Identity Theft Methods and AI Tools
5 minutes
5 Questions
Identity theft occurs when a perpetrator obtains and misuses another person's personal identifying information (PII) such as Social Security numbers, dates of birth, account credentials, or biometric data to commit fraud. Certified Fraud Examiners (CFEs) study the methods criminals use so they can detect, investigate, and prevent these schemes. Traditional identity theft methods include dumpster diving for discarded documents, mail theft, shoulder surfing at ATMs, skimming devices on card readers, pretexting (posing as a legitimate party to extract information), and insider theft by employees with database access. Digital methods have expanded the threat: phishing emails and smishing texts lure victims into revealing credentials; malware and keyloggers capture keystrokes; data breaches expose millions of records sold on dark web marketplaces; SIM swapping hijacks phone numbers to defeat two-factor authentication; and synthetic identity fraud combines real and fabricated data to create new fictitious identities that evade basic verification. Artificial intelligence has amplified both the attack and defense sides. Fraudsters use generative AI to craft highly personalized, grammatically flawless phishing messages at scale, deepfake audio and video to impersonate executives or relatives in social engineering attacks, and automated bots to perform credential stuffing against thousands of accounts. AI can also scrape social media to assemble detailed victim profiles. Conversely, CFEs and financial institutions deploy AI tools for detection and prevention. Machine learning models analyze transaction patterns to flag anomalies in real time, behavioral biometrics assess typing rhythm and device usage to verify legitimate users, natural language processing scans communications for phishing indicators, and link analysis software uncovers networks of related synthetic identities. Document verification systems use computer vision to detect forged or altered identification. For the CFE, understanding this dual role of AI is essential: examiners must recognize AI-enabled attack signatures while leveraging analytical tools responsibly, maintaining evidentiary standards, data privacy compliance, and professional skepticism throughout investigations.
Identity Theft Methods and AI Tools: A Complete CFE Study Guide
1. Why This Topic Matters for the CFE Exam
Identity theft sits inside the Financial Transactions and Fraud Schemes section of the CFE Exam, and it is one of the fastest-evolving areas in the Fraud Examiners Manual. Historically the exam tested the classic ways criminals obtain and misuse personal data: stolen mail, dumpster diving, skimming, phishing. The ACFE has now layered artificial intelligence onto that foundation because fraudsters use generative AI, deepfakes and automated tools to make identity theft faster, cheaper and far more convincing.
Why should a fraud examiner care? Because identity theft is rarely an end in itself; it is the enabler of other frauds: account takeover, loan and credit card fraud, benefits and tax refund fraud, business email compromise, synthetic identity lending fraud and money laundering through mule accounts. If you understand how identities are stolen and weaponised, you can recognise red flags earlier, design controls and interview victims and suspects more effectively. On the exam, this translates into questions that test definitions, classifications, method recognition and, increasingly, the role of AI in both committing and detecting identity fraud.
2. What Identity Theft Is
The ACFE defines identity theft broadly as the wrongful acquisition and use of another person's identifying information (name, Social Security or national ID number, date of birth, account numbers, passwords, biometric data) for fraud or other crimes. Key distinctions the exam expects you to know:
Identity theft vs. identity fraud. Identity theft is the act of obtaining the data. Identity fraud is the subsequent use of that data for gain. Many questions hinge on this sequence: theft first, fraud second.
True name (new account) fraud. The thief uses stolen data to open new accounts, loans, phone contracts or utilities in the victim's name. Victims often discover it months later via collection notices or a denied credit application.
Account takeover fraud. The thief gains control of an existing account, changes the address or contact details, then drains funds or runs up charges. Detected faster because the victim already monitors the account.
Synthetic identity theft. The fraudster blends real elements (often a child's or deceased person's SSN) with fabricated names, dates of birth and addresses to create a person who does not exist. The synthetic identity is nurtured over time to build credit, then busted out. There is no single victim to complain, so it is the hardest form to detect and the one most supercharged by AI.
Other categories: criminal identity theft (giving a victim's identity to police at arrest), medical identity theft (obtaining care, drugs or insurance payouts), child identity theft, deceased-person (ghosting) identity theft, tax refund identity theft, employment identity theft, and business or corporate identity theft (posing as a legitimate company to obtain credit, divert payments or file fraudulent state records).
3. How Identity Theft Works: The Lifecycle
Think of identity theft as a four-stage cycle. Exam questions frequently ask you to place a method in the correct stage.
Stage 1: Acquisition of information. The thief gathers identifiers through physical or digital means.
Stage 2: Assumption of identity. Documents, accounts or profiles are created or hijacked.
Stage 3: Exploitation / monetisation. Credit is drawn, goods bought, benefits claimed, funds moved through mules.
Stage 4: Concealment. Address changes, forwarding of mail, deleting alerts, use of synthetic identities and layered transactions to delay discovery.
4. Traditional (Non-AI) Methods of Obtaining Identity Information
Physical methods
- Dumpster diving: retrieving bank statements, pre-approved credit offers and medical records from trash.
- Mail theft and change-of-address fraud: stealing from mailboxes or redirecting the victim's mail.
- Shoulder surfing: observing PINs, passwords or card numbers in public.
- Theft of wallets, laptops, phones and records; burglary of homes or offices.
- Skimming: capturing magnetic stripe or chip data at ATMs, fuel pumps and point-of-sale devices, often with hidden cameras for PINs. Shimming targets chip cards.
- Insider theft: employees of banks, hospitals, HR departments or call centres selling customer data; the ACFE stresses that insiders remain a major source.
Social engineering methods
- Pretexting: inventing a scenario (bank security officer, survey taker, IT help desk) to persuade the victim or a third party to disclose data. Note that pretexting to obtain financial information is prohibited under the Gramm-Leach-Bliley Act in the United States.
- Phishing: fraudulent emails imitating trusted institutions, leading to fake login pages.
- Spear phishing and whaling: targeted phishing against specific individuals or executives.
- Vishing: voice phishing by telephone, often with spoofed caller ID.
- Smishing: phishing via SMS text messages.
- Pharming: redirecting users to counterfeit websites through DNS poisoning or malicious host files, even when the correct URL is typed.
- Baiting and quid pro quo: offering something (a prize, free software, tech support) in exchange for credentials.
Technical methods
- Malware, spyware and keyloggers installed via attachments, drive-by downloads or infected USB drives.
- Data breaches of retailers, credit bureaus, health systems and government databases; stolen data is sold in bulk on dark web marketplaces as fullz (full identity packages).
- Credential stuffing: automated reuse of breached username/password pairs across many sites.
- SIM swapping: convincing a mobile carrier to port the victim's number to the thief's SIM, intercepting one-time passcodes and defeating SMS-based two-factor authentication.
- Public Wi-Fi interception and man-in-the-middle attacks.
- Open-source intelligence (OSINT): harvesting birthdates, mother's maiden names, pet names and employers from social media to answer security questions.
5. AI Tools in Identity Theft
The ACFE now expects candidates to understand that artificial intelligence does not create entirely new categories of identity theft; rather, it scales and perfects existing ones. Learn the following applications.
Generative AI for social engineering. Large language models produce flawless, personalised phishing emails and texts in any language, eliminating the misspellings and awkward grammar that were once red flags. Criminal variants marketed on dark web forums (often described as jailbroken or uncensored chatbots) write malware, scam scripts and fake customer-service dialogues on demand. AI chatbots can also hold real-time conversations with victims, scaling romance and tech-support scams that harvest identity data.
Deepfake voice cloning (AI vishing). A few seconds of audio from a voicemail, podcast or social media video is enough to clone a voice. Fraudsters impersonate executives to authorise payments, impersonate relatives in distress to extract money and identity data, and defeat voice-based authentication at banks and call centres.
Deepfake video and images. AI-generated or face-swapped video is used to pass remote onboarding, to impersonate executives on video calls, and to produce fake ID photos and selfies for know-your-customer (KYC) checks. Injection attacks feed deepfake video directly into a verification app, bypassing the camera entirely.
Synthetic identity manufacturing. Generative adversarial networks (GANs) create photorealistic faces of people who do not exist. Combined with AI-generated supporting documents (utility bills, pay stubs, driver's licences) and fabricated digital footprints, these allow synthetic identities to be built and aged at industrial scale.
Document forgery. AI image tools alter passports, licences and statements so convincingly that visual inspection fails; fraud-as-a-service sites sell template-based forged IDs within minutes.
Automated reconnaissance and data mining. AI aggregates breach dumps, scrapes social media and correlates fragments into complete profiles, identifying the most profitable targets and the security-question answers needed to take over accounts.
Automated attack tooling. Machine learning helps bots solve CAPTCHAs, rotate IP addresses, mimic human typing and mouse behaviour to evade bot detection, and optimise credential-stuffing campaigns.
Biometric spoofing. AI generates fingerprints, voiceprints and facial images designed to trick biometric systems, and adversarial inputs that confuse recognition models.
6. AI on the Defensive Side
The exam may also ask how organisations use AI to fight identity theft. Know these counter-tools:
- Behavioural biometrics (typing cadence, swipe patterns, device handling) to confirm the genuine user is present.
- Liveness detection and deepfake detection algorithms during onboarding.
- Anomaly detection and machine-learning transaction monitoring that flag unusual logins, device changes, velocity of applications and address-change-then-withdrawal patterns.
- Link analysis to detect synthetic identity clusters sharing phone numbers, addresses, devices or SSNs.
- Natural language processing to screen inbound emails for AI-generated phishing.
Remember the principle: controls should be layered (defence in depth) and should not rely on any single factor such as SMS codes or voice recognition that AI can defeat.
7. Red Flags and Prevention Points Likely to Be Tested
Victim-side red flags: unexplained denials of credit, bills or collection calls for unknown accounts, missing mail, medical explanation-of-benefits statements for services never received, IRS or tax authority notices of duplicate filings, and sudden loss of mobile service (possible SIM swap).
Organisational red flags: multiple applications sharing an SSN with different names, thin credit files that suddenly request high limits, addresses that are mail drops, mismatched geolocation and device fingerprints, video verification with unnatural blinking or lighting, and urgent payment requests on calls where the speaker refuses to switch channels.
Prevention: shredding, locking mailboxes, credit freezes and fraud alerts, monitoring credit reports, strong unique passwords with multi-factor authentication (preferably app-based or hardware tokens rather than SMS), call-back verification using independently obtained numbers, family or corporate safe words to defeat voice clones, employee training, data minimisation and encryption, and vendor due diligence on identity-verification providers.
8. Exam Tips: Answering Questions on Identity Theft Methods and AI Tools
Tip 1: Master the vocabulary and the subtle pairs. Phishing (email) vs. vishing (voice) vs. smishing (SMS) vs. pharming (website redirection without a lure). Skimming (card data capture) vs. shimming (chip). Identity theft (acquisition) vs. identity fraud (use). True name fraud (new accounts) vs. account takeover (existing accounts). Many wrong answers are built from swapping these pairs.
Tip 2: Classify by stage. When a scenario describes behaviour, ask whether the fraudster is obtaining data, assuming the identity, exploiting it or concealing it. Dumpster diving and phishing are acquisition; filing a change of address or deleting account alerts is concealment.
Tip 3: Recognise synthetic identity as the odd one out. If a question says there is no identifiable consumer victim, the credit file is thin but growing, or a child's SSN is paired with an adult's name, the answer is synthetic identity fraud. Expect AI-generated faces and documents to appear in these scenarios.
Tip 4: For AI questions, remember amplification not invention. The exam frames AI as a tool that makes traditional schemes more convincing, personalised and scalable. If an option claims AI eliminates the need for social engineering or makes detection impossible, it is likely a distractor. The correct option usually describes AI improving the quality, speed or volume of phishing, impersonation, document forgery or biometric spoofing.
Tip 5: Know what each AI tool defeats. Voice cloning defeats voice authentication and call-back trust; deepfake video defeats remote KYC and video approvals; generative text defeats grammar-based phishing detection; SIM swapping (often paired with AI-assisted pretexting) defeats SMS one-time passcodes. Questions often ask which control is weakest against a given attack.
Tip 6: Choose the most robust control. When asked for the best preventive measure, prefer multi-layered, out-of-band or independent verification (call back on a known number, hardware MFA, liveness detection plus document checks, pre-agreed code words) over single-point controls such as caller ID, email domain inspection or voice recognition alone.
Tip 7: Watch for legal hooks. Pretexting for financial data violates the Gramm-Leach-Bliley Act; identity theft is a federal crime under the Identity Theft and Assumption Deterrence Act; the Fair and Accurate Credit Transactions Act and Red Flags Rule require certain creditors and financial institutions to have identity theft prevention programs. Questions sometimes combine a method with the relevant statute.
Tip 8: Read for the victim's perspective. Scenario questions about an individual discovering fraud typically test red flags and response steps (place fraud alert or credit freeze, file a police report and an FTC report, notify creditors). Scenario questions about a company test program design and detection analytics.
Tip 9: Eliminate absolutes. Answers containing always, never, impossible or guaranteed are rarely correct in this topic because identity theft methods and AI tools are constantly changing and no control is foolproof.
Tip 10: Practise mapping scenarios to terms. Before the exam, write out ten short scenarios (an email asking you to verify a password, a cloned CEO voice requesting a wire, a GAN-generated face on a loan application, a DNS redirect to a fake bank site) and label each with its method, lifecycle stage, enabling technology and best control. This mirrors exactly how the CFE Exam tests the subject.
9. One-Paragraph Summary
Identity theft is the wrongful acquisition of personal identifiers; identity fraud is their misuse through true name fraud, account takeover or synthetic identities, as well as medical, criminal, child, tax and business variants. Thieves obtain data through physical theft, insider leaks, social engineering (pretexting, phishing, vishing, smishing, pharming), technical attacks (malware, breaches, SIM swapping, credential stuffing) and open-source research. Artificial intelligence amplifies every one of these methods, producing flawless phishing, cloned voices, deepfake video, synthetic faces and forged documents that defeat traditional and biometric controls, while defensive AI in the form of behavioural biometrics, liveness detection and anomaly analytics provides the counterweight. For the exam, know the definitions precisely, classify methods by lifecycle stage, treat AI as an amplifier rather than a new scheme, and select layered, out-of-band controls as the best answer.
Identity theft sits inside the Financial Transactions and Fraud Schemes section of the CFE Exam, and it is one of the fastest-evolving areas in the Fraud Examiners Manual. Historically the exam tested the classic ways criminals obtain and misuse personal data: stolen mail, dumpster diving, skimming, phishing. The ACFE has now layered artificial intelligence onto that foundation because fraudsters use generative AI, deepfakes and automated tools to make identity theft faster, cheaper and far more convincing.
Why should a fraud examiner care? Because identity theft is rarely an end in itself; it is the enabler of other frauds: account takeover, loan and credit card fraud, benefits and tax refund fraud, business email compromise, synthetic identity lending fraud and money laundering through mule accounts. If you understand how identities are stolen and weaponised, you can recognise red flags earlier, design controls and interview victims and suspects more effectively. On the exam, this translates into questions that test definitions, classifications, method recognition and, increasingly, the role of AI in both committing and detecting identity fraud.
2. What Identity Theft Is
The ACFE defines identity theft broadly as the wrongful acquisition and use of another person's identifying information (name, Social Security or national ID number, date of birth, account numbers, passwords, biometric data) for fraud or other crimes. Key distinctions the exam expects you to know:
Identity theft vs. identity fraud. Identity theft is the act of obtaining the data. Identity fraud is the subsequent use of that data for gain. Many questions hinge on this sequence: theft first, fraud second.
True name (new account) fraud. The thief uses stolen data to open new accounts, loans, phone contracts or utilities in the victim's name. Victims often discover it months later via collection notices or a denied credit application.
Account takeover fraud. The thief gains control of an existing account, changes the address or contact details, then drains funds or runs up charges. Detected faster because the victim already monitors the account.
Synthetic identity theft. The fraudster blends real elements (often a child's or deceased person's SSN) with fabricated names, dates of birth and addresses to create a person who does not exist. The synthetic identity is nurtured over time to build credit, then busted out. There is no single victim to complain, so it is the hardest form to detect and the one most supercharged by AI.
Other categories: criminal identity theft (giving a victim's identity to police at arrest), medical identity theft (obtaining care, drugs or insurance payouts), child identity theft, deceased-person (ghosting) identity theft, tax refund identity theft, employment identity theft, and business or corporate identity theft (posing as a legitimate company to obtain credit, divert payments or file fraudulent state records).
3. How Identity Theft Works: The Lifecycle
Think of identity theft as a four-stage cycle. Exam questions frequently ask you to place a method in the correct stage.
Stage 1: Acquisition of information. The thief gathers identifiers through physical or digital means.
Stage 2: Assumption of identity. Documents, accounts or profiles are created or hijacked.
Stage 3: Exploitation / monetisation. Credit is drawn, goods bought, benefits claimed, funds moved through mules.
Stage 4: Concealment. Address changes, forwarding of mail, deleting alerts, use of synthetic identities and layered transactions to delay discovery.
4. Traditional (Non-AI) Methods of Obtaining Identity Information
Physical methods
- Dumpster diving: retrieving bank statements, pre-approved credit offers and medical records from trash.
- Mail theft and change-of-address fraud: stealing from mailboxes or redirecting the victim's mail.
- Shoulder surfing: observing PINs, passwords or card numbers in public.
- Theft of wallets, laptops, phones and records; burglary of homes or offices.
- Skimming: capturing magnetic stripe or chip data at ATMs, fuel pumps and point-of-sale devices, often with hidden cameras for PINs. Shimming targets chip cards.
- Insider theft: employees of banks, hospitals, HR departments or call centres selling customer data; the ACFE stresses that insiders remain a major source.
Social engineering methods
- Pretexting: inventing a scenario (bank security officer, survey taker, IT help desk) to persuade the victim or a third party to disclose data. Note that pretexting to obtain financial information is prohibited under the Gramm-Leach-Bliley Act in the United States.
- Phishing: fraudulent emails imitating trusted institutions, leading to fake login pages.
- Spear phishing and whaling: targeted phishing against specific individuals or executives.
- Vishing: voice phishing by telephone, often with spoofed caller ID.
- Smishing: phishing via SMS text messages.
- Pharming: redirecting users to counterfeit websites through DNS poisoning or malicious host files, even when the correct URL is typed.
- Baiting and quid pro quo: offering something (a prize, free software, tech support) in exchange for credentials.
Technical methods
- Malware, spyware and keyloggers installed via attachments, drive-by downloads or infected USB drives.
- Data breaches of retailers, credit bureaus, health systems and government databases; stolen data is sold in bulk on dark web marketplaces as fullz (full identity packages).
- Credential stuffing: automated reuse of breached username/password pairs across many sites.
- SIM swapping: convincing a mobile carrier to port the victim's number to the thief's SIM, intercepting one-time passcodes and defeating SMS-based two-factor authentication.
- Public Wi-Fi interception and man-in-the-middle attacks.
- Open-source intelligence (OSINT): harvesting birthdates, mother's maiden names, pet names and employers from social media to answer security questions.
5. AI Tools in Identity Theft
The ACFE now expects candidates to understand that artificial intelligence does not create entirely new categories of identity theft; rather, it scales and perfects existing ones. Learn the following applications.
Generative AI for social engineering. Large language models produce flawless, personalised phishing emails and texts in any language, eliminating the misspellings and awkward grammar that were once red flags. Criminal variants marketed on dark web forums (often described as jailbroken or uncensored chatbots) write malware, scam scripts and fake customer-service dialogues on demand. AI chatbots can also hold real-time conversations with victims, scaling romance and tech-support scams that harvest identity data.
Deepfake voice cloning (AI vishing). A few seconds of audio from a voicemail, podcast or social media video is enough to clone a voice. Fraudsters impersonate executives to authorise payments, impersonate relatives in distress to extract money and identity data, and defeat voice-based authentication at banks and call centres.
Deepfake video and images. AI-generated or face-swapped video is used to pass remote onboarding, to impersonate executives on video calls, and to produce fake ID photos and selfies for know-your-customer (KYC) checks. Injection attacks feed deepfake video directly into a verification app, bypassing the camera entirely.
Synthetic identity manufacturing. Generative adversarial networks (GANs) create photorealistic faces of people who do not exist. Combined with AI-generated supporting documents (utility bills, pay stubs, driver's licences) and fabricated digital footprints, these allow synthetic identities to be built and aged at industrial scale.
Document forgery. AI image tools alter passports, licences and statements so convincingly that visual inspection fails; fraud-as-a-service sites sell template-based forged IDs within minutes.
Automated reconnaissance and data mining. AI aggregates breach dumps, scrapes social media and correlates fragments into complete profiles, identifying the most profitable targets and the security-question answers needed to take over accounts.
Automated attack tooling. Machine learning helps bots solve CAPTCHAs, rotate IP addresses, mimic human typing and mouse behaviour to evade bot detection, and optimise credential-stuffing campaigns.
Biometric spoofing. AI generates fingerprints, voiceprints and facial images designed to trick biometric systems, and adversarial inputs that confuse recognition models.
6. AI on the Defensive Side
The exam may also ask how organisations use AI to fight identity theft. Know these counter-tools:
- Behavioural biometrics (typing cadence, swipe patterns, device handling) to confirm the genuine user is present.
- Liveness detection and deepfake detection algorithms during onboarding.
- Anomaly detection and machine-learning transaction monitoring that flag unusual logins, device changes, velocity of applications and address-change-then-withdrawal patterns.
- Link analysis to detect synthetic identity clusters sharing phone numbers, addresses, devices or SSNs.
- Natural language processing to screen inbound emails for AI-generated phishing.
Remember the principle: controls should be layered (defence in depth) and should not rely on any single factor such as SMS codes or voice recognition that AI can defeat.
7. Red Flags and Prevention Points Likely to Be Tested
Victim-side red flags: unexplained denials of credit, bills or collection calls for unknown accounts, missing mail, medical explanation-of-benefits statements for services never received, IRS or tax authority notices of duplicate filings, and sudden loss of mobile service (possible SIM swap).
Organisational red flags: multiple applications sharing an SSN with different names, thin credit files that suddenly request high limits, addresses that are mail drops, mismatched geolocation and device fingerprints, video verification with unnatural blinking or lighting, and urgent payment requests on calls where the speaker refuses to switch channels.
Prevention: shredding, locking mailboxes, credit freezes and fraud alerts, monitoring credit reports, strong unique passwords with multi-factor authentication (preferably app-based or hardware tokens rather than SMS), call-back verification using independently obtained numbers, family or corporate safe words to defeat voice clones, employee training, data minimisation and encryption, and vendor due diligence on identity-verification providers.
8. Exam Tips: Answering Questions on Identity Theft Methods and AI Tools
Tip 1: Master the vocabulary and the subtle pairs. Phishing (email) vs. vishing (voice) vs. smishing (SMS) vs. pharming (website redirection without a lure). Skimming (card data capture) vs. shimming (chip). Identity theft (acquisition) vs. identity fraud (use). True name fraud (new accounts) vs. account takeover (existing accounts). Many wrong answers are built from swapping these pairs.
Tip 2: Classify by stage. When a scenario describes behaviour, ask whether the fraudster is obtaining data, assuming the identity, exploiting it or concealing it. Dumpster diving and phishing are acquisition; filing a change of address or deleting account alerts is concealment.
Tip 3: Recognise synthetic identity as the odd one out. If a question says there is no identifiable consumer victim, the credit file is thin but growing, or a child's SSN is paired with an adult's name, the answer is synthetic identity fraud. Expect AI-generated faces and documents to appear in these scenarios.
Tip 4: For AI questions, remember amplification not invention. The exam frames AI as a tool that makes traditional schemes more convincing, personalised and scalable. If an option claims AI eliminates the need for social engineering or makes detection impossible, it is likely a distractor. The correct option usually describes AI improving the quality, speed or volume of phishing, impersonation, document forgery or biometric spoofing.
Tip 5: Know what each AI tool defeats. Voice cloning defeats voice authentication and call-back trust; deepfake video defeats remote KYC and video approvals; generative text defeats grammar-based phishing detection; SIM swapping (often paired with AI-assisted pretexting) defeats SMS one-time passcodes. Questions often ask which control is weakest against a given attack.
Tip 6: Choose the most robust control. When asked for the best preventive measure, prefer multi-layered, out-of-band or independent verification (call back on a known number, hardware MFA, liveness detection plus document checks, pre-agreed code words) over single-point controls such as caller ID, email domain inspection or voice recognition alone.
Tip 7: Watch for legal hooks. Pretexting for financial data violates the Gramm-Leach-Bliley Act; identity theft is a federal crime under the Identity Theft and Assumption Deterrence Act; the Fair and Accurate Credit Transactions Act and Red Flags Rule require certain creditors and financial institutions to have identity theft prevention programs. Questions sometimes combine a method with the relevant statute.
Tip 8: Read for the victim's perspective. Scenario questions about an individual discovering fraud typically test red flags and response steps (place fraud alert or credit freeze, file a police report and an FTC report, notify creditors). Scenario questions about a company test program design and detection analytics.
Tip 9: Eliminate absolutes. Answers containing always, never, impossible or guaranteed are rarely correct in this topic because identity theft methods and AI tools are constantly changing and no control is foolproof.
Tip 10: Practise mapping scenarios to terms. Before the exam, write out ten short scenarios (an email asking you to verify a password, a cloned CEO voice requesting a wire, a GAN-generated face on a loan application, a DNS redirect to a fake bank site) and label each with its method, lifecycle stage, enabling technology and best control. This mirrors exactly how the CFE Exam tests the subject.
9. One-Paragraph Summary
Identity theft is the wrongful acquisition of personal identifiers; identity fraud is their misuse through true name fraud, account takeover or synthetic identities, as well as medical, criminal, child, tax and business variants. Thieves obtain data through physical theft, insider leaks, social engineering (pretexting, phishing, vishing, smishing, pharming), technical attacks (malware, breaches, SIM swapping, credential stuffing) and open-source research. Artificial intelligence amplifies every one of these methods, producing flawless phishing, cloned voices, deepfake video, synthetic faces and forged documents that defeat traditional and biometric controls, while defensive AI in the form of behavioural biometrics, liveness detection and anomaly analytics provides the counterweight. For the exam, know the definitions precisely, classify methods by lifecycle stage, treat AI as an amplifier rather than a new scheme, and select layered, out-of-band controls as the best answer.
Test mode:
CFE - Identity Theft Methods and AI Tools Example Questions
Test your knowledge of Identity Theft Methods and AI Tools
Question 1
When an identity thief uses an AI voice-cloning tool to impersonate a trusted bank representative over the telephone and obtain a customer's account credentials, the technique is classified as smishing.
Question 2
Identity thieves use generative AI tools to write personalized phishing messages free of spelling and grammar errors, which weakens a red flag that recipients have traditionally relied on to spot phishing.
Question 3
A bank's contact center receives a call from someone whose voice passes the bank's voiceprint check for an existing customer. The caller correctly answers knowledge-based security questions using details the customer had posted publicly on social media. The caller then asks to update the registered phone number and email address. Days later, wire transfers drain the account. A fraud examiner reviewing the incident must classify how the identity was compromised. Which of the following BEST describes the method used?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Identity Theft Methods and AI Tools questions
19 questions (total)