Blank slates: Child identity theft is a repository for cyber criminals

Child identity theft can remain undetected for years, covertly eroding victims’ financial and educational futures. Fraud Magazine delves into how perpetrators prey on these vulnerable victims, factors contributing to the magnitude of the problem, and what’s involved in prevention and recovery.

EDITOR’S NOTE — This story includes discussion of suicide. If you or someone you know needs help, the national suicide and crisis lifeline in the U.S. is available by calling or texting 988. There’s also an online chat at 988lifeline.org.

At just 6 years old Renata Galvão had amassed more than $400,000 in debt. She had no idea of the catastrophic damage that had been done to her once pristine, unblemished credit record until she was 18 years old. Galvão eventually learned that a family member pressured her mother into disclosing Galvão’s personally identifiable information (PII) and used it to create numerous shell companies, open bank accounts, access credit and secure loans — all in her name. The scheme, which persisted for decades, destroyed her financial future and credit rating. She spent decades working to restore her financial health and take back her identity.

Today, Galvão is a child identity theft protection advocate, campaigning for regulations that safeguard minors’ PII. She works as a risk and compliance professional for U.K.-based LSEG Risk Intelligence and stars in the short documentary “One in Fifty.” The film’s title refers to a 2021 statistic that indicates approximately 1.25 million children globally — one in 50 — were victims of identity theft between 2021 and 2022.

In the documentary, Galvão, who was born in Brazil in 1990, emotionally recounts how identity theft followed her into adulthood, contributing to feelings of shame and a “need to hide something.”

“I grew up with that feeling of not being able to really build my identity because something was already decided for me. I couldn’t have anything in my name because otherwise it would be taken from me,” she recalls in the film. “I felt I needed to hide my story because otherwise people wouldn’t trust me.”

She says her family home was inundated with mail addressed to her from the government and financial institutions shortly after her mother took her to register with the Instituto Nacional do Seguro Social (INSS), Brazil’s social security system, when she was 5 years old. “Then things got out of control,” she explains in the film. Debt collectors frequently came to her childhood home and took electronics and furniture as payment.

The emotional fallout from having her identity stolen had a devastating impact on Galvão, who says she had severe depression around age 12. Galvão started seeing a therapist and took medication to combat feelings of suicide. “I didn’t want to live for a while. It’s hard to talk about it,” she recalls in the documentary.

The financial damage Galvão endured tarnished her name and prohibited her from opening utilities and bank accounts, securing housing, obtaining student loans, or passing background checks in Brazil. In search of a fresh start and a clean slate, Galvão moved to South Africa and worked as a journalist for a Brazilian news outlet before becoming a research analyst. On the job she learned how to research criminal cases and access court filings. Galvão says in “One in Fifty” that she began to understand what had happened to her and to use her newfound skills to erase the black mark that identity fraud left on her name.

“My name in Brazil was finally cleared when I was 28,” she recounts in the documentary. “I fought too hard for my name to be clear and done. And I’m proud of my story. It was a difficult one, a complicated one, but I’m proud of it. It’s who I am. And I want to be able to build my name and my identity the way I wanted because growing up, I wasn’t able to.”

Galvão’s story underscores the growing problem of child identity theft, a crime that often goes undetected for years and inflicts tremendous harm on its victims, often destroying their sense of security, robbing them of financial independence and curtailing their educational opportunities. Victims average only 8 years old. In the past six years, data breaches have been responsible for exposing the PII of one in eight U.S. children, according to a 2024 report by research firm Javelin. In the past year, one in 43 (1.7 million) U.S. children has had PII stolen in a breach. This article examines the methods fraudsters use to perpetrate child identity theft, habits and trends that make children vulnerable to this form of fraud, challenges facing fraud examiners who investigate synthetic identity fraud, and recommended prevention and recovery measures.

A note about data

Much of the available data related to child identity theft is from the U.S. With its extensive credit infrastructure, early issuance of Social Security numbers (SSNs) and robust consumer credit reporting system, the U.S. has a vast amount of information and statistics on the crime compared to other countries. Not all countries have readily accessible credit histories for minors, and some don’t issue government identification numbers to children before they reach the age of 16. These varying legal and administrative structures affect how countries measure child identity theft. Therefore, most of the data in this article focuses on child identity theft in the U.S.

How it’s done: Synthetic identity fraud

An examination of child identity theft is incomplete without the inclusion of synthetic identity fraud, one of the fastest growing financial crimes in the world and identity thieves’ tactic of choice. By 2030, synthetic identity fraud will generate at least $23 billion in losses in the U.S. alone, according to estimates from the Deloitte Center for Financial Services. Because children often have no existing credit files, they’re perfect targets for synthetic identity theft, according to Steve Lenderman, CFE, head of fraud prevention at isolved. “Fraudsters typically use a variation of the child’s name and alter the date of birth, creating a manipulated identity that appears legitimate from an identity verification standpoint, but is synthetic from a financial perspective,” he explains to Fraud Magazine.

Entrust Cybersecurity Institute’s 2025 Identity Fraud Report identifies three common methods that fraudsters use to create synthetic identities.

1. Identity manipulation: Fraudsters slightly adjust authentic PII to create a new fake identity. For example, fraudsters alter a date of birth or a name on a driver’s license. 
2. Identity compilation: Fraudsters compile authentic and fabricated PII to form a new identity. For example, fraudsters combine a real government identification number with a fabricated birth certificate.
3. Identity fabrication: Fraudsters create a new identity without using any authentic PII. For example, fraudsters create an identity document with fabricated information, combined with an artificial-intelligence-generated deepfake.

One way that cyber criminals use deepfakes in synthetic identity theft is to bypass biometric verification. A Group-IB investigation revealed that more than 1,100 deepfake fraud attempts were made to bypass biometric verification systems at a major Indonesian financial institution. Attackers used AI-altered ID photos to fool facial recognition and liveness detection systems. Deepfakes are also used to impersonate trusted individuals in video or audio to manipulate victims into taking harmful actions. In a high-profile case, a U.K. energy firm lost €220,000 after a deepfake voice impersonated a company executive during a phone call.

Regardless of the method used to create a synthetic identity, parents and victims often learn of identity theft when debt or credit activity appears on a child’s credit report. The long-term damage done by identity theft may include unpaid debts, ruined credit and legal complications. You can order your child’s credit report from Experian, TransUnion and Equifax. [See “Is your child the victim of identity theft?” at the end of this article.]

Fraudsters have access to a treasure trove of PII, much of which is attributable to recent large-scale data breaches, which have “flooded the black market with child identities,” Lenderman says. “Health care and education sectors — where children’s data is often stored — are frequent targets of breaches.”

Christopher DeAngelis, CFE, vice president of enterprise fraud strategy and prevention at Zelis, says criminals often use synthetic identities to open credit cards, take out loans, buy cars and file fraudulent tax returns. “The first attempts may get denied, but those denials still create a file with the credit bureaus,” he explains. “With persistence, they may secure small lines of credit or authorized user status on another account. Over months or years, they nurture that profile until it looks legitimate. Once established, fraudsters ‘bust out’ by maxing out cards or loans before disappearing.”

Lenderman says fraud examiners shouldn’t underestimate the scope of synthetic identity fraud, adding that most cases today stem from organized criminal groups operating on a grand scale. “This isn’t about a lone teenager in a hoodie anymore; the landscape has shifted,” he says. “Sophisticated networks are leveraging breached data, automation and AI [artificial intelligence] to manufacture synthetic identities with precision and volume, making detection and prevention far more complex.”

Fraudsters now use advanced tools, including unregulated AI models, to generate convincing synthetic profiles at scale that bypass traditional verification systems. “The rise of AI has significantly lowered the barrier to entry for fraudsters,” Lenderman says.

The Federal Reserve’s white paper, Protecting Your Kids from Synthetic Identity Fraud, informs parents about proactively reducing their children’s risk of becoming synthetic identity fraud victims. The Federal Reserve’s synthetic identity fraud mitigation toolkit offers resources for financial institutions, businesses and individuals. The toolkit walks through detecting a synthetic identity, how criminals use synthetic identities, how technology enhances fraud detection, validating identities and more.

“A synthetic identity built from a child’s information can persist undetected for years,” Lenderman warns. “The reason synthetic identity fraud is so effective is that there’s no clear ‘human’ victim to raise a complaint. While using a child’s identity increases the chance of eventual detection, it rarely happens until the child begins engaging with financial systems. The lack of monitoring, combined with the delayed use of a child’s SSN, creates a long runway for fraud to go unnoticed.”

Challenges for fraud examiners

Among the challenges limiting fraud examiners’ ability to investigate synthetic identity fraud is SSN randomization, implemented by the U.S. Social Security Administration in 2011. Randomization makes it “harder for investigators to detect inconsistencies between birth dates and issuance patterns,” according to Lenderman. “This helps fraudsters avoid detection when fabricating synthetic profiles.” Fraudsters’ ability to create hundreds of synthetic identities at once makes this form of identity fraud “low risk and high reward,” DeAngelis says.

Synthetic identity theft is easy for criminals to perpetrate and “doesn’t take a lot of work like other financial frauds,” Lenderman adds. The probability of getting caught is low. Many states lack specific legislation addressing synthetic identities, and federal laws don’t explicitly cover them. “As a result, prosecutors often must rely on creative legal strategies, charging offenders under broader statutes like wire fraud or false documentation. Compounding the issue, most law enforcement agencies are not adequately trained to recognize or investigate synthetic identity fraud,” Lenderman tells Fraud Magazine.

The gap between detection and enforcement is significant when dealing with synthetic identities, which Lenderman says “look legitimate on paper, especially to automated systems that rely on credit history length, payment behavior and account diversity.” He adds that traditional red flags, such as lack of digital breadcrumbs, no familial or social connections, or unusual application patterns, slip past detection “because financial institutions view identity data in isolation rather than holistically.”

Financial institutions can play a significant role in helping combat child identity theft. “Too often, financial institutions evaluate identity data in isolation, missing the broader context. But synthetic identity fraud is rarely a stand-alone issue; it’s part of a larger, interconnected ecosystem. When we zoom out and examine the patterns holistically, the connections become much clearer,” Lenderman explains.

To make a meaningful contribution to the fight against child identity theft, DeAngelis advocates that financial institutions take a multipronged approach that encompasses technology, data sharing and consumer education. For instance, banks could implement robust identity verification tools that flag discrepancies in age-appropriate patterns. Sharing intelligence across institutions could aid in identifying fraud rings that abuse children’s SSNs. Banks and credit unions could inform parents about credit freezes, monitoring tools and the signs of child identity theft, he adds.

Habits that make children prime targets

Younger generations’ heavy involvement in social media provides fraudsters with easier access to their PII. Within the past six years, 96% of child identity fraud victims in the U.S. were active on social media when their identities were compromised, according to a recent child identity theft white paper published by Javelin. These victims subsequently lost money due to fraud.

And the way children conduct themselves online plays a role in child identity theft, according to Amy Nofziger, CFE, senior director of fraud victim support at AARP. She oversees the older adults’ advocacy group’s Fraud Watch Network Helpline (877-908-3360), which is available to everyone regardless of age or membership status. The helpline handles approximately 400 calls daily from fraud victims.

Missteps that lead children and teenagers to inadvertently divulge too much information on social media platforms and gaming sites can have dire consequences. “Children may unknowingly share too much … such as their full name, birth date, school name or even photos that reveal location details. These bits of information can be pieced together to commit identity theft,” Nofziger tells Fraud Magazine.

According to the white paper by Javelin, children from higher-income households (annual income exceeding $100,000) are most likely to be child identity theft victims. In fact, 58% of U.S. children victimized by identity theft come from affluent economic backgrounds.

Once they have the necessary information, it’s not unusual for cyber criminals to take over victims’ email accounts. Sixty-three percent of children whose identities were compromised also experienced an email account takeover. Children from affluent households often have access to and use their parents’ peer-to-peer accounts, such as Venmo, Zelle or CashApp, which are also frequent takeover targets. [See “What to do if your child is a victim of identity theft” at the end of this article.]

Familial fraud: The ultimate betrayal

Familial fraud (use of one’s personal information by a family member without permission for financial gain or another purpose) is common in cases of child identity theft. Data from Javelin shows that 73% of U.S. child identity theft victims know their perpetrators. The report breaks down the data by the perpetrator’s relationship with the victim. The perpetrator was a parent or stepparent in 35% of cases, a family friend in 29% of cases, a sibling in 11% of cases or another relative in 5% of cases.

Galvão addresses her betrayal by a family member in “One in Fifty.” When speaking of her mother’s role in her identity theft, she emphasizes that she doesn’t blame her. “She was coerced and told something that ultimately ended up not being true. I think that she blames herself a lot, but it wasn’t her fault. She was also a victim,” Galvão explains to viewers.

Axton Betz‑Hamilton shared her story of familial fraud with Fortune last year. She learned of her sullied credit score at age 19 when she attempted to pay a security deposit to set up utilities. Her abysmal credit score prevented her from opening the account. She ordered a copy of her credit report, which totaled 10 pages and listed fraudulent purchases she supposedly made starting at age 11.

After her mother died in 2013, Betz‑Hamilton’s father found a credit card statement in her name from 2001 among her mother’s records. Further investigation by Betz‑Hamilton and her father revealed that her mother not only stole her identity but those of Betz‑Hamilton’s father and grandfather. Familial fraud had a lasting impact on her family.

“That moment of discovery, it was like experiencing two extreme emotions,” Betz-Hamilton told Fortune. “As someone who’d been living with identity theft for 20 years and not knowing who was responsible, it was like, wow, we figured out who did it finally, and we don’t have to live like this anymore — but then it’s like: it’s mom, really? It’s mom.”

According to Nofziger, many of the cases of child identity theft reported to the AARP’s helpline involve familial fraud. “The person reporting the incident often shares that the perpetrator is struggling with substance abuse and is opening lines of credit to support their addiction,” she tells Fraud Magazine.

Nofziger says the “significant breach of trust” caused by familial fraud leaves victims and their families feeling “deeply violated and often scared by the possibility that someone they know may have caused harm to their child and family.” Parents and grandparents dealing with identity theft involving minors are commonly reluctant to file a police report against a loved one, according to Nofziger. She says helpline staff members approach familial fraud cases with “compassionate, nonjudgmental support.”

“We share all the necessary information and resources — how to report the theft, protect the child’s credit and monitor for further misuse. But ultimately, we empower the caller to make the decision that feels right for their situation. Our role is to guide, not pressure,” she explains.

When the perpetrator of child identity theft is a family member, DeAngelis recommends prioritizing the child’s future and filing a report, “even if it feels uncomfortable or creates an awkward situation.” The Federal Trade Commission (FTC) allows victims to file fraud reports anonymously.

The hidden dangers of ‘sharenting’

One of the many ways fraudsters gather premium PII on children is by scouring social media platforms. Posts, messages, photos and videos are rife with priceless details — home addresses, birthplaces, mothers’ maiden names, schools, the names of pets, favorite sports teams — fraudsters can use to steal a child’s identity. “Sharenting” is the new, trendy name for the practice of parents posting photos, videos and updates about their children on social media. Sharing information about their children with family and friends online may seem harmless to many well-meaning parents. But cybersecurity experts warn that the rich repository of minors’ personal data inadvertently being advertised is catnip for identity thieves. “Parents don’t always realize that oversharing online (birthdays, full names, hometowns) can provide fraudsters with the pieces needed to construct synthetic identities,” DeAngelis says.

A study by Barclays Bank predicts that sharenting will account for two-thirds of child identity theft by 2030. Moreover, the U.K. bank says fraud due to sharenting will cost $911 million per year and produce 7.4 million annual incidents of identity fraud just five years from now.

“Our growing tendency to share personal information, often voluntarily or unknowingly, through our digital and social footprints” contributes to the sheer volume of PII exposed online, according to Lenderman. “As long as sensitive data remains accessible and unprotected, the cycle of exploitation will persist.”

Prioritizing prevention

Child identity theft comes at a high price, costing a U.S. family more than $1,000 on average, according to a 2021 report. Estimated fraud losses linked to child identity fraud totaled $918 million in the 12-month period studied. Child identity theft isn’t going anywhere anytime soon. DeAngelis says several factors may contribute to an increase in child identity theft in the coming years, including children’s expanding digital profiles and the associated data points fraudsters can exploit. Data breaches on the dark web and via messaging apps Signal and Telegram provide fraudsters with a plethora of PII, including children’s government IDs. Lending legitimacy to stolen and synthetic identities has never been easier for fraudsters, thanks to emerging technologies, such as AI-driven bots and deepfakes, he explains.

In a digital environment fueling child identity theft rather than thwarting it, prevention is more important than ever. “Ultimately, the best defense against identity theft is you,” Lenderman advises. “Proactive vigilance and smart data habits remain your strongest line of defense.”

Many financial institutions recommend that parents invest in an identity protection service (LifeLock, Aura, IDShield) family plan to fight identity theft and subsequent privacy and cybersecurity risks. But Lenderman cautions these services don’t offer effective preventive measures, adding, “Once your data is exposed or misused, it’s already too late.” DeAngelis says family plans purchased from an identity protection service company are helpful in alerting parents to suspicious activity tied to their child’s identity. Despite their ability to aid in detecting identity theft, few parents (5%) reported having an identity protection service plan before child identity theft occurred, according to data from Javelin. Parents took a more reactive approach, with 95% reporting that they enrolled in an identity protection service after their child’s identity had been stolen.

To protect his son (who’s now 23 years old) from identity theft, Lenderman says he froze his credit reports when he was younger and monitored his SSN regularly. “I also added him as an authorized user on my credit card accounts, which helped establish his financial identity and build a positive credit history,” Lenderman recalls.

DeAngelis says safeguarding the identities of his three children — ages 13, 17 and 22 — has always been a priority. In addition to adding his children as authorized users on his credit card and freezing their credit reports, he keeps their SSN cards locked in a secure place and never provides their numbers unless necessary. And he limits their digital footprint “to help build a shield around their information so fraudsters don’t have easy access.”

Acknowledging that he can’t make his children invisible online, DeAngelis says his goal as a parent is to minimize their PII exposure. “For photos or events involving our kids that my wife and I or our immediate family might share online, we stick to our social media accounts or photo-sharing apps that we know limit access only to the family or friends we allow. Video game and education accounts are set up using a parent’s name and email address,” he says.

Both DeAngelis and Lenderman have taught their children about the risks of divulging PII and the steps they can take to protect it. Lenderman says he gave his son a digital tour through some underground markets to illustrate how easily his gaming data and personal photos could be accessed and misused. “That made it real for him. Most of the time he’s vigilant. He reaches out occasionally to help his friends navigate identity issues when they come up. That’s a great feeling, to know he’s not only aware but also passing that awareness on,” Lenderman says.

Nofziger, the mother of two boys ages 17 and 21, says that she tries to empower them to “be voices of awareness within their own circles” because “teens tend to listen to each other more than adults sometimes.” And she’s made educating them about online safety a priority, warning them to “be cautious of anyone on social media or gaming platforms asking for personal details, especially things like SSNs or login credentials.”

Through her work with AARP, she reminds parents to listen to their children. “We’re all busy, but if your child suddenly asks, ‘What’s my SSN?’ ask why. Most kids don’t need that information, so it’s important to understand what prompted the question. That moment of curiosity could be your first clue that something’s not right,” she advises.

Road to recovery

Preventing child identity theft takes work, but it’s minimal compared to the recovery process. Of consumers who reported identity theft to the Identity Theft Resource Center in 2023, 71% of general consumers were able to resolve the problem within three months. The IRS reports it currently spends an average of 506 days processing Identity Theft Victim Assistance (IDTVA) cases. The IDTVA program helps U.S. taxpayers resolve problems that arise when their PII is used to file fraudulent tax returns.

The recovery process is extensive. Depending on how fraudsters misused the child’s identity, recovery could entail:

• Adding a fraud alert or credit freeze on the child’s credit file.
• Replacing government-issued identification.
• Filing a police report.
• Contacting cable, electric, water or other utility service providers to close accounts in the child’s name.
• Contacting the school that authorized a loan in your child’s name to request that it be closed.

The length of the recovery process in an identity theft case depends on three factors, according to Allstate.

1. A cyber criminal successfully opened one or more new accounts or took out one or more lines of credit in your child’s name, making the recovery process lengthier.
2. The identity thief sold your child’s data on the dark web, where it could be sold and misused multiple times.
3. The perpetrator used your child’s PII to obtain medical care, creating the potential for the criminal’s medical conditions and history to mix with the child’s.

The longer an identity thief uses a child’s identity unchecked, the bigger the problem is to untangle. But Lenderman clarifies, “The deeper issue is that fraudulent data often remains embedded within the credit bureau systems. To date, bureaus haven’t developed effective internal protocols for identifying and purging synthetic identities from a data management perspective. The synthetic profile can persist and even be reused, perpetuating the cycle of fraud.”

In the absence of a system-wide solution for eradicating synthetic identities, Nofziger recommends victims of child identity theft and their families begin the recovery process by consulting IdentityTheft.gov, a free FTC resource that offers step-by-step guidance tailored to child identity theft. “In many cases, the process of cleaning up fraudulent activity is lengthy and emotionally taxing, especially for families navigating it for the first time. However, most victims are ultimately able to resolve the issues with the right support and resources,” she says.

Crystal Zuzek is an assistant editor of Fraud Magazine. Contact her at czuzek@acfe.com.

Is your child a victim of identity theft?

Here are some common signs that your child’s identity may have been stolen, according to Experian.

• Your child receives personally addressed preapproved credit card offers at your home.
• The IRS sends your child (who’s never been employed) a tax notice.
• Collection agencies, credit card issuers or lenders start hounding your child about unpaid bills.
• Your child has a credit report but hasn’t ever used credit.

You can check whether your child has a credit report by requesting a manual Social Security number search at each of the three major credit bureaus in the U.S.

• Experian
• TransUnion
• Equifax

What to do if your child is a victim of identity theft

If you discover that someone is using your child’s personally identifiable information, Amy Nofziger, CFE, senior director of fraud victim support at AARP, advises following these steps:

1. Submit a report to the U.S. Federal Trade Commission (FTC) at IdentityTheft.gov. You’ll receive a personalized recovery plan. If you create a free account, you can track your progress in the recovery process and receive support with each step.
2. Contact the three major U.S. credit bureaus — Equifax, Experian and TransUnion — to request a fraud alert or credit freeze on the child’s credit file.
3. File a police report, especially if documentation is needed to support the recovery process.
4. Report unauthorized use of your child’s Social Security number to the Social Security Administration.
5. Review the child’s credit report, if one exists, to identify any fraudulent activity.

The FTC has a detailed recovery plan with additional information and resources to help victims remedy the problems that identity theft causes.

Facebook provides recourse to parents who discover someone has posted images or videos of their child without permission. They can submit a request to Meta to have the materials removed if the child is younger than 13. Parents can also report violations of their child’s privacy to Instagram. Parents concerned about misuse of their child’s image or PII on X, formerly Twitter, can file a report. Snapchat’s policy prohibits children younger than 13 from using the platform. Parents of children ages 13–17 concerned about privacy violations can submit privacy requests on their children’s behalf.