Consumers know that fraudsters would love to get their hands on their debit cards, credit cards and the physical identity cards in their wallets. What they often don’t realize is that their digital identity has value too, and it can be just as attractive to criminals.
I’ve spent decades looking at identity from the fraud side of the equation, and I believe we’ve been asking an incomplete question. For many years, those of us in fraud prevention have focused on whether the information a consumer provides about themselves matches against a separate source. Does that name match? Does the address match? What about that date of birth? However, we need to be asking an additional question: does the consumer’s behavior make sense? Static information like a name, address and date of birth tell us something about who you are, but it doesn’t tell us whether the person sitting behind the keyboard
is you, or whether there’s even a person behind it at all.
Expanding the Definition of Identity
The public and private sectors have spent decades teaching us to protect our personal information: our “identity.” As a fraud-prevention practitioner, I believe we need to expand these definitions and teach consumers to also protect their identity patterns. The strongest identity signal might be your behavior, not a set of fixed information on a document.
Fraud doesn’t begin—or end—at the moment when money changes hands. TransUnion's latest
fraud research found that 8.3% of digital-account creation attempts globally were suspected of fraud in 2025, making account creation the riskiest stage of the consumer lifecycle. At the same time, the suspected digital fraud rate for account takeover increased 37% year over year. In other words, the most dangerous moment can occur before a financial transaction ever happens.
As identity fraud has increased, the old definition of identity has become outdated. For years, the formula was “identity = name + date of birth + address + Social Security Number or Social Insurance Number.” But identity also exists in the devices we use, the locations we log in from, the way we interact with our accounts, the transactions we make, the people and organizations we interact with and the patterns we create over time. In other words, the emerging formula should be “Identity = the continuously changing collection of attributes, behaviors, relationships, devices, transactions and digital signals that collectively represent a person”. A criminal may have one piece of information from a data breach, one from social media, another from a phishing attack and yet another from a compromised account. The danger lies in connecting these data points to create a picture of a person’s identity, which can then be stolen or misused.
Protecting Your Digital Identity
A modern understanding of identity must fully account for what happens before, during and after an interaction. Identity is increasingly a living, evolving pattern, and artificial intelligence (AI) is raising the stakes. Technology has made it easier for all of us to live digitally and makes it easier for criminals to create convincing versions of reality. We live in a world where AI is helping fraudsters produce convincing messages, impersonations, images and interactions at scale. As a result, the question becomes "Can someone create a believable version of me—or someone else—using the digital information available about me?" That distinction matters because synthetic identities, account takeovers and impersonation don't always require a complete stolen identity. They only require enough credible information to pass the checks. The more fragmented our digital lives become, the more opportunities there are to assemble those pieces.
So, what should you as a consumer do?
Think about identity as something you actively manage, rather than something you simply possess. That means being intentional about what you share and with whom. Information that seems harmless in isolation can become valuable when combined with other information.
Best Practices
- Treat your phone number and email address as identity credentials.
- Pay attention to account alerts. A new device, password reset, phone-number change or unfamiliar login can be an early warning signal.
- Don't assume a familiar-looking message is legitimate. Criminals don't need to fool everyone. They only need to fool the right person once.
- Think about your digital footprint. Your social media posts, photographs, employment information, travel patterns and relationships can collectively reveal far more than you may realize.
Perhaps most importantly, think about identity protection as an ongoing process. The future of identity protection lies in combining traditional identifiers, such as dates of birth and government-issued identification numbers, with behavioral signals, including patterns of financial activity.
