Identity Theft Schemes

Why Identity Theft Schemes Matter on the CFE Exam

Identity theft is one of the fastest-growing categories of fraud worldwide and appears in the ACFE Certified Fraud Examiner (CFE) exam within the Financial Transactions and Fraud Schemes section, typically under consumer fraud and computer/internet fraud topics. The ACFE treats identity theft as both a stand-alone crime and an enabling crime: stolen identities are the raw material for credit card fraud, loan fraud, tax refund fraud, medical fraud, and money laundering through mule accounts. A fraud examiner who cannot recognize how identities are stolen, how they are monetized, and how victims and organizations detect the scheme will miss red flags in almost every other scheme category. Expect several questions on this topic, many of them scenario-based, asking you to classify a scheme, identify the data-acquisition method used, or select the best investigative or preventive response.

What Is Identity Theft?

The ACFE Fraud Examiners Manual describes identity theft as the wrongful acquisition and use of another person's (or entity's) personally identifiable information (PII) for fraudulent purposes, usually economic gain. PII includes items such as name, date of birth, Social Security or national identification number, driver's license number, passport number, account numbers, PINs and passwords, mother's maiden name, and biometric data. The key elements the exam expects you to remember are: (1) information is obtained without authorization, (2) the thief impersonates the victim, and (3) the impersonation is used to obtain money, goods, services, credit, employment, benefits, or to conceal the perpetrator's true identity.

Identity theft differs from simple credit card theft because the perpetrator assumes the victim's identity more broadly rather than merely using one stolen payment instrument. The exam frequently tests this distinction.

Who Commits Identity Theft?

Perpetrators fall into three broad groups you should be able to recognize:
- Acquaintances and insiders: family members, roommates, caregivers, coworkers, and household employees who have easy physical access to documents. Historically, a large share of victims knew the thief.
- Employee insiders at data-rich organizations: workers at banks, hospitals, government agencies, call centers, and retailers who sell or misuse customer records.
- Organized criminal groups and cyber criminals: rings that harvest data through breaches, malware, and phishing, then sell it on underground markets or use it at scale.

Major Categories of Identity Theft Schemes

1. True-Name Fraud (New Account Fraud)
The thief uses the victim's real identifying information to open new accounts: credit cards, cellular service, utilities, loans, or bank accounts. Because statements are sent to an address controlled by the thief, the victim often learns of the fraud only when denied credit or contacted by collectors. True-name fraud is generally the hardest type for victims to detect quickly and the most damaging to credit standing.

2. Account Takeover Fraud
The thief gains control of an existing account. Common methods include changing the mailing address or email on file, resetting passwords through compromised recovery questions, adding themselves as an authorized user, or executing a SIM swap to intercept one-time passcodes. Account takeover is usually detected faster because the legitimate owner eventually notices unauthorized transactions.

3. Synthetic Identity Theft
The perpetrator combines real and fabricated data, for example a genuine Social Security number (often a child's or deceased person's) paired with a fictitious name and date of birth, to create a brand-new identity that exists nowhere in reality. The thief builds a credit file over months or years, then busts out by maxing all credit lines and disappearing. Because there is no single real victim monitoring the file, synthetic identity fraud is frequently cited as the fastest-growing and hardest-to-detect form. Exam questions love this category.

4. Criminal Identity Theft
The thief provides the victim's name and identifiers to law enforcement when arrested or cited, so the criminal record attaches to the innocent victim.

5. Medical Identity Theft
The thief uses the victim's identity or insurance information to obtain medical treatment, prescription drugs, or to submit false insurance claims. Beyond financial harm, this can corrupt the victim's medical records with incorrect blood type, allergies, or diagnoses, creating physical danger.

6. Tax Refund and Government Benefits Identity Theft
The thief files a fraudulent tax return early in the filing season using the victim's identifiers to claim a refund, or applies for unemployment, disability, or other government benefits. Victims learn of it when their legitimate return is rejected as a duplicate.

7. Employment Identity Theft
The perpetrator uses someone else's Social Security number or work authorization to obtain employment, often leaving the victim with unreported income on their tax records.

8. Child Identity Theft
Children's identifiers are prized because the fraud can go undetected for a decade or more until the child first applies for credit. Often committed by relatives.

9. Business or Commercial Identity Theft
The thief impersonates a legitimate company to open trade credit, order goods, file fraudulent corporate documents with the state to change officers or addresses, or obtain loans. Business identity theft often exploits publicly available corporate registration information.

10. Identity Cloning and Concealment
The thief lives as the victim on a day-to-day basis, often to hide from creditors, immigration authorities, or law enforcement, rather than for an immediate financial score.

How Identity Thieves Obtain Information

The exam expects you to recognize both low-tech and high-tech acquisition methods:

Low-tech / physical methods
- Dumpster diving: retrieving discarded statements, pre-approved credit offers, and medical records from trash.
- Mail theft: stealing incoming mail (new cards, checks, statements) or outgoing mail containing payments.
- Change-of-address fraud: filing a fraudulent forwarding order so the victim's mail is diverted to the thief.
- Shoulder surfing: observing PINs, passwords, or card details in public.
- Theft of wallets, purses, laptops, and phones.
- Insider theft: employees copying or selling customer files.
- Pretexting: calling a bank, utility, or the victim under a false pretense to extract information.

High-tech / electronic methods
- Phishing: deceptive emails directing victims to fake websites to enter credentials.
- Spear phishing: phishing customized to a specific individual using known personal details.
- Vishing: phishing conducted by voice telephone call, often with spoofed caller ID.
- Smishing: phishing conducted through SMS text messages.
- Pharming: redirecting users from a legitimate website to a fraudulent one by poisoning DNS or altering host files, so the victim is compromised even when typing the correct address.
- Skimming: capturing magnetic stripe data with a hidden device on ATMs, fuel pumps, or handheld readers; often paired with pinhole cameras to capture PINs.
- Malware, spyware, and keyloggers: software that records keystrokes or harvests stored credentials.
- Data breaches: large-scale compromise of corporate or government databases, with data sold on the dark web.
- Social media mining: gathering birthdays, pet names, schools, and family names used in security questions.
- Public records and people-search sites: compiling data legally available in fragments.
- Wireless interception and unsecured Wi-Fi: capturing traffic on public networks.

How the Stolen Identity Is Monetized

Once information is obtained, perpetrators typically: open new credit or loan accounts; make unauthorized purchases; drain bank accounts via wire or ACH; file fraudulent tax returns; obtain medical care or prescriptions; rent apartments or obtain utilities; take out insurance policies; obtain employment; create mule accounts to launder proceeds; or sell the data to other criminals. In synthetic schemes, the thief deliberately nurtures the identity, making small on-time payments to build credit limits before the bust-out.

Red Flags and Victim Indicators

Fraud examiners should recognize these warning signs:
- Unexplained charges, withdrawals, or accounts on statements or credit reports.
- Denial of credit or unexpectedly high interest rates.
- Calls or letters from debt collectors about unfamiliar debts.
- Bills or statements that stop arriving (possible address diversion).
- Bills, cards, or welcome letters for accounts never opened.
- Tax return rejected as a duplicate, or IRS notices about unreported income.
- Medical bills, Explanation of Benefits statements, or insurance denials for services never received.
- Notification that information was exposed in a data breach.
- Inquiries on a credit report from unfamiliar lenders.
- A child receiving pre-approved credit offers or collection notices.

Red flags for organizations (Red Flags Rule categories)
- Alerts or freezes on a consumer report.
- Suspicious documents: altered IDs, photographs inconsistent with the applicant.
- Suspicious PII: SSN that does not match date of birth, address matching a known fraud address, phone number belonging to a pager or answering service.
- Unusual account activity: address change followed quickly by request for new cards or added users, inactive account suddenly active, mail returned as undeliverable while transactions continue.
- Notice from customers, victims, or law enforcement.

Key Legal Framework (United States Focus Commonly Tested)

- Identity Theft and Assumption Deterrence Act of 1998: made identity theft a federal crime in its own right (18 U.S.C. 1028), recognized the individual whose identity was stolen as a true victim (previously only the creditor was considered the victim), and designated the Federal Trade Commission (FTC) as the central point for complaints and consumer assistance.
- Identity Theft Penalty Enhancement Act of 2004: created the offense of aggravated identity theft, adding mandatory consecutive prison terms when identity theft is committed in connection with certain felonies, including terrorism-related offenses.
- Fair and Accurate Credit Transactions Act (FACTA) of 2003: amended the Fair Credit Reporting Act (FCRA) to give consumers one free credit report annually from each nationwide bureau, the right to place fraud alerts and active-duty alerts, truncation of card numbers on receipts, the right to block fraudulent information from credit reports with an identity theft report, and the Red Flags Rule requiring financial institutions and creditors to maintain written identity theft prevention programs.
- Gramm-Leach-Bliley Act: requires financial institutions to safeguard customer information and prohibits pretexting to obtain financial information.
- HIPAA: protects health information and is relevant to medical identity theft.
- Many jurisdictions also have data breach notification laws and credit freeze statutes. Outside the US, examiners should know the general principles rather than specific statutes, though the exam leans toward the US framework described in the Fraud Examiners Manual.

Prevention and Response Measures

For individuals
- Shred documents containing PII; opt out of pre-screened credit offers.
- Review credit reports regularly; place a credit freeze (the strongest tool, blocking new credit without the consumer's PIN) or a fraud alert (requires creditors to take extra verification steps).
- Use strong, unique passwords and multi-factor authentication; be skeptical of unsolicited requests for information.
- Secure mail, use a locking mailbox, and promptly collect deliveries.
- Limit information shared on social media.
- Monitor Explanation of Benefits statements for medical identity theft.

For victims after the fact
- Contact affected creditors immediately and close compromised accounts.
- Place a fraud alert or freeze with the credit bureaus.
- File a report with the FTC (IdentityTheft.gov) and obtain an identity theft report.
- File a police report, which supports disputes with creditors and bureaus.
- Dispute fraudulent entries with credit bureaus in writing and keep a detailed log of all communications.
- For tax identity theft, submit an identity theft affidavit to the tax authority.

For organizations
- Implement a Red Flags identity theft prevention program with written procedures, employee training, and board oversight.
- Minimize data collection and retention; encrypt stored and transmitted PII.
- Apply strict access controls, segregation of duties, and activity logging for customer data.
- Screen and monitor employees with access to sensitive records.
- Verify identity at account opening and before address or contact changes, especially when followed by card replacement requests.
- Secure disposal of paper and electronic media.

Investigating Identity Theft

A fraud examiner investigating an identity theft case typically will:
1. Interview the victim to establish a timeline, determine what information was compromised, and identify who had access (family, employers, recent service providers, lost documents).
2. Obtain the victim's credit reports and identify every fraudulent account and inquiry.
3. Request account-opening records from each creditor: applications, IP addresses, phone numbers, delivery addresses, and transaction histories.
4. Analyze common data points across fraudulent accounts (shared addresses, phone numbers, email addresses, devices) to link cases and identify the perpetrator.
5. Coordinate with law enforcement and the credit bureaus; identity theft frequently crosses jurisdictions.
6. Preserve digital evidence properly, including email headers in phishing cases and device images in malware cases.
7. Document everything, because victims need evidence to clear their records and prosecutors need it to prove intent.

Exam Tips: Answering Questions on Identity Theft Schemes

Tip 1: Classify the scheme by what happened to the account. If the thief opened something new in the victim's real name, it is true-name or new account fraud. If the thief seized control of something that already existed, it is account takeover. If the identity is a mixture of real and invented data, it is synthetic identity theft. Many questions hinge solely on this classification.

Tip 2: Memorize the phishing family precisely. Phishing = email; spear phishing = targeted email; vishing = voice/phone; smishing = SMS text; pharming = redirection via DNS poisoning or host file alteration, requiring no click on a malicious link. Questions often describe the method and ask you to name it, or name the method and ask what distinguishes it.

Tip 3: Know why synthetic identity theft is uniquely dangerous. The correct answer typically emphasizes that there is no real victim monitoring the credit file, so detection is delayed and losses are absorbed by lenders. Children's and deceased persons' SSNs are favored because they are unused.

Tip 4: Distinguish a fraud alert from a credit freeze. A fraud alert flags the file and requires creditors to take reasonable extra steps to verify identity; a credit freeze actually blocks access to the credit report so new credit generally cannot be opened until lifted. If a question asks for the most effective protection against new account fraud, the freeze is the stronger answer.

Tip 5: Recognize the Red Flags Rule categories. Alerts from consumer reporting agencies, suspicious documents, suspicious personal identifying information, unusual account activity, and notices from customers or law enforcement. Questions may present a fact pattern (an address change followed immediately by a request for additional cards) and ask which red flag category it represents or what the institution should do.

Tip 6: Remember who the law treats as the victim. Before the 1998 Act, only the defrauded creditor was legally the victim. The Act recognized the individual whose identity was misused as a victim and gave the FTC the complaint clearinghouse role. The 2004 Act added aggravated identity theft with enhanced mandatory penalties. FACTA added free annual credit reports, fraud alerts, receipt truncation, and the Red Flags Rule.

Tip 7: Watch for the low-tech trap. Many candidates assume identity theft is always a cyber crime. The exam often includes dumpster diving, mail theft, change-of-address fraud, pretexting, and insider theft as correct answers. Read the scenario for physical access clues.

Tip 8: Understand medical identity theft's special harm. If a question asks why medical identity theft is particularly serious beyond financial loss, the answer involves corrupted medical records that can lead to incorrect treatment, plus difficulty correcting records due to privacy rules.

Tip 9: Sequence the victim's response correctly. Typical best-practice ordering: contact creditors and close compromised accounts, place a fraud alert or freeze with the bureaus, file a report with the FTC, file a police report, and dispute entries in writing. If asked for the first step, stopping ongoing loss by contacting the affected creditors or the bureaus is usually preferred over purely documentary steps.

Tip 10: Think like an investigator on process questions. When asked how to identify the perpetrator, favor answers that involve obtaining account-opening records from creditors and correlating shared data elements (addresses, phone numbers, IP addresses, devices) across fraudulent accounts, and interviewing the victim about who had access. Avoid answers that skip documentation or ignore legal process for obtaining third-party records.

Tip 11: Eliminate absolute language. Options stating that identity theft is always committed by strangers, always detected quickly, or only involves credit cards are almost always wrong. The ACFE emphasizes that acquaintances and insiders are frequent perpetrators and that detection often takes months.

Tip 12: Tie identity theft to other scheme categories. The exam may embed identity theft inside a credit card fraud, loan fraud, tax fraud, or money laundering question. Ask yourself whether the core wrongdoing is impersonation of a real or fabricated person; if so, apply identity theft principles even if the question is framed differently.

Quick Review Summary
- Identity theft = unauthorized acquisition and use of PII to impersonate for gain.
- Main types: true-name/new account, account takeover, synthetic, criminal, medical, tax/benefits, employment, child, business, cloning.
- Acquisition methods range from dumpster diving and mail theft to phishing variants, skimming, malware, and data breaches.
- Red flags: unfamiliar accounts, collection calls, missing mail, duplicate tax filings, unexplained medical bills, suspicious address changes.
- Key laws: 1998 Identity Theft and Assumption Deterrence Act, 2004 Penalty Enhancement Act (aggravated identity theft), FACTA 2003 (free reports, fraud alerts, Red Flags Rule), GLBA, HIPAA.
- Prevention: shredding, monitoring, freezes and alerts, MFA, Red Flags programs, data minimization, employee controls.
- Investigation: victim interview, credit reports, creditor records, data correlation, law enforcement coordination, thorough documentation.

Master these distinctions and you will be well prepared for any identity theft question the CFE exam presents.