How data brokers enable identity theft

Identity theft hit over 1 million Americans last year. Data brokers are a big part of why — your name, address, date of birth, and phone number sit on dozens of broker sites right now, accessible to anyone who searches for you.

Identity thieves routinely pull these listings to assemble what they need to impersonate you. Your exposed data is the supply chain that makes the attack cheap and fast. Understanding how it works is the first step toward cutting it off.

How identity theft actually happens

Identity theft isn't one crime — it's a category of fraud that takes several distinct forms. Each exploits your personal data differently, and data brokers feed all of them.

Synthetic identity fraud

This is the fastest-growing type of identity theft, and it's particularly insidious because victims often don't discover it for years. Criminals combine real data from one person — typically a Social Security number — with fabricated details like a fake name and address. They use this hybrid identity to open credit accounts, build a credit history over months or years, then "bust out" by maxing everything and disappearing.

Data brokers make synthetic fraud easier by providing verified personal details that lend credibility to fabricated identities. A real date of birth paired with a real former address makes a synthetic identity far more convincing to automated verification systems.

Account takeover

In an account takeover, criminals gain access to your existing financial accounts, email, or other services. They use your personal information to answer security questions ("What street did you grow up on?"), convince customer service representatives they're you, or reset passwords using information found in your listings.

Think about your security questions. Your mother's maiden name, the city where you were born, your high school — all of this is likely available on data broker sites. These "knowledge-based authentication" questions were designed in an era before personal data was widely available online. Today, they offer almost no protection.

New account fraud

This is the classic form of identity theft: someone opens credit cards, loans, or bank accounts in your name. They need your full name, date of birth, address, and Social Security number. Data brokers provide three of those four pieces freely. The SSN is the only missing element, and those are available on dark web marketplaces for a few dollars after any of the major data breaches of the past decade.

Most relevant if this is you:For high-net-worth households · After a scam targeting parents

The role broker data plays

A typical data broker listing contains your full name, current and past addresses, phone numbers, email addresses, date of birth, known relatives, and sometimes employer information. That combination is more than enough to pass most identity verification checks.

When someone applies for credit, the system checks whether their submitted name, date of birth, address, and SSN are consistent with known records. Data brokers effectively publish the cheat sheet: the exact combination of name, DOB, and address the verification system expects to see.

Beyond automated systems, broker data fuels social engineering. A criminal who can recite your address history, your relatives' names, and your date of birth will sound convincing to a customer service representative. Those security questions were designed before your personal details were a Google search away. Today, they offer almost no protection against anyone who's looked you up first.

The "fullz" market

On dark web marketplaces, complete identity packages are known as "fullz" — a full set of personal information sufficient to impersonate someone. A fullz record typically includes:

• Full legal name and date of birth
• Social Security number
• Current and previous addresses
• Phone numbers and email addresses
• Bank account or credit card details
• Mother's maiden name and other security question answers

These packages sell for between $10 and $50 per record, depending on the target's credit score and the completeness of the data. What's striking is how much of a fullz record can be assembled from data broker sites alone. The SSN and financial details typically come from breaches, but everything else — the name, addresses, date of birth, relatives, phone numbers — is available on people-search sites for free or a few dollars.

Data brokers effectively subsidize the identity theft economy. By making personal data freely available, they reduce the cost and effort required to build a complete identity package. Even a criminal who only has a leaked SSN can fill in every other field they need from broker listings.

Practical protection steps

Meaningful protection exists. Here are the most effective steps, roughly in order of impact.

Freeze your credit

A credit freeze is the single most effective defense against new-account identity theft. It prevents anyone — including you — from opening new credit accounts until you temporarily lift the freeze. It's free at all three bureaus (Equifax, Experian, TransUnion) and takes about ten minutes to set up.

When you freeze your credit, lenders cannot pull your credit report, which means they cannot approve new accounts. Even if a criminal has your SSN, name, and address, the application will be denied. You can temporarily lift the freeze when you need to apply for credit yourself, then re-freeze immediately after.

Set up fraud alerts

A fraud alert tells lenders to take extra steps to verify your identity before opening new accounts. Unlike a freeze, it doesn't block applications outright — it just adds a verification step. You only need to place an alert at one bureau; they're required to notify the other two. Initial fraud alerts last one year and can be renewed.

Remove your data from broker sites

Every listing you remove eliminates one source of information available to a thief. This doesn't make you unreachable, but it meaningfully shrinks your attack surface. A criminal who can pull your current address, phone number, and date of birth from twenty different sites has an easy job. One who can't find any of that has to work much harder — and usually moves on to an easier target.

Removal works best alongside a credit freeze. The freeze blocks new accounts; getting your listings removed cuts off the information available for account takeovers, social engineering, and synthetic fraud — threats a freeze alone doesn't address. Delist removes your personal information from the internet and keeps checking that it stays down, because brokers re-list people after confirmed removals.

Monitor your accounts

Review your credit reports at least annually through AnnualCreditReport.com (the only federally authorized source for free reports). Set up transaction alerts on your bank and credit card accounts so you're notified of any activity in real time. Consider a credit monitoring service if you want automated scanning, but don't treat monitoring as a substitute for a freeze — monitoring tells you after theft has occurred, while a freeze prevents it.

What to do if you're a victim

If you discover that someone has used your identity, act quickly. The first hours and days matter most for limiting damage.

1. Report to the FTC at IdentityTheft.gov. This generates a recovery plan and an official Identity Theft Report that you'll need for disputes.
2. Contact the credit bureaus to place a fraud alert or freeze (if you haven't already) and dispute any fraudulent accounts.
3. File a police report with your local department. Some creditors require this before they'll remove fraudulent accounts.
4. Request an IRS Identity Protection PIN at irs.gov. This prevents anyone from filing a tax return using your SSN. Tax refund fraud is one of the most common forms of identity theft, and the IP PIN stops it completely.
5. Notify your financial institutions directly. Close compromised accounts, change passwords, and set up new security questions using answers that aren't derivable from public records.

Frequently asked questions