"Identity crimes are becoming multi-layered because one successful compromise now gives criminals reusable access across multiple systems." — Patrick Harr, CEO at DataVisor
Identity Theft Resource Center’s 2026 Trends in Identity Report: scope and headline numbers
The Identity Theft Resource Center’s 2026 Trends in Identity Report finds that identity crimes increasingly cascade into multiple, simultaneous frauds rather than remaining isolated incidents. Approximately a quarter of victims (25.6%) dealt with two or more concurrent events — a figure the report says represents a 23.5% increase from the year prior. The report also documents shifts in how victims are targeted and what happens after compromise.
Unauthorized device access and AI-enhanced outreach
The report highlights rising unauthorized access to computers and mobile devices. Patrick Harr at DataVisor explains why that matters: "The phone or laptop is now the control center for a person’s digital identity," he said, adding that if "a fraudster gets onto the device, or into the cloud account tied to it, they may gain access to logged-in apps, stored credentials, messages, MFA flows, and recovery paths." Harr warns this access is more valuable than compromising single accounts and that "AI is accelerating that trend by helping criminals create more convincing, personalized outreach at scale and by making fake identities, fake profiles, and impersonation cheaper to operate."
Financial loss changes the equation: resolution rates collapse
The report draws a stark line between incidents that result in monetary loss and those that do not. Among victims with no financial loss, 53% were able to find a resolution. That success rate falls sharply once money moves: among victims who suffered financial loss, only 9% found resolution. And for the worst-off cohort, "0% of those who experienced three or more financial repercussions found a resolution." Harr ties this to monetization: "Cases with financial loss are much harder to resolve because the crime has already moved from compromise to monetization," he said, noting that tracing funds often means following money through multiple accounts and fast payment rails across institutions.
Fraudulent employment and detection by financial institutions
The report highlights particular abuses and who is detecting them. Fraudulent employment is identified as the most common crime against minors, accounting for 40% of misuse cases involving children; the report notes minors’ clean identities and sparse credit histories make them attractive for synthetic identity fraud and employment-related misuse. On detection, financial institutions identified a larger share of attempted misuse cases, at 28.6% of incidents referenced by the report.
What this means for technologists, enterprises, and consumers
- Technologists and security teams: The report and DataVisor’s commentary emphasize that identities — and devices tied to those identities — are the new perimeter. Defenders will be watching for vectors that convert device footholds into downstream fraud (logged-in apps, stored credentials, MFA recovery paths) and for AI-driven spoofing and synthetic profiles that lower the cost of large-scale impersonation.
- Enterprises and procurement leaders: BeyondTrust’s James Maude cautions that organizations sometimes accept customer identity compromise as a cost of convenience: "Many customer facing organizations will quickly write off losses associated with compromised customer identities" because added friction can be seen as a competitive disadvantage. Procurement teams will need to weigh that trade-off explicitly when choosing customer authentication and anti-fraud tools.
- Consumers and families: The report signals special risk for children’s identities. Patrick Harr notes that "children’s SSNs are especially attractive" for building synthetic profiles, and the report flags that minors are frequently targeted for fraudulent employment. At the same time, James Maude points to underreporting driven by stigma: "there is often a social stigma or element of shame that leads to reduced reporting."
Two clear threads run through the report and the experts’ comments: first, a single successful compromise is rarely a single crime any longer — it is the opening move in a chain that can end in account takeover, new-account fraud, employment misuse, and monetary loss across institutions. Second, once money has moved, victims’ chances of finding resolution drop precipitously. That combination — expanded attack surface tied to devices and identities, plus the accelerating role of AI in enabling convincing impersonation — frames the immediate challenge for defenders and for policy and consumer protections going forward.
Original story: https://www.securitymagazine.com/articles/102364-identity-crimes-have-become-multi-layered
