ITRC 2026 Report Highlights Rising Device Access in Identity Crime
Summary
The ITRC’s 2026 report finds unauthorized device access rose to 27.2% of reported identity compromises, while 25.6% of individuals contacting the center faced multiple incidents. Its findings describe patterns in identity misuse, recovery and prevention.
Key points
- The report analyzes 9,253 cases from 6,188 people who contacted the ITRC between April 2025 and March 2026; these contacts are not a representative sample of all identity crime victims.
- Unauthorized device access accounted for 27.2% of reported identity compromises, up from 15.3% in the prior period; it surpassed scams as the leading compromise method for adults aged 35–64.
- Among people reporting unauthorized device access who later experienced misuse, 87% experienced account takeover.
- More than one in four individuals (25.6%) reported two or more identity incidents, with account takeover and unauthorized device access a common combination.
- In a 147-person financial impact survey, 9% of respondents reporting financial impact said their concern was resolved, compared with 53% of those reporting no financial impact; the report notes the survey was small and self-selected.
- The report recommends matching protections to likely risks: credit freezes and credit-report checks for new-account fraud, and password or passkey changes, MFA and active-session reviews after device compromise.
Article Details
- Publisher
- Identity Theft Resource Center
- Report Period
- 2025-04-01 to 2026-03-31
- Scope
- Identity crime experiences reported to the ITRC across U.S. states and territories; contacts and voluntary surveys are not representative prevalence samples.
- Sample Size
- 9,253 cases from 6,188 unique individuals; voluntary surveys had 261 emotional-impact, 147 financial-impact and 236 satisfaction respondents.
- Key Statistics
- 25.6% of individuals reported two or more identity incidents, compared with 23.5% in the prior reporting period.
- Unauthorized device access accounted for 27.2% of identity compromise cases, up from 15.3% the prior year; scams involving shared personal information accounted for 36.1%.
- Among 157 individuals who reported unauthorized device access followed by identity misuse, 87% experienced account takeover.
- Account takeover represented 50% of the 5,020 misuse cases, while new account fraud represented 37.9%.
- In the small, self-selected financial-impact survey, 53% of those without financial impact reported resolution, compared with 9% of those with any financial impact.
- Recommendations
- Freeze credit and regularly check credit reports to prevent and detect new financial account fraud.
- Adopt passkeys or strong passwords and enable multi-factor authentication.
- After a device compromise, change passwords or adopt passkeys and review active sessions across accounts.
- Monitor account activity for signs of account takeover.
- Parents should consider freezing their children's credit.