sign in sign up
<<
Home , Cybercrime, Identity theft

Facts + Statistics: Identity and

Technology

IN THIS FACTS + STATISTICS

The scope of

Identity theft and complaints

Identity Theft And Fraud Reports, 2016-2020 (1)

Top Five Types of Identity Theft, 2020 (1)

Identity Theft By State, 2020 (1)

Top 10 Writers Of Identity Theft Insurance By Direct Premiums Written, 2020 (1)

Cybercrime

Number Of Data Breaches And Individuals Impacted, 2015-2020

Cybercrime Complaints, 2016-2020 (1)

Top 10 States By Number Of Cybercrime Victims And By Losses, 2020 (1)

Top 10 Writers Of Cybersecurity Insurance By Direct Premiums Written, 2020 (1)

Additional resources

SHARE THIS

DOWNLOAD TO PDF The scope of identity theft

According to the Aite Group, 47 percent of Americans experienced financial identity theft in 2020. The group’s report, U.S. Identity Theft: The Stark Reality, found that losses from identity theft cases cost $502.5 billion in 2019 and increased 42 percent to $712.4 billion in 2020. The group explains that the huge increase was fueled by the high rate of unemployment identity theft during the pandemic, as increased and extended unemployment benefits made the sector an attractive target for fraudsters.

Losses are forecast to increase again in 2021 to $721.3 billion. The study narrowed the identity theft definition to include only application fraud, where criminals used a victim’s identity to open a new account of some type, and account takeover, where an account is taken so criminals can steal money or access rewards. Examples of accounts include rewards accounts for airlines, hotels, or merchants; insurance policies; and other accounts.

In the past two years, 37 percent of consumers have been victims of application fraud and 38 percent experienced account takeovers. The highest percentage of consumers who were victimized in 2020 were between 35 and 44 years of age and accounted for 30 percent of all identity theft victims. The findings are from an online survey conducted in December 2020 of 8,653 U.S. consumers age 18 and older.

Identity theft and fraud complaints

The Consumer Sentinel Network, maintained by the (FTC), tracks consumer fraud and identity theft complaints that have been filed with federal, state and local law enforcement agencies and private organizations. There were 4.8 million identity theft and fraud reports received by the FTC in 2020, up 45 percent from 3.3 million in 2019, mostly due to the 113 percent increase in identity theft complaints. In 2020, 1.4 million complaints were for identity theft, up from 651,000 in 2019. Identity theft complaints accounted for 29 percent of all complaints received by the FTC, up from 20 percent in 2019. About 2.2 million reports were fraud complaints and 1.2 million involved other complaints.

Out of the total 4.8 million reports received by the FTC in 2020, the most by category were for identity theft complaints. Within identity theft, almost one-third were for scams involving government benefits applied for or received. According to , federal stimulus payments were an easy target for criminals and were the number one COVID-19 scam. New accounts fraud were the next largest identity theft scam, about 30 percent of all identity theft complaints. Imposter scams were the second-worst overall category of FTC complaints, with almost one-half million reports.

Of the 2.2 million fraud cases, 34 percent reported money was lost. Consumers reported losing more than $3.3 billion related to fraud complaints, an increase of $1.5 billion from 2019. The median amount consumers paid in these cases was $311. Twenty-two percent of imposter scams reported money lost, totaling about $1.2 billion.

The top five states for identity theft ranked by the number of reports per population were Kansas, Rhode Island, Illinois, Nevada and Washington. (See chart below). For fraud and other complaints, the top five states were Nevada, Delaware, Florida, Maryland, and .

Identity Theft And Fraud Reports, 2016-2020 (1)

(1) Percentages are based on the total number of Consumer Sentinel Network reports by calendar year. These figures exclude "Do Not Call" registry complaints.

Source: Federal Trade Commission, Consumer Sentinel Network.

View Archived Graphs

Top Five Types of Identity Theft, 2020 (1)

Type of identity theft Number of reports Percent of total top five

Government benefits applied for/received 394,324 32.0% —new accounts 365,597 29.7 Miscellaneous identity theft (2) 281,434 22.9 Business/personal loan 99,667 8.1 Tax fraud 89,391 7.3 Total, top five 1,230,413 100.0%

(1) Consumers can report multiple types of identity theft. In 2020, 15 percent of identity theft reports included more than one type of identity theft. (2) Includes and payment account fraud, and fraud, and medical services, insurance and securities account fraud, and other identity theft.

Source: Federal Trade Commission, Consumer Sentinel Network.

View Archived Tables

Identity Theft By State, 2020 (1)

Reports per Reports per 100,000 Number of 100,000 State population (2) reports Rank (3) State population (2)

Alabama 354 17,376 21 Montana 228 Alaska 127 926 47 Nebraska 113 Arizona 380 27,661 14 Nevada 740 Arkansas 579 17,470 8 New Hampshire 169 373 147,382 15 New Jersey 362 Colorado 361 20,762 20 New Mexico 165 Connecticut 191 6,821 35 345 Delaware 449 4,374 13 North Carolina 288 D.C. 368 2,595 18 North Dakota 166 Florida 472 101,367 11 Ohio 222 Georgia 654 69,487 7 Oklahoma 349 Hawaii 271 3,835 28 Oregon 176 Idaho Reports p1e3r2 2,353 45 Pennsylvania Reports p2e6r5 Illinois 100,0010,066 Num13b5e,r0 3o8f 3 Puerto Rico 100,000 52 State population (2) reports Rank (3) State population (2) Indiana 257 17,306 30 Rhode Island 1191 Iowa 96 3,022 50 South Carolina 373 Kansas 1,483 43,211 1 South Dakota 72 Kentucky 127 5,693 47 Tennessee 281 Louisiana 473 21,976 10 Texas 465 Maine 534 7,183 9 Utah 292 Maryland 343 20,718 24 Vermont 130 Massachusetts 661 45,575 6 Virginia 183 Michigan 244 24,370 31 Washington 712 Minnesota 146 8,246 44 West Virginia 148 Mississippi 371 11,048 17 Wisconsin 154 Missouri 222 13,653 33 Wyoming 151

(1) Includes the District of Columbia and Puerto Rico. (2) Population figures are based on the 2019 U.S. Census population estimates. (3) Ranked per complaints per 100,000 population. States with the same number of complaints per 100,000 population receive the same rank.

Source: Federal Trade Commission, Consumer Sentinel Network.

View Archived Tables

See also the Identity Theft section of our Web site Click Here

Top 10 Writers Of Identity Theft Insurance By Direct Premiums Written, 2020 (1)

($000)

As a percent of total direct Rank Group/company Direct premiums written (2) premiums written

1 Nationwide Mutual Group $33,005 2 State Farm 32,694 3 Travelers Companies Inc. 23,812 4 Hanover Insurance Group Inc. 13,352 5 Liberty Mutual 13,174 6 Allstate Corp. 10,630 As a percent of total direct 7 Farmers Insurance Group of Companies 10,430 Rank Group/company Direct premiums written (2) premiums written 8 American Family Insurance Group 10,138 9 Erie Insurance Group 8,917 10 Mercury General Corp. 6,614

(1) Includes stand-alone policies and the identity theft portion of package policies. Does not include premiums from companies that cannot report premiums for identity theft coverage provided as part of package policies. (2) Before reinsurance transactions.

Source: NAIC data, sourced from S&P Global Market Intelligence, Insurance Information Institute.

View Archived Tables

Cybercrime

As businesses increasingly depend on electronic data and networks to conduct their daily operations, growing pools of personal and financial information are being transferred and stored online. This can leave individuals exposed to violations, and financial institutions and other businesses exposed to potentially enormous liability, when a breach occurs.

High-profile data breaches continue to threaten business with losses and consumers with exposure of their . In 2021 more than 280 million Microsoft customer records were left unprotected on the web in January. By March, the U.S. Cybersecurity and Infrastructure Security Agency, a standalone federal agency in the Department of Homeland Security, advised all organizations across all sectors follow its guidance to address Microsoft’s email server vulnerabilities. According to the Triple-I, the number of U.S.-based organizations affected is estimated to be at least 30,000, while worldwide that number is close to 100,000. Other notable breaches in 2021 involved Colonial Pipeline Co., an East Coast gas utility that suffered a attack that shut down the company for six days, along with and Volkswagen of America breaches. A breach at Marriott Hotels in March 2020 reached a data system containing the personal information of about 5.2 million customers and MGM Resorts was hit by a February 2020 that exposed the personal information of more than 10.6 million guests. Also of note, in late 2020 criminals believed to originate outside the United States breached as many as 18,000 government agencies through software from SolarWinds, a software service company. The breach went undetected for months and was caused by changes made to a software program update. The information targeted appears to be corporate and government intellectual rather than consumer information. In 2019 the worst data breaches were the Capital One Financial Corp. breach in July that exposed 100 million records and the October Adobe Creative Cloud breach that exposed 7​ million users. In 2017 the largest U.S. , Equifax Inc., suffered a breach that exposed the personal data, including Social Security numbers, of 145 million people. It was among the worst breaches on record because of the amount of sensitive information stolen. In 2019 ransomware attacks—a type of that denies access to an organization’s system—more than doubled from 2018. In 2019 an organization fell victim to ransomware every 14 seconds on average. Also troubling is that while more organizations purchase insurance to protect against the risk, ransom demands grow larger as attackers realize that companies can meet these demands.

The Identity Theft Resource Center® (ITRC) reported in early 2021 that cybercriminals continue to be less interested in stealing large amounts of personal information directly from consumers but instead are taking advantage of bad consumer behaviors to commit identity-related against businesses using stolen credentials like logins and . Criminals use these credentials to make ransomware and attacks against businesses.

In 2020, there were 1,108 data breaches, down 19 percent from 1,362 breaches in 2019, according to the ITRC’s 2020 End-of Year Data Breach Report. There was also a significant decrease in the number of individuals impacted. In 2020, 300.6 million people were impacted by data breaches, down 66 percent from 887.3 million people impacted in 2019. were the most used cause of compromise, accounting for 878 events that affected 170 million individuals. One form of cyberattacks, using (phishing) or texts (smishing) supposedly from a reputable company that induces people to supply personal information, was the most used method of , accounting for 44 percent of all cyberattacks. Ransomware accounted for 18 percent of cyberattacks and malware accounted for 12 percent. Human and system errors accounted for 152 events that affected 130 million people. Physical attacks, such as stealing a device or document, accounted for 78 events and affected about 943,000 people. Supply chain attacks, which target a vendor, account for the remainder of attacks.

By first half 2021, the ITRC reported that the number of data breaches were on track to exceed those recorded in 2020 and could reach a new record, while the number of individuals impacted is trending lower. In the first half of 2021, there were 846 compromises (breaches and data exposures) representing about 75 percent of all compromises in 2020. About 118.7 million individuals were impacted, compared with 300.6 million in 2020. Phishing and ransomware were the top two causes of data compromise in the first half of 2021. Compromises at manufacturing and utilities companies were up five-fold in first half 2021 compared with a year ago and more than doubled in the retail sector. The largest number of compromises, 162, occurred in the healthcare sector, but these events were down 7 percent from a year ago. Ranked by individuals impacted, the technology sector ranked first with 36.6 million individuals impacted, followed by professional services with 20.1 million, financial services with 9.7 million and healthcare with 9.1 million impacted.

By industry, according to Accenture, insurance companies were the most targeted by ransomware attacks, accounting for almost a quarter of all ransomware attacks on Accenture’s clients. Consumer goods and services, and telecommunications ranked second and third.

According to the 2020 Cost of a Data Breach Report, sponsored by IBM Security and conducted by the Ponemon Institute, global data breaches cost companies $3.86 million per breach, on average. The study surveyed more than 500 organizations worldwide between August 2019 and April 2020. Cost factors included in the survey included legal, regulatory and technical activities related to breaches. Customers’ personally identifiable information (PII) was exposed in 80 percent of the breaches that occurred in the past year. Nearly 40 percent of malicious incidents were caused by stolen or compromised credentials and cloud misconfigurations. Attackers used previously exposed emails and passwords in one out of five breaches studied, stemming from more than 8.5 billion records exposed in 2019. Businesses that experienced breaches of corporate networks through the use of stolen or compromised credentials had nearly $1 million added to data breach costs over the global average, or $4.77 million. Cloud misconfigurations were used to breach networks nearly 20 percent of the time, increasing breach costs by more than half a million dollars to $4.41 million on average. State-sponsored threat actors were the most damaging type of adversary found in the 2020 study, although they accounted for 13 percent of all attacks. The resulting breach costs averaged $4.43 million. The COVID-19 pandemic brought more risk of data breaches because remote work conditions created less controlled environments. The report found that 70 percent of companies studied that adopted telework during the pandemic expect that it would exacerbate data breach costs.

According to the Insurance Information Institute and J.D. Power 2019 Cyber Insurance and Security Spotlight SurveySM, 12 percent of businesses surveyed suffered one or more cyber incidents in 2019, up from 10 percent in 2018. Nearly 71 percent said they are “very concerned” about cyber incidents, up from 58 percent in 2018. Seventy-five percent said they believe the risk of being victimized by a cyberattack is growing at an alarming rate compared with 70 percent in 2018. Among the 44 percent of respondents who said they do not currently have cyber insurance and the 21 percent who said they do not know whether they do, 64 percent said they do not plan to purchase a cyber insurance policy in the next 12 months. This number is down from 70 percent in 2018. Given small companies’ growing awareness and concerns about cyberrisk, insurers and agents and brokers could potentially increase their overall support of this market by addressing the issues of affordability and coverage limitations that seem to be an obstacle to purchasing.

Cyber insurance evolved as a product in the United States in the mid- to late- 1990s as insurers had to expand coverage for a risk that is rapidly shifting in scope and nature. In 2020, 203 insurer groups reported writing cyber insurance at one or more of their subsidiaries, up from 197 in 2019, according to data sourced from S&P Global Market Intelligence. Direct premiums written totaled $2.8 billion in 2020, from companies that can report premiums for stand-alone and coverage provided as part of package policies, up from $2.2 billion in 2019. For more information on cyber insurance see Chapter 7, Commercial Lines.

Number Of Data Breaches And Individuals Impacted, 2015-2020

Source: Identity Theft Resource Center, 2020 year in review, Data Breach Report.

View Archived Graphs

The IC3 says that 2020 complaints and dollar losses were the highest since the center began tracking cybercrime statistics in 2000. In 2020 the IC3 received and processed 791,790 complaints, a 69 percent increase from 467,361 in 2019. Losses to individuals and businesses totaled $4.2 billion, up 20 percent from 2019 . Business email compromise continued to cause the most losses, with about $1.8 billion in losses, followed by confidence or romance fraud, with $600.2 million in losses. Business email compromise typically involves a criminal mimicking a legitimate email address. For example, an employee might receive a message that appears to be from an executive within their company requesting a payment or wire transfer that funnels money directly to a criminal. About 19,400 people were victims of email account scams. Confidence fraud occurs when a criminal deceives a victim into believing they have a trust relationship and the victim is persuaded to send money or personal and financial information. In 2020 about 23,750 people reported confidence scams.

Cybercrime Complaints, 2016-2020 (1)

(1) Based on complaints submitted to the Complaint Center.

Source: Internet Crime Complaint Center.

View Archived Graphs

Top 10 States By Number Of Cybercrime Victims And By Losses, 2020 (1)

Rank State Number Rank State Losses ($ millions) R1 ank SCataliftoernia Nu6m9,b54e1r R1 ank SCataliftoernia Losses ($ mi$ll6io2n1s.5) 2 Florida 53,793 2 New York 415.8 3 Texas 38,640 3 Texas 313.6 4 New York 34,505 4 Florida 295.0 5 Illinois 20,185 5 Ohio 170.2 6 Pennsylvania 18,636 6 Illinois 150.5 7 Washington 17,229 7 Missouri 115.9 8 Nevada 16,110 8 Pennsylvania 108.5 9 New Jersey 14,829 9 Virginia 101.7 10 Maryland 14,804 10 Colorado 100.7

(1) Based on the total number of complaints submitted to the Internet Crime Complaint Center via its website from each state where the complainant provided state information.

Source: Internet Crime Complaint Center.

View Archived Tables

Top 10 Writers Of Cybersecurity Insurance By Direct Premiums Written, 2020 (1)

($000)

As a percent of total direct Rank Group/company Direct premiums written (2) premiums written

1 Chubb Ltd. $404,144 14.7% 2 AXA XL 293,025 3 American International Group (AIG) 228,425 4 Travelers Companies Inc. 206,817 5 Beazley Plc 177,746 6 AXIS Capital Holdings Ltd. 133,550 7 CNA Financial Corp. 119,612 8 Fairfax Financial Holdings 108,543 9 Hartford Financial Services 102,865 10 BCS Insurance Co. 86,583

(1) Includes stand-alone policies and the cybersecurity portion of package policies. Does not include premiums from companies that cannot report premiums for cybersecurity coverage provided as part of package policies. (2) Before reinsurance transactions.

Source: NAIC data, sourced from S&P Global Market Intelligence, Insurance Information Institute.

View Archived Tables

Additional resources

Federal Trade Commission

Internet Crime Complaint Center

Back to top