Identity theft
Identity theft occurs when someone uses another person's personal or financial information without permission, such as to obtain credit, services, or money in that person's name.
Personal information can be misused without someone first breaking into the victim’s email account. The FTC describes uses such as opening credit or utility accounts, seeking medical care, or stealing a tax refund under another person’s identity.
Account takeover concerns control of an existing account. The two can overlap, but a stolen identity document and a hijacked mailbox call for different questions.
Exposure and misuse are separate findings
A copy of an identity document sent to a false recruiter creates exposure. It does not, on its own, establish that a loan was opened or another service was obtained. Record which documents and details were disclosed so responders can assess the possible misuse.
The FBI has documented fake employers using hiring conversations to collect applicants’ personal information. Our recruiting article explains how to verify the employer and the purpose of a document request. The employee tax-data article covers the organizational side, where one disclosure can affect multiple people.
For suspected identity theft in the United States, the FTC directs people to IdentityTheft.gov for a report and recovery plan. Workplace responders should also involve the appropriate security or privacy team. An email password reset cannot undo a fraudulent credit application made with stolen personal details.