Identity Theft Risk Calculator

Identity theft rarely happens through a single dramatic event — far more often, it's the accumulation of several smaller exposures that, combined, give someone enough to open a credit card, file a fraudulent tax return, or drain an account in someone else's name. Understanding which factors compound is more useful than treating any single risk in isolation.

Password reuse is the multiplier that turns an isolated breach into broad exposure. When one site is breached and passwords leak (even hashed ones, which can often still be cracked), attackers run 'credential stuffing' attacks — automatically trying that same email/password combination across hundreds of other sites. A password unique to each account contains a breach to that one account; a reused password turns it into a skeleton key for everything else you've used it on.

Data breaches themselves are now essentially a background fact of digital life — major breaches affecting hundreds of millions of records have become common enough that checking whether your specific accounts were involved (via a service like haveibeenpwned.com) is more actionable than assuming you haven't been affected. What matters is response speed: changing an exposed password, and any reused copies of it, closes the window before it's exploited, but that window narrows the longer a breach notification goes unaddressed.

A Social Security number occupies a different tier of risk entirely, because unlike a password, it can't easily be changed if compromised, and it's the single piece of information most directly tied to opening new credit in your name. This is exactly why a credit freeze — free, reversible, and available from all three major bureaus — is disproportionately effective: it directly blocks the specific action (opening new credit) that a stolen SSN is usually used for, regardless of what other information a thief has.

Phishing sits at the entry point of most of this: a single convincing fake login page can capture a password, and depending on the site, potentially trigger further exposure (a password reset flow, security questions, or linked account access). The follow-up matters more than the initial mistake — anyone can click a well-crafted phishing link once; changing the affected password immediately, and checking for reuse elsewhere, is what actually limits the damage.

None of these protections require constant vigilance once set up — a password manager, MFA, and a credit freeze are each largely 'set and forget' measures that meaningfully reduce exposure across almost every scenario this calculator scores, which is why they show up as the recommended action regardless of which specific flags triggered the score.