Identity fraud figures are quoted everywhere, but most circulate without a source, a year or a definition, which makes them useless for a business case or a risk model. This page collects identity fraud statistics that trace back to the publisher's own report: US government bodies (FTC, FBI IC3, FinCEN, the Bureau of Justice Statistics), UK Finance, and clearly labelled vendor telemetry on synthetic identities, document forgery and deepfake injection. Each figure carries its source, its data year and what it actually measures. It is written for fraud, KYC and identity teams and the executives who fund them. Workforce identity attacks are covered separately in the Identity Attack Statistics Guide. Last reviewed: November 2026.
Key takeaways
- Identity theft is one in six US consumer reports. The FTC's Consumer Sentinel Network logged 1,135,291 identity theft reports in 2024, 17.5% of all 6.47 million reports, with credit card misuse the largest type.
- Impersonation dominates bank reporting. FinCEN found identity-related suspicious activity in about 42% of Bank Secrecy Act reports for 2021, and impersonation accounted for 69% of the typologies it classified.
- Synthetic identities are a lending problem measured in billions. TransUnion reported more than $3.3 billion of US lender exposure to suspected synthetic identities for the year ending 2024 (vendor data).
- Document fraud is going digital. Entrust's 2026 Identity Fraud Report found digital forgeries made up 35% of document fraud in 2025, against a 29% average for 2022 to 2024, and injection attacks rose 40% year on year (vendor data).
- Account takeover is now a named FBI warning. IC3 received more than 5,100 account takeover complaints with losses above $262 million between January and November 2025.
Headline statistics
| Measure | Figure | Data year | Source |
|---|---|---|---|
| US identity theft reports to the FTC | 1,135,291 (17.5% of all reports) | 2024 | FTC Consumer Sentinel Network Data Book 2024 |
| US residents aged 16+ who experienced identity theft | About 23.9 million (9%) | 2021 | Bureau of Justice Statistics, Victims of Identity Theft, 2021 |
| Losses from identity theft (all victims) | $16.4 billion | 2021 | Bureau of Justice Statistics |
| Identity-related Bank Secrecy Act reports | About 1.6 million (42%), $212 billion suspicious activity | 2021 | FinCEN Financial Trend Analysis |
| Personal Data Breach complaints to IC3 | 67,456 complaints, $1.31 billion losses | 2025 | FBI IC3 Internet Crime Report 2025 |
| Lender exposure to synthetic identities | More than $3.3 billion | Year ending 2024 | TransUnion (vendor analysis) |
| UK payment fraud losses | £1.28 billion, up 4% | 2025 | UK Finance Annual Fraud Report 2026 |
Identity theft reported by consumers
The FTC's Consumer Sentinel Network Data Book 2024 is the largest public US dataset of consumer-reported identity theft. Consumers can report more than one type, so the types overlap.
| Identity theft type (FTC, 2024) | Reports |
|---|---|
| Credit card fraud | 449,032 |
| Loan or lease fraud | 176,400 |
| Bank account fraud | 114,608 |
| Employment or tax-related fraud | 87,470 |
| Government documents or benefits fraud | 70,332 |
- Credit card misuse leads: it appears in about 40% of identity theft reports (449,032 of 1,135,291, our calculation), consistent with new account fraud being the cheapest monetisation route.
- Victim survey view: the Bureau of Justice Statistics found that for 76% of 2021 victims the most recent incident involved misuse of only one type of existing account, such as a credit card or bank account, and about 59% had a financial loss of $1 or more.
- Fraud context: the same FTC dataset recorded 2,600,678 fraud reports with $12.54 billion in reported losses in 2024, so identity theft sits beside, not inside, the headline fraud loss figure.
- Tax angle: employment or tax-related identity theft is the fourth largest type. See the Tax Identity Theft and Tax Scams Guide.
The FTC 2025 Data Book could not be retrieved when this page was checked; the 2024 edition is used and the table will be refreshed.
Identity fraud in financial crime reporting
FinCEN's Financial Trend Analysis of identity-related suspicious activity covers Bank Secrecy Act reports filed in 2021. It is older than other sources here but remains the most detailed public breakdown of how identities are exploited.
| Exploitation type (FinCEN) | Share of reports | Suspicious amount | Share of amount |
|---|---|---|---|
| Impersonation (posing as a real person or organisation) | 69% | $200 billion | 57% |
| Compromise (stolen or compromised credentials) | 18% | $112 billion | 32% |
| Circumvention (defeating identity verification) | 13% | $39 billion | 11% |
These shares use FinCEN's aggregate dataset of about 2.4 million reports and $351 billion, because one report can show several typologies; the de-duplicated total is about 1.6 million reports of roughly 3.8 million filed. Compromise is a minority of reports but carries almost a third of the money, which matches the high value of account takeover.
Synthetic identity fraud
The Federal Reserve's industry focus group defines synthetic identity fraud as the use of a combination of personally identifiable information to fabricate a person or entity. There is no government count of synthetic identity losses; the public figures come from credit bureaus.
- Exposure: TransUnion reported more than $3.3 billion of US lender exposure to suspected synthetic identities for the year ending 2024, linked to a record number of newly opened accounts (release of 17 September 2025).
- Earlier trend: TransUnion put exposure at nearly $3 billion for the first half of 2023, with auto loans at $1.8 billion, up 38% from $1.3 billion a year earlier and more than 60% of the total (release of 24 August 2023).
- Signals: identities with no known relatives and no motor vehicle registrations made up 30% to 50% of synthetic identities in TransUnion's analysis and were up to seven times more likely to be synthetic than legitimate.
Exposure is the balance at risk on suspect accounts, not confirmed losses. See the Synthetic Identity Fraud Guide for controls.
Document fraud, deepfakes and injection attacks
Public statistics on remote identity verification attacks come almost entirely from verification vendors' own traffic. Treat them as indicators of direction, not market-wide rates.
| Measure | Figure | Period and basis | Source |
|---|---|---|---|
| Digital forgeries as share of document fraud | 35% in 2025, against a 29% average for 2022 to 2024 | Entrust verification data, September 2024 to September 2025, 195 countries | Entrust 2026 Identity Fraud Report (vendor) |
| Deepfakes as share of biometric fraud attempts | About 1 in 5 | As above | Entrust (vendor) |
| Growth in deepfaked selfies | 58% in 2025 | As above | Entrust (vendor) |
| Growth in injection attacks | 40% year on year | As above | Entrust (vendor) |
| Complaints mentioning AI | 22,364 complaints, $893 million losses | 2025 | FBI IC3 Internet Crime Report 2025 |
| Bank reporting of deepfake media | Increase in SARs describing suspected deepfakes, beginning in 2023 and continuing in 2024 | Alert FIN-2024-Alert004, 13 November 2024 | FinCEN |
FinCEN asks institutions to use the key term FIN-2024-DEEPFAKEFRAUD in suspicious activity reports, and lists red flags such as a customer photo that looks altered, a third-party webcam plugin during live verification, and a reverse image search matching a gallery of generated faces. Deeper deepfake figures are on the Deepfake Fraud Statistics page.
Account takeover and data breach losses
- FBI account takeover warning: IC3 public service announcement I-112525-PSA (25 November 2025) reported more than 5,100 account takeover complaints and losses above $262 million since January 2025, driven by criminals impersonating bank, customer support or technical support staff to obtain credentials and one-time passcodes, phishing sites and SEO poisoning with fake search ads.
- Personal data breach: IC3 recorded 67,456 Personal Data Breach complaints and $1,314,923,988 in losses in 2025, about $19,500 per complaint (our calculation). Identity Theft as a separate IC3 category had 31,675 complaints and $185.8 million.
- Impersonation: Government Impersonation drew 32,424 complaints and $798 million in 2025, often the opening move that harvests identity data.
- All internet crime: IC3 received 1,008,597 complaints with $20.877 billion in losses in 2025.
- UK: UK Finance reported £1.28 billion stolen through payment fraud in 2025, up 4% (report published 15 June 2026), after over £1.1 billion in 2024.
See the Account Takeover Prevention Guide.
Methodology notes and caveats
- Reports are not incidents: FTC and IC3 data are self-reported complaints; most victims never report, so counts are floors.
- Different years: BJS (2021) and FinCEN (2021) are the latest editions found; they show structure, not current volume.
- Vendor telemetry: Entrust and TransUnion figures come from their customers' traffic and models and are labelled as such. Entrust notes its data may not reflect wider market trends.
- Exposure versus loss: synthetic identity "exposure" is outstanding balance on suspect accounts, not written-off losses.
- Do not add datasets together: a single victim may report to the FTC, file with IC3 and appear in a bank's suspicious activity report, so summing FTC, IC3 and FinCEN figures double counts. Use each source for its own question: consumer harm (FTC, BJS), reported cyber-enabled losses (IC3), institutional detection (FinCEN).
- Category definitions differ: IC3 "Identity Theft" and "Personal Data Breach" are complaint categories chosen by the complainant, while FTC identity theft types describe how the identity was misused. They are not interchangeable.
- UK gap: Cifas Fraudscape, the main UK source on identity fraud filings, could not be retrieved for this edition and is not quoted.
What the numbers mean for defenders
| Finding | Implication | Control to prioritise |
|---|---|---|
| Impersonation is the dominant typology (FinCEN 69%) | Customers and staff are talked out of credentials and codes | Phishing-resistant authentication, call-back verification, out-of-band confirmation of changes |
| Compromise carries 32% of suspicious value | Takeover of existing accounts is high value per case | Session and device risk scoring, step-up on payee and contact detail changes |
| Digital forgeries and injection attacks rising (vendor data) | Photo-of-document and selfie checks alone are weak | Injection attack detection and presentation attack detection, as NIST SP 800-63A-4 requires for remote proofing |
| Synthetic exposure concentrated in new credit | Thin-file applicants are hard to separate from synthetics | Consortium data, identity graph checks, monitoring of early account behaviour |
| Credit card misuse is the top consumer type | New account fraud remains cheap for criminals | Identity proofing at onboarding matched to risk |
NIST SP 800-63A-4 includes a section on digital injection prevention and forged media detection and requires presentation attack detection for remote biometric capture. See the Identity Proofing and KYC Guide, the Biometric Liveness and Presentation Attack Detection Guide and the Fraud Metrics and KPIs Guide for measuring your own rates.
Practitioner checklist
- Quote every figure with publisher, report name and data year; drop any number that cannot be traced to its primary source.
- Label vendor telemetry as vendor data and never present it as a market-wide rate.
- Benchmark your own rates (fraud attempts per 1,000 applications, takeover rate per 10,000 active accounts, document rejection rate) rather than relying on industry averages.
- Map your losses to FinCEN's impersonation, compromise and circumvention typologies to see where controls are thin.
- Add the FIN-2024-DEEPFAKEFRAUD key term to suspicious activity reports where deepfakes are suspected (US institutions).
- Test remote onboarding against injection attacks and forged documents, not only printed photos.
- Refresh this evidence each year when the FTC, IC3 and UK Finance reports are published.
Standards and references
- FTC: Consumer Sentinel Network Data Book 2024
- FBI IC3: Internet Crime Report 2025
- FBI IC3: Account Takeover Fraud public service announcement I-112525-PSA
- FinCEN: Financial Trend Analysis, identity-related suspicious activity
- FinCEN: Alert on fraud schemes involving deepfake media (FIN-2024-Alert004)
- Bureau of Justice Statistics: Victims of Identity Theft, 2021
- NIST: SP 800-63A-4 Identity Proofing and Enrollment
- UK Finance: Annual Fraud Report 2026
Vendor sources: Entrust 2026 Identity Fraud Report announcement; TransUnion releases of 17 September 2025 and 24 August 2023; synthetic identity definition from the Federal Reserve FedPayments Improvement programme.
Related NHI Mgmt Group resources: Identity Attack Statistics Guide · Deepfake Fraud Statistics · Synthetic Identity Fraud Guide · Identity Fraud Prevention Guide