Skip to content
← All fraud types

Identity & Access

Identity Theft & Account Takeover

The theft of personal information — or the hijacking of an existing account — to impersonate a victim, drain accounts, open new credit, or file fraudulent claims. It usually begins with a breach, phishing, or SIM swapping rather than a stolen wallet.

01 — How it works

  1. 01

    Acquire

    Obtain credentials from a breach, phishing, or SIM swap.

  2. 02

    Verify

    Log in and change contact details to lock the victim out.

  3. 03

    Drain

    Move funds and open new accounts or credit lines.

  4. 04

    Exit

    Disappear before the victim or bank detects the activity.

02 — Lifecycle

From first contact to detection.

  1. Breached

    Credentials leaked or a SIM is hijacked.

  2. Drained

    Accounts emptied and new credit opened.

  3. Reported

    Victim discovers the loss and reports it.

  4. Repeated

    Fraudsters quickly move to the next victim.

03 — Common variants

  • Credential stuffing
  • SIM swapping
  • Credit bust-out
  • New-account fraud

04 — Statutes & penalties

18 U.S.C. § 1028 (Identity Theft), § 1028A (Aggravated Identity Theft), § 1343 (Wire Fraud)

Up to 15–30 years and fines; aggravated identity theft adds a mandatory 2-year consecutive term. Restitution and credit-monitoring orders are common.

05 — How people are drawn in

Victims are selected for the value of their data, not recruited. Insiders are sometimes paid to smuggle customer records out of call centers, banks, or medical offices.

06 — Examples

  • Account takeover via credential stuffing with a password reused across breached sites.
  • SIM-swap attacks that hijack a phone number to intercept one-time codes.
  • Opening new lines of credit with stolen identities and a synthetic address.