States Most Vulnerable to Identity Theft & Fraud

In recent years, significant data breaches have compromised many Americans’ personal information. U.S. consumers reported losing 25% more money due to fraud last year compared to the previous year, totaling nearly $12.5 billion in losses nationwide. This year, a major data breach involving AT&T has exposed sensitive information from nearly 86 million customer accounts, including over 44 million Social Security numbers in plain text. The leaked data, now circulating on the dark web, affects a wide range of individuals and poses significant risks of identity theft and fraud.

Each new year brings new strategies by identity thieves and fraudsters, but older schemes, such as tech support scams and fake IRS calls, still abound. Some Americans are more susceptible than others to such crimes, however. In order to determine who is most likely to be exposed to and affected by identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across 15 key metrics. Our data set ranges from identity theft complaints per capita to the average loss due to fraud.

“In an age where we have sensitive data online in a multitude of places, we risk falling victim to identity theft and fraud whenever there’s a data breach. Living in a state with robust legal protections against identity theft and fraud, such as identity theft passports and cybersecurity task forces, can decrease your risk of falling victim to these crimes, though staying vigilant and protecting yourself online is still the most important.”

Chip Lupo, WalletHub Analyst

Main Findings

States With the Most Identity Theft & Fraud

Notes: *No. 1 = Most Vulnerable
With the exception of “Total Score,” all of the columns in the table above depict the relative rank of that state, where a rank of 1 represents the worst conditions for that metric category.

Identity-Theft Complaints per Capita

Most

• 1. Florida
• 2. Georgia
• 3. District of Columbia
• 4. Nevada
• 5. Texas

Fewest

• 47. North Dakota
• 48. West Virginia
• 49. Alaska
• 50. Vermont
• 51. South Dakota

Best State vs. Worst State: 6x Difference

Florida vs. South Dakota

Avg. Loss Amount Due to Online Identity Theft

Highest

• T-1. New Jersey
• T-1. North Carolina
• T-1. Utah
• 4. California
• 5. Iowa

Lowest

• 47. Kansas
• 48. Connecticut
• 49. Hawaii
• 50. Montana
• 51. Vermont

Fraud Complaints per Capita

Most

• 1. District of Columbia
• 2. Florida
• 3. Georgia
• 4. Delaware
• 5. Nevada

Fewest

• 47. Kansas
• 48. West Virginia
• 49. Iowa
• 50. North Dakota
• 51. South Dakota

Best State vs. Worst State: 4x Difference

District of Columbia vs. South Dakota

Avg. Loss Amount Due to Fraud

Highest

• T-1. Arizona
• T-1. Hawaii
• T-1. Wyoming
• 4. Utah
• 5. California

Lowest

• T-43. Maine
• T-43. Ohio
• 48. Kentucky
• 49. West Virginia
• 50. New Hampshire
• 51. Vermont

Best State vs. Worst State: 2x Difference

Arizona vs. Vermont

Show More

In-Depth Look at the Places Most Vulnerable to Identity Theft and Fraud

Florida

Florida, despite being a vibrant and populous state, remains notably vulnerable to identity theft and fraud. One of the big reasons for this is a lack of suitable laws protecting against these crimes. For example, Florida doesn’t have an identity theft passport program, which is a way to help prove your identity if it gets stolen, and the state doesn’t have laws against spyware on computers either.

Florida had 528 identity theft complaints and 2,163 fraud complaints for every 100,000 residents last year–the highest and second-highest rates in the nation, respectively. It also had the fifth-highest median loss due to fraud, at over $500.

California

California ranks second in the nation for exposure to identity theft and fraud, in large part because its residents have the fourth-highest average loss due to identity theft, at over $28,000. Residents also have the third-highest median loss due to fraud, at $542. In addition, Californians also lost an average of over $71,000 to fraud involving cryptocurrency, the fourth-highest amount in the country.

For every 100,000 residents, California had 356 identity theft complaints and 1,291 fraud complaints last year, the eighth-most and 18th-most in the country, respectively. In addition, California has the fifth-highest fraud rate for e-commerce when considering shipping addresses and the seventh-highest for billing addresses located in the state.

While California does have most of the essential laws necessary for addressing identity theft and fraud, there is still room for improvement. For example, the state still lacks an identity theft passport program to help people prove their identities after an incident.

Georgia

Georgia ranks third for vulnerability to identity theft and fraud, and one contributing factor is that it has a relatively high number of people arrested for fraud per capita. It also has the sixth-highest and fifth-highest rate of fraud for e-commerce, based on shipping addresses and billing addresses located in the state, respectively.

Although laws in Georgia are comprehensive in most areas relating to identity theft and fraud, the state lacks an identity theft passport program that would assist victims in verifying their identities after an incident.

Finally, Georgia had 2,108 fraud complaints and 517 identity theft complaints for every 100,000 residents last year, the third-most and second-most in the nation, respectively. The state also had the 15th-highest average loss amount due to identity theft, at over $13,000.

Quick Tips for Avoiding Identity Theft & Fraud

• Emphasize Email Security: Using strong passwords for all financial accounts is important, but you may not realize how essential it is to focus on email. Your primary email address will likely be your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, use an exceptionally secure password and establish two-step verification for this account.
• Sign up for Credit Monitoring: Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind through alerts about significant changes to your file, including potential signs of identity theft. WalletHub offers 24/7 monitoring of your TransUnion credit report if you sign up for a free account, and you can also get advanced identity theft protection with WalletHub Premium.
• Leverage Account Alerts & Update Contact Info: Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address, and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will safeguard you.
• Use Common Sense Online: Don’t open emails you don’t recognize. Don’t download files from untrustworthy sources. Don’t send account numbers and passwords via email or messenger applications. And don’t enter financial or personal information into websites that lack the “https” prefix in their URLs.

For more tips and information, check out WalletHub’s Identity Theft Guide.

Ask the Experts

We may not have control over how organizations handle our data. However, we can control how and where we share this information. We consulted a panel of experts for advice on safeguarding our data against cybercriminals. Click on the experts’ profiles to read their bios and thoughts on the following key questions:

1. What can individuals do to guard against identity theft?
2. Should victims of identity theft be able to change their Social Security number? How can we make this number more difficult to steal and use (e.g., more digits)?
3. What are some common scams and fraud attempts people should be vigilant about?
4. Is the expansion of social media facilitating more identity thefts?
5. Should the federal government intervene to establish a clear process for victims of identity theft looking to clear their name?

Ask the Experts

Chih-Chen Lee
Ph.D., CPA, CFE - William and Dian Taylor Professor of Accountancy, Director of Inclusive Excellence for College of Business, Coordinator of Global Learning Opportunities (GLO, formerly known as IBS) at NIU - Northern Illinois University
Read More

Suzanne Lynch
Adjunct Professor, Financial Crime, School of Business & Justice Studies, Utica College
Read More

Dr. Philip Kim
D.Sc., CISSP, CISA, Associate Professor, The DeVille School of Business - Walsh University
Read More

Dr. France Belanger
University Distinguished Professor, R. B. Pamplin Professor, Byrd Senior Faculty Fellow, Virginia Tech
Read More

Shambhu Upadhyaya
IEEE Fellow; Director, SEAS/SOM Cybersecurity MS Program; Professor, Computer Science and Engineering – University at Buffalo
Read More

Ryan T. Wright
MBA, Ph.D. – Senior Associate Dean for Faculty and Research, Professor of Commerce, McIntire School of Commerce – University of Virginia
Read More

More Experts

Methodology

In order to determine where American consumers are most vulnerable to identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across three key dimensions: 1) Identity Theft, 2) Fraud, and 3) Policy.

We evaluated those dimensions using 15 key metrics listed below with their corresponding weights. Each metric was graded on a 100-point scale, with a score of 100 representing the most vulnerable.

Finally, we determined each state and the District’s weighted average across all metrics to calculate its overall score and used the resulting scores to rank-order our sample.

Identity Theft – Total Points: 47.5

• Identity-Theft Complaints per Capita: Full Weight (~15.83 Points)
• Change in Identity-Theft Complaints per Capita (2024 vs. 2023): Full Weight (~15.83 Points)
• Average Loss Amount Due to Online Identity Theft: Full Weight (~15.83 Points)
  Note: This metric was calculated using the following formula: Total Loss Amount / Total Number of Online Identity-Theft Complaints.

Fraud – Total Points: 47.5

• Fraud & Other Complaints per Capita: Full Weight (~7.92 Points)
• Change in Fraud & Other Complaints per Capita (2024 vs. 2023): Full Weight (~7.92 Points)
• Median Loss Amount Due to Fraud: Full Weight (~7.92 Points)
  Note: “Total reported amount paid” is based on the total number of fraud complaints for which the amount paid was reported by the victims. The amount paid ranges from $1 to $999,999.
• Average Loss Amount Through Cryptocurrency Schemes: Full Weight (~7.92 Points)
  Note: This metric was calculated using the following formula: Total Loss Amount / Total Number of Cryptocurrency Complaints.
• Persons Arrested for Fraud per Capita: Full Weight (~7.92 Points)
• E-Commerce Attack Rates: Full Weight (~7.92 Points)

Policy – Total Points: 5.0

• Availability of Security-Freeze Law for Minors’ Credit Reports: Full Weight (~0.83 Points)
  Note: This binary metric considers the presence or absence of legislation allowing parents, legal guardians, or other representatives of minors to place a security freeze on the minor’s credit report.
• Availability of Identity-Theft Passport Program: Full Weight (~0.83 Points)
  Note: This binary metric considers the presence or absence of Identity-Theft Passport programs that help victims of identity theft reclaim their identity. When presented to a law enforcement agency, an “identity-theft passport” allows a victim to prevent his or her arrest for offenses committed by an identity thief.
• Data Disposal Laws by State: Full Weight (~0.83 Points)
  Note: This binary metric measures the presence or absence of data disposal laws in each state. Businesses and governments collect personal information and store it in various formats-digital and paper. Several states have enacted laws that require entities to destroy, dispose or otherwise make personal information unreadable or undecipherable.
• Presence of State Laws Addressing "Phishing": Full Weight (~0.83 Points)
  Note: This binary metric measures the presence or absence of laws addressing “phishing” in a state. “Phishing” is a cybercrime in which a target is contacted by email, telephone, or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.
• Presence of State Spyware Laws: Full Weight (~0.83 Points)
  Note: This binary metric measures the presence or absence of laws addressing “spyware” in a state. “Spyware” is classified as a type of malware, malicious software designed to gain access to or damage your computer, track your online activities, or collect confidential information.
• Presence of Statewide Cybersecurity Task Forces: Full Weight (~0.83 Points)
  Note: This binary metric measures the presence or absence of cybersecurity task forces in a state.

 
Sources: Data used to create this ranking were collected as of November 5, 2025 from the Federal Trade Commission, Internet Crime Complaint Center, Federal Bureau of Investigation, Experian Information Solutions, and the National Conference of State Legislatures.

Supporting Video Files:

• YouTube (for web embedding)
• Raw video files (for editing into clips)