Identity theft is not limited to someone stealing a physical identity document.
In cybersecurity, identity theft can involve the misuse of personal information, account credentials or other identifying data to impersonate a person, open or access accounts, make transactions, or commit fraud in that person’s name.
The important thing is to understand that identity theft is usually a chain of events. Information may be exposed in a breach, collected through phishing, stolen from a compromised device, guessed from public information, or obtained through a scam. The attacker then combines that information with an account, transaction or service where the identity has value.
What does identity theft actually mean?
Identity theft happens when someone uses identifying information belonging to another person without permission for an unlawful or fraudulent purpose.
Depending on the situation, the stolen information may include:
- name and address;
- phone number;
- email address;
- identity-document details;
- account usernames and passwords;
- payment-card information;
- bank-account information;
- one-time authentication codes;
- copies of documents;
- answers to identity-verification questions.
Not every exposed piece of information is enough to commit identity theft by itself. The risk depends on what an attacker can combine and what controls the targeted service requires.
That distinction is important. A leaked phone number is not automatically equivalent to a compromised bank account.
How identity theft can begin
There are many entry points.
Phishing and impersonation
A convincing message can trick someone into providing a password, card detail, OTP or document.
The Central Bank of Sri Lanka warns that fake links, impersonation and requests for confidential banking information are used in scams, and advises people to verify communications through official channels. citeturn2search0turn2search5
Data breaches
A breach can expose information held by a company or service.
The attacker may not immediately use every item. Stolen information can be combined with data from other sources or used later in targeted scams.
Malware and compromised devices
Malicious software can steal browser credentials, session information or other personal data.
In this situation, changing one password may not be enough if the device remains compromised.
Oversharing and public information
Public social-media profiles can reveal names, relationships, workplaces, birthdays, travel patterns and other information useful for impersonation or social engineering.
Public information is not automatically dangerous. The problem is when enough details are combined to make a targeted deception more convincing.
Fake forms and websites
A fraudulent website can ask for personal details while pretending to be a bank, delivery company, employer or government service.
The site may never need to technically compromise the real organisation. It only needs to persuade the victim to hand over useful information.
Identity theft and account takeover are related, but not identical
These terms are sometimes used interchangeably.
Identity theft is about misuse of another person’s identifying information.
Account takeover is about an attacker gaining control of an existing account.
They can overlap.
For example, an attacker may steal a password and take over an email account. They may then use information inside that account to impersonate the victim elsewhere.
Conversely, identity information can be misused without taking over an existing online account.
Thinking in terms of the entire identity chain helps defenders avoid protecting only one login.
Why email is especially important
Email often connects many other accounts.
If an attacker controls an email account, they may be able to:
- receive password-reset messages;
- read private conversations;
- discover account numbers and documents;
- impersonate the victim;
- access other services through recovery mechanisms.
That makes the primary email account a high-value security boundary.
Use a unique strong password, MFA or a passkey where available, and review account recovery methods.
The danger of reused passwords
Suppose the same password is used for an online forum, email account and financial service.
If the forum suffers a breach and the password is exposed, an attacker can try the same credentials elsewhere.
This is credential stuffing, and it can turn a relatively small breach into a much larger identity problem.
Use a different password for every important account. A password manager makes this practical.
See How Passwords Are Cracked and Password Managers Explained for the technical side.
Why OTPs should never be treated as ordinary information
One-time passwords are designed to prove possession of an authenticator during a particular authentication or transaction flow.
If an attacker asks for the OTP that just arrived on your phone, they may be trying to complete an action that they initiated.
The Central Bank of Sri Lanka specifically warns the public not to share OTPs, PINs, passwords or other confidential banking information with third parties. citeturn2search5
A useful rule is simple:
If someone contacts you and asks you to tell them an authentication code, stop and verify the request through the organisation’s official channel.
How identity theft can become financial fraud
An attacker may use stolen information to make purchases, access accounts, create fraudulent applications or convince another person that they are the victim.
The Central Bank’s current public awareness campaign describes digital intrusions, impersonation and other tactics used to obtain money or personal information. citeturn2search0
Sri Lanka’s national cybersecurity strategy also records financial scams, phishing, data breaches and account-related incidents among the country’s reported cyber risks. These figures describe reported incidents, not the total amount of crime, and the strategy notes limitations in national data collection. citeturn2search36
The practical lesson is not that every exposed detail leads to financial loss. It is that identity information can become valuable when combined with authentication and social-engineering attacks.
Signs that your identity or accounts may be misused
Watch for:
- password-reset emails you did not request;
- login alerts from unfamiliar devices or locations;
- unexpected transactions;
- unfamiliar account openings or service registrations;
- messages sent from your account that you did not write;
- calls about debts, purchases or services you do not recognise;
- changes to account recovery information;
- friends reporting suspicious messages from your account.
One sign does not prove identity theft. It is a reason to investigate promptly.
What to do if you suspect identity theft
Start by containing the affected accounts.
1. Secure the primary email account
If you still control it, change the password to a new unique one and enable strong MFA.
Review recovery email addresses, phone numbers, active sessions and connected applications.
2. Secure financial accounts
Contact the bank or payment provider through an official channel, especially if there are unauthorised transactions or exposed credentials.
Do not use contact details supplied by the suspicious message.
For Sri Lankan financial scams, the Central Bank advises people to contact their relevant financial institution promptly and provides public reporting information through its Be Scam Proof initiative. citeturn2search0
3. Preserve evidence
Keep:
- suspicious emails and messages;
- transaction references;
- screenshots where useful;
- dates and times;
- phone numbers and account details involved;
- relevant URLs.
Do not alter evidence unnecessarily.
4. Check other accounts
Look for password resets, unfamiliar sessions and suspicious activity on other services.
If a password was reused, change it everywhere it was used.
5. Report through the appropriate channel
The correct reporting path depends on the incident and country.
Sri Lanka CERT provides an incident-reporting portal and advises that social-media incidents and personal financial fraud or scams should be submitted through its official reporting route rather than the general CERT email address. citeturn2search7
The Sri Lanka Police has also advised the public to report online fraud to the relevant police and Computer Crime Investigation Division channels. citeturn2search39
For readers outside Sri Lanka, use the relevant national cybercrime, police, financial-regulator and affected-service reporting channels.
What not to do after a suspected compromise
Avoid:
- responding to the suspected attacker;
- sending additional identity documents just because someone asks;
- clicking links in follow-up messages;
- using a contact number supplied by the suspicious message;
- deleting evidence before recording what happened;
- assuming one password change fixed every affected account.
The recovery process should be based on the actual attack path.
Reduce identity-theft risk before anything happens
A practical baseline is:
- Use unique passwords for important accounts.
- Use a password manager.
- Enable MFA or passkeys where available.
- Protect the primary email account carefully.
- Keep operating systems, browsers and apps updated.
- Treat unexpected links and attachments cautiously.
- Do not share OTPs, PINs or passwords with callers or chat contacts.
- Review important account alerts.
- Minimise unnecessary public personal information.
- Check financial and account activity regularly.
Protect identity documents too
Identity documents can be useful to legitimate organisations, but a copy should not be treated as harmless.
When a service genuinely needs an identity document:
- verify the organisation first;
- understand why it is required;
- use the organisation’s official submission method;
- avoid sending documents through an unverified contact;
- keep records of where sensitive documents were submitted when appropriate.
Do not add unnecessary personal information to a document just for convenience.
A useful threat model for ordinary people
You do not need a complex security framework to think about identity theft.
Ask four questions:
What information could an attacker obtain?
Think about passwords, documents, phone numbers, email, financial details and public information.
What could they do with it?
Could they access an account, impersonate you, make a transaction or convince another person?
What control would stop that action?
MFA, approval, transaction limits, identity verification or a manual callback may break the chain.
Would I notice quickly?
Security alerts and regular account review reduce the time an attacker can operate unnoticed.
This approach turns a vague fear of “identity theft” into concrete controls.
Identity protection is a system, not one setting
No single privacy setting prevents identity theft.
A strong defence combines:
- secure authentication;
- unique credentials;
- device security;
- careful handling of personal information;
- transaction monitoring;
- independent verification;
- account recovery protection;
- fast incident response.
The goal is to make identity information less useful to an attacker and make suspicious activity easier to detect.
The practical conclusion
Identity theft often starts with something ordinary: a reused password, a convincing message, a compromised database, an exposed document or a fraudulent phone call.
The solution is not to assume that every piece of personal information must remain secret forever. It is to protect high-value information, strengthen the accounts that depend on it, verify unusual requests independently and respond quickly when something looks wrong.
For most people, the highest-value steps are straightforward: protect your main email account, use unique passwords, enable strong authentication, avoid sharing OTPs or passwords, verify financial requests independently and know how to report an incident.