery plan and a sworn affidavit you can give to creditors.
4. Within a week. Pull your free credit reports from annualcreditreport.com. Look for accounts you didn't open.
5. Within 30 days. Consider a credit freeze. Free, permanent until you lift it. Stops new credit accounts from being opened in your name.
6. Ongoing. File a police report if local law allows it. Some jurisdictions require this for certain types of restitution.

Why the credit freeze isn't enough

A credit freeze stops new credit. It does not stop:

• Existing-account fraud. A thief can still charge cards you already have.
• Medical fraud. Credit freezes don't affect medical providers.
• Government-benefits fraud. The IRS doesn't pull credit reports.
• Social engineering. Call centers, customer-support reps, and family members can still be convinced you're not you (or that the thief is). They don't pull credit reports either.

The freeze closes one door. The rest stay open as long as your name, address, birthday, employer, and family are on the open web. Removing the exposure is what closes the rest of the doors.

How Delist reduces your attack surface

Identity theft is downstream of exposure. The fewer sources a thief can use to confirm "this is the right person," the less likely the attack works.

Delist does three things that move the identity-theft needle:

• Files removals across data brokers. The broker sites that publish your name, address, phone, and relatives. Cuts the raw material social-engineering attacks rely on.
• Watches for breach exposures. Cross-references your email and identifiers against known breach sources and alerts on new leaks. You can act before fraud lands.
• Detects re-listings. Brokers can re-add a record when they ingest fresh source data; timing varies. Delist catches it and re-submits removal automatically.

It does not make you bulletproof. Nothing does. It makes you a less profitable target, and that is most of the game.

Frequently asked questions