When the term “theft” meant house invasions or street muggings, the harm was at least visible. With identity theft the damage is unseen, often for months, and the numbers describing it are easy to misread.
That last part matters more than it sounds. The headline figures on this subject come from three organisations that count three different things, and most of the alarming statistics in circulation are one of them wearing another’s label. So before the numbers, what each source actually measures:
- FTC Consumer Sentinel publishes reports. These are unverified complaints filed by consumers and contributing organisations. They are not confirmed incidents, not unique victims, and not a survey of the population. One person can file more than one, and most victims never file at all.
- Javelin Strategy & Research publishes weighted survey estimates of identity fraud, projected from a sample to the US adult population. Its 2026 study surveyed 5,010 US adults aged 18+ between November 10 and December 3, 2025.
- The FBI’s IC3 summarises internet-crime complaints submitted to the Bureau, covering far more than identity theft.
FTC “identity theft”, Javelin “identity fraud” and FBI “internet crime” are not interchangeable, and none of their totals can be divided into another’s to produce a rate. Each figure below says which source it comes from, what population it covers and which year it describes.
Key Identity Theft Statistics for 2026
- FTC Consumer Sentinel recorded 1,135,291 identity-theft reports in 2024, alongside 2,600,678 fraud reports.
- Credit-card identity theft led the FTC’s 2024 categories with 449,032 reports, overtaking government documents or benefits.
- Consumer-reported fraud losses passed $12.5 billion in 2024, a 25% rise. That total covers fraud of all kinds, not identity theft alone.
- Javelin estimates 18 million US adults experienced traditional identity fraud in 2025, with losses of $27.3 billion.
- New-account-fraud victims rose 31% to 5.4 million, and account-takeover victims rose 18% to 6 million.
- Victims spent an average of 10.4 hours resolving identity fraud; 17.8 hours for new-account fraud.
- FBI IC3 received 1,008,597 complaints in 2025 with $20.877 billion in reported losses. This is all internet crime, not identity theft.
- Adults aged 60+ reported $2.4 billion in fraud losses to the FTC in 2024, about four times the 2020 figure.
FTC Identity Theft Reports
The FTC runs Consumer Sentinel, the largest public database of fraud and identity-theft reports in the US. Note the date on what follows: the most recent annual Data Book still covers calendar year 2024, published in March 2025, so these are the current official figures even though we are writing in 2026.
1. The FTC recorded 1,135,291 identity-theft reports in 2024.
(Source: FTC Consumer Sentinel Data Book 2024)
Consumer Sentinel logged 1,135,291 identity-theft reports during 2024, part of 6.5 million consumer reports overall. In 14% of identity-theft reports the victim described more than one type.
What this number is not: a count of Americans whose identity was stolen. These are reports, so they exclude everyone who did not file, and they are unverified, meaning the FTC records what was described without confirming it. The old claim on this page that one in three Americans has suffered identity theft was never supportable from data like this, and no current representative survey establishes a figure like it.
2. Consumers reported losing more than $12.5 billion to fraud in 2024.
(Source: FTC)
The FTC received fraud reports from 2.6 million consumers in 2024, roughly level with 2023, but reported losses jumped 25% to more than $12.5 billion.
Read the scope carefully, because this is the single most misquoted figure in the field. The $12.5 billion covers fraud of every kind, including investment and romance scams that involve no identity theft at all. It is not the cost of identity theft, and attaching it to identity theft, as this page previously did with an older version of the number, overstates the problem by a wide margin.
3. Credit-card identity theft was the most reported type, with 449,032 reports.
(Source: FTC Consumer Sentinel Data Book 2024)
Credit-card identity theft topped the FTC’s 2024 categories at 449,032 reports, around 40% of all identity-theft reports. Most involved new accounts opened in the victim’s name rather than misuse of an existing card.
This is a change of pattern worth noting. For several years government documents or benefits led the table, inflated by pandemic-era unemployment-benefit fraud, which is the state of affairs the old version of this page described. That wave receded and credit applications moved back to the top. For a finance-focused breakdown of reported fraud losses, impersonation, account abuse and consumer financial risk, see these identity theft statistics.
4. Here is how the FTC’s 2024 identity-theft categories rank.
(Source: FTC Consumer Sentinel Data Book 2024)
The full 2024 ranking by number of reports:
- Credit-card identity theft: 449,032
- Other identity theft: 358,993
- Loan or lease identity theft: 176,400
- Bank-account identity theft: 114,608
- Employment or tax-related identity theft: 87,470
- Phone or utilities identity theft: 82,626
- Government documents or benefits: 70,332
The categories overlap, since one report can describe several types, so the figures do not sum to the 1,135,291 total. “Other identity theft” is the second largest and the fastest growing, which is a reminder that the taxonomy lags behind what people are actually experiencing: online-payment and account fraud that fits none of the older boxes lands there.
5. State rankings depend entirely on what you are counting.
(Source: FTC Consumer Sentinel Data Book 2024)
This page used to name California the “main target” of identity theft on the strength of raw complaint totals. That is not a defensible claim, and it is worth explaining why rather than simply swapping in newer numbers.
The FTC publishes state figures two ways: total reports, and reports per 100,000 population. The two answer different questions and produce different league tables. Populous states inevitably top the raw count, which tells you where the most people live more than where the risk is highest; the per-capita rate is the one to use for comparing states, and smaller states regularly top it. Any state ranking you encounter, here or anywhere else, is uninterpretable unless it says which denominator it used.
Identity Fraud: Javelin’s Survey Estimates
Javelin takes the other approach: instead of counting complaints, it surveys a representative sample and projects the results to the whole adult population. Its 2026 study covers 2025 experiences, drawn from 5,010 US adults aged 18 and over surveyed between November 10 and December 3, 2025, weighted to census demographics with about ±2% variance.
Because it captures people who never filed a report, it produces much larger victim numbers than the FTC. It is also an estimate, with the uncertainty that implies, and it measures identity fraud rather than the FTC’s identity theft categories.
6. Javelin estimates 18 million US adults experienced identity fraud in 2025.
(Source: Javelin 2026 Identity Fraud Study)
Javelin puts traditional identity fraud at 18 million US adult victims in 2025, with losses holding steady at $27.3 billion.
“Traditional identity fraud” is Javelin’s term for the unauthorised use of personal information for financial gain, and the $27.3 billion is its estimate of losses from that specific category. It is not an FTC figure and should not be compared with the $12.5 billion fraud-loss total above, which covers different ground entirely. The older $56 billion claim on this page came from a 2020 edition that combined traditional fraud with scams.
7. New-account-fraud victims rose 31% to 5.4 million.
(Source: Javelin 2026 Identity Fraud Study)
Victims of new-account fraud, where a criminal opens an account in someone else’s name, climbed from 4.2 million in 2024 to 5.4 million in 2025, a 31% increase.
This is the sharpest movement in the study and it matches what the FTC categories show from the other direction, with credit-card identity theft dominated by newly opened accounts. New-account fraud is also the hardest kind to notice, because nothing changes on any statement you already receive.
8. Account-takeover victims rose 18% to 6 million.
(Source: Javelin 2026 Identity Fraud Study)
Account takeover, where a criminal gains control of an account you already hold, affected 6 million US adults in 2025, up from 5.1 million, an 18% rise.
Account takeover and new-account fraud are Javelin categories, not FTC ones, so they cannot be matched to the report counts above. Both routes usually begin with credentials exposed in a breach, which is why reused passwords matter so much here; our password statistics cover the authentication side, and the data breach statistics cover where the credentials come from.
9. Victims spent an average of 10.4 hours sorting it out.
(Source: Javelin 2026 Identity Fraud Study)
Consumers spent an average of 10.4 hours resolving identity-fraud problems in 2025, up from 9.5 hours in 2023. The burden is far heavier for the two categories above: account-takeover victims averaged 17 hours and new-account-fraud victims 17.8 hours.
This replaces an out-of-pocket cost figure from 2018 that had no current equivalent. Hours are arguably the more honest measure anyway, since most direct financial losses from card and account fraud are eventually reimbursed, while the time spent making calls, filing reports and repairing credit records never is.
10. Scams are counted separately: about $11 billion and 19 million consumers.
(Source: Javelin 2026 Identity Fraud Study)
Javelin treats scams as a distinct research scope from identity fraud. It estimates scams cost consumers just under $11 billion in 2025 and affected about 19 million people, down from roughly 22 million in 2024, with the average loss per victim falling from $868 to $579.
The distinction is that a scam persuades you to hand over money or information, while identity fraud uses your details without your involvement. They overlap in practice but Javelin does not add them together, and neither should anyone quoting the figures. Scam victim numbers and losses both fell in 2025, which is the rare piece of good news on this page.
Cyber-Enabled Fraud and Older Adults
The last group of figures sits alongside identity theft rather than inside it. The FBI’s numbers cover internet crime broadly, and the older-adult figures cover fraud generally. Both are useful context and neither is an identity-theft total.
11. The FBI received 1,008,597 internet-crime complaints in 2025.
(Source: FBI IC3 2025 Internet Crime Report)
The FBI’s Internet Crime Complaint Center logged 1,008,597 complaints in 2025, up from 859,532 in 2024, with reported losses of $20.877 billion, a 26% increase.
IC3 complaints are a separate population from FTC reports, collected by a different agency through a different channel, and they span ransomware, business email compromise, investment fraud and much else besides identity theft. The two totals happening to sit near one million each is a coincidence of scale, not a corroboration. Our cybersecurity statistics cover the rest of the report.
12. About 453,000 cyber-enabled fraud complaints accounted for $17.7 billion.
(Source: FBI IC3 2025 Internet Crime Report)
Within that total, roughly 453,000 complaints concerned cyber-enabled fraud, with reported losses above $17.7 billion, so about 45% of complaints produced around 85% of the losses.
That concentration is the point. Fraud carried out at a distance, through investment platforms, impersonation and payment redirection, costs far more per incident than the high-volume credential misuse that dominates report counts.
13. Cryptocurrency complaints reached 181,565, with over $11 billion lost.
(Source: FBI IC3 2025 Internet Crime Report)
Cryptocurrency-related complaints totalled 181,565 in 2025 with more than $11 billion in reported losses, up 22% on 2024. The FBI also flagged AI-related complaints among the costliest emerging trends.
Crypto losses are now roughly half of all reported losses in the IC3 dataset, driven by investment fraud rather than by identity theft. It belongs here as context for how fraud money moves, not as an identity-theft figure, and treating all crypto or AI-assisted fraud as identity theft would be a mistake.
14. Adults aged 60+ reported $2.4 billion in fraud losses in 2024.
(Source: FTC)
Reported fraud losses among adults aged 60 and over reached $2.4 billion in 2024, roughly four times the $600 million reported in 2020. The increase was driven largely by individual losses above $100,000, usually to investment scams, romance scams and impersonation.
The FTC is unusually candid about what its own data misses here: because most fraud is never reported, it estimates the true cost to older adults in 2024 at somewhere between $10.1 billion and $81.5 billion, depending on the method. That range is the clearest statement anywhere of how far report-based figures sit from reality.
The previous version of this page claimed identity theft affected one in four older adults and explained it by saying elderly people are not tech-savvy. The first part was unsupported and the second was a stereotype rather than a finding, so both are gone.
15. 41% of adults aged 50+ say they have lost money to fraud or had information misused.
(Source: AARP Fraud Awareness Survey, 2026)
AARP’s 2026 survey of 1,696 US adults found 41% of those aged 50 and over said they had lost money to fraud or had sensitive information obtained and used fraudulently. Across all adults the figure was 38%, which AARP puts at roughly 103 million people.
This is self-reported experience over a lifetime rather than an annual rate, and it combines losing money to fraud with having information misused, which are different harms. It is the closest thing available to a prevalence figure, and worth contrasting with the discredited “one in three Americans” claim: a carefully scoped survey of a defined age group, not a universal headline.
How to Protect Yourself From Identity Theft
The figures above describe scale, not inevitability. The practical advice below follows current FTC and FBI guidance, and differs from what this page used to say in one important respect: the single most effective step is freezing your credit, which was not mentioned at all.
Here are a few ways you can protect yourself from identity theft.
- Freeze your credit with all three bureaus. This is free, it does not affect your credit score, and it directly blocks new-account fraud, the category that grew 31% last year. A freeze stops lenders pulling your file, so an application in your name cannot be approved. Lift it temporarily when you genuinely need credit.
- Use unique passwords and a password manager. Account takeover usually starts with credentials leaked from somewhere else, so reuse is what turns one breach into several. Let software generate and store them.
- Turn on multi-factor authentication, and prefer app or security-key methods over SMS. Text codes are better than nothing but can be captured by a convincing fake login page.
- Check your credit reports. You are entitled to free reports from each bureau at AnnualCreditReport.com. New-account fraud leaves no trace on statements you already read, so the report is often the only place it shows up.
- Guard your Social Security number specifically. It is the key to opening accounts in your name. Give it only when you initiated the contact and the request makes sense; legitimate organisations rarely ask for it over the phone.
- Be careful what you publish about yourself. Birth date, birthplace, phone number and the answers to common security questions, pet names and schools included, are all reusable by someone impersonating you.
- Keep devices and software updated, and lock every device with a passcode or biometric.
- If it happens, report it at IdentityTheft.gov. The FTC site generates a personal recovery plan and the affidavit that creditors ask for, which is what makes disputing fraudulent accounts practical.
Wrap Up
Two things stand out from the 2026 picture. The pattern of identity theft has shifted back towards credit applications, with credit-card identity theft leading the FTC’s categories and new-account fraud victims up 31% in a year, which is precisely the kind of fraud a credit freeze prevents. And the burden on victims is measured better in hours than in dollars, since the money is often reimbursed and the 10.4 hours, or nearly 18 for new-account fraud, never are.
The other thing worth carrying away is scepticism about the numbers themselves. Three organisations count three different things here, the FTC is explicit that its own reports capture a fraction of reality, and the most quoted statistics on this subject are usually one source’s figure attached to another source’s question. Any identity-theft statistic without a source, a year and a population attached is not telling you much.
