Questioning Identity Fraud: Who Is Responsible and How to Protect Yourself

When people lose money to fraud, the first question is often “How could this happen?” and the second is “Who is going to fix it?” The honest answer is complicated. Banks, card networks, telecom carriers, social platforms, retailers, data brokers and customers all play a part, and rules about who pays differ by payment type and by how quickly you act. This article looks at the problem of identity fraud in 2026, the questions we should ask of institutions, and the practical protections that put you in the strongest position.

1. The scale of the problem

The Federal Trade Commission reported $15.9 billion in consumer fraud losses in 2025, up from more than $12 billion in 2024. Imposter scams drew over a million reports and $3.5 billion in losses. The FBI’s Internet Crime Complaint Center received 1,008,597 complaints and $20.877 billion in reported losses in 2025, including 31,675 identity theft complaints and 67,456 personal data breach complaints, with $1.31 billion in breach-related losses. Adults aged 60 and over reported $7.748 billion. These are only the reported cases. See the agencies’ data at ftc.gov and ic3.gov.

With that much money moving to criminals every year, it is reasonable to ask whether institutions are doing enough and whether the burden has been placed too heavily on individuals.

2. Who is responsible for what

Criminals are legally responsible, but are often abroad, anonymous and difficult to prosecute.

Financial institutions must investigate disputes, follow federal error-resolution rules and maintain fraud controls. They also decide how much friction to place on risky transactions.

Card networks and payment apps set rules for chargebacks, tokenization and dispute handling.

Mobile carriers control SIM swaps and number porting, a common path to account takeover. The Federal Communications Commission describes carrier obligations at fcc.gov.

Companies that hold data must secure it, and in many places must notify you of breaches. Our article on how companies respond to data breaches describes the weaknesses.

Data brokers sell the information that helps criminals impersonate you. Regulation of them is expanding but remains uneven.

Consumers are expected to protect credentials, notice unusual activity and report quickly.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. How liability works in practice

Credit cards. Under federal law, your liability for unauthorized charges is capped, and in practice most issuers offer zero liability policies. You still need to report promptly and follow the dispute process.

Debit cards and electronic transfers. The rules provide limits on liability that depend on how quickly you report, and delays can increase your exposure. The Consumer Financial Protection Bureau explains these protections at consumerfinance.gov.

Peer-to-peer payments and wires. If a criminal accessed your account and sent money, you may have dispute rights. If you were deceived into sending the payment yourself, recovery is harder and depends on the provider and sometimes on state or national rules.

New accounts opened in your name. You generally are not responsible for debts you did not incur, but you must dispute the accounts and document the fraud. Credit bureaus must block information caused by identity theft when you provide proper documentation.

Tax and benefits fraud. Government agencies have their own processes, such as the IRS identity theft procedures at irs.gov and the Social Security Administration’s guidance at ssa.gov.

Our article on taking control and forgetting zero liability explains why relying on refunds alone is not a plan.

4. Questions we should ask institutions

Does the company limit how long it keeps sensitive data and delete it when it is no longer needed?
Are strong authentication options such as passkeys or hardware keys available?
Does the company block or delay unusual transfers and warn customers about common scams?
Are SIM-swap and port-out protections the default?
Does the firm provide clear breach notices and meaningful remedies, not just a year of monitoring?
Does it avoid selling data to third parties who do not need it?

Customers can put pressure on these questions by choosing providers who answer well and by filing complaints with regulators when problems occur.

5. What you can control

Freeze your credit. A freeze at Equifax, Experian and TransUnion is free and blocks most new-account fraud. See what is a credit freeze and IdentityTheft.gov.

Secure your logins. Use a password manager, unique passwords and MFA, preferring authenticator apps or passkeys. Add a PIN to your carrier account.

Turn on alerts. Enable transaction alerts for every card and account.

Report fast. Contact your bank at once, file at ReportFraud.ftc.gov and, if needed, ic3.gov.

Limit data donations. Decline unnecessary requests for your Social Security number, birth date and phone number.

Remove public listings. Opt out of data brokers using official pages like spokeo.com/optout and suppression.peopleconnect.us, so fewer details are available to criminals. California residents can use DROP at privacy.ca.gov/drop.

6. Documenting and disputing fraud

If fraud occurs, keep a log of dates, names, reference numbers and copies of letters. Send disputes in writing, attach your FTC Identity Theft Report and ask for written confirmation. If a creditor or collector pursues you for an account you did not open, send a written dispute and cite your identity theft report. If an institution refuses to help, file a complaint with the Consumer Financial Protection Bureau and your state attorney general. Our walkthrough how to report identity theft covers the steps.

7. Should the burden shift?

Many consumer advocates argue that institutions are best placed to prevent fraud, since they control authentication, monitoring and payment rails, and that a system which relies on individuals to spot sophisticated scams is unfair. Industry groups respond that fraud is a shared problem and that customers must take reasonable precautions. Policy debates continue about stronger reimbursement rules for authorized-payment scams, better carrier protections and limits on data sales. Whatever the outcome, you will be in a stronger position if you assume you may have to defend yourself and prepare accordingly.

8. A worked example

Nina sees a charge she does not recognize on her debit card. She calls her bank within an hour, receives a provisional credit and a new card and files a report at ReportFraud.ftc.gov. She then freezes her credit, changes her email password and enables alerts. She later learns her phone number and address were on eight people-search sites. She opts out of the top six. Months later she sees one relisted profile and removes it in minutes.

9. Myths about identity fraud

“The bank always covers it.” It depends on the type of fraud and how fast you act. “I’d notice right away.” Many victims find out months later. “Monitoring prevents fraud.” It only alerts you. “It only happens to careless people.” Breaches and scams affect careful people too.

10. What the numbers say about who gets hurt

Fraud is not evenly distributed. The FBI’s Internet Crime Complaint Center reported $7.748 billion in losses among adults aged 60 and over in 2025, which reflects both the size of retirement savings and the focus of scammers on trust-based schemes. Younger adults file many reports as well, often tied to investment, job and marketplace scams, with smaller average losses. Small businesses, nonprofits and families caring for relatives face their own versions. A realistic view of risk recognizes that no demographic is immune and that the same basic protections help everyone: freezes, strong authentication, alerts and a habit of verifying requests through trusted channels. Read more about steps to take after falling for a scam and effective identity theft prevention tips.

11. Where to complain when institutions fail you

If a bank, lender, credit bureau or collector does not handle your fraud dispute properly, escalate. File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov, which forwards it to the company and tracks the response. Contact your state attorney general’s consumer protection office. Report the underlying crime at reportfraud.ftc.gov and ic3.gov so investigators can see patterns. For tax-related fraud, use the Identity Theft Central pages at irs.gov, and for misuse of a Social Security number, see ssa.gov. Persistence, written records and clear requests are the most effective tools a victim has.

12. Protecting the people around you

Fraud rarely stays inside one household. A parent who loses money, a child whose Social Security number is misused or a partner whose accounts are shared can bring problems to everyone. Sit down together once a year to review credit freezes, account recovery details and who to call if something looks wrong. Teach every family member the same simple rule: no one sends money, codes or documents because of an unexpected message until a second person has verified it by another channel. See how to keep your family’s digital privacy safe for a household checklist.

13. Three scenarios

Scenario 1: A card is used without your permission. Call the issuer immediately and dispute the charges.

Scenario 2: You approved a payment to a scammer. Contact the bank and payment app right away and report; recovery is not assured.

Scenario 3: A new account appears on your credit report. Dispute in writing with the FTC report, and freeze credit.

14. What to expect: a realistic timeline

Action	Time to do	When it takes effect
Credit freezes	30 minutes	Immediate
Alerts and MFA	30 minutes	Immediate
Reporting fraud	30 minutes	Immediate
Dispute resolution	Weeks	Varies
Broker opt-outs	2 to 4 hours	Days to 4 weeks

15. Common mistakes

Waiting days to report.
Relying on monitoring instead of freezes.
Skipping written disputes.
Ignoring SIM-swap protection.
Leaving personal details in public listings.

16. How Wiperts helps lower your fraud risk

Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so relisted data is removed again. Less public data means fewer easy openings for impersonators.

Check your exposure before a criminal does.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

17. Key takeaways

Responsibility for fraud is shared, but your protections depend on acting quickly and on payment type.
Freezes, MFA, carrier PINs and alerts prevent most fraud.
Report fast and document everything.
Remove public listings so impersonators have less to work with.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

18. Frequently Asked Questions

Who is responsible when identity fraud happens?

Responsibility is shared. Companies must protect data and follow fraud rules, consumers must report promptly, and criminals bear legal responsibility. Liability for money lost depends on the type of payment and how quickly you report.

Will my bank refund fraud?

For unauthorized card and electronic transfers reported promptly, federal rules limit your liability and banks generally must investigate. If you were tricked into sending the money yourself, protections are weaker and vary by provider.

What is the difference between unauthorized and authorized fraud?

Unauthorized fraud means someone else initiated the transaction without permission. Authorized fraud means you approved a payment because you were deceived. Rules and refunds differ.

How fast should I report fraud?

Immediately. Liability limits and dispute rights often depend on how quickly you notify the bank, and some deadlines are measured in days or weeks.

Is credit monitoring enough?

No. It alerts you after something happens. A credit freeze prevents new accounts from being opened, and strong authentication prevents takeovers.

Where do I report identity fraud?

Report at IdentityTheft.gov, contact the affected institutions and, if online crime is involved, file at ic3.gov.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing