New Report Reveals Scams Are No Longer The #1 Identity Theft Threat. Here's What Is

A new report finds the bigger identity threat in 2026 isn't a smooth-talking scammer. It's your own phone.

The Identity Theft Resource Center (ITRC) released its 2026 Trends in Identity Report on June 9. Among people who turned to the ITRC for help, unauthorized access to phones and computers jumped 78% year over year. For adults aged 35 to 64, hacked devices have now passed scams as the single most common way identities get stolen for the first time.^[1]

For years, staying safe online mostly meant avoiding phishing scams and malicious downloads. But now, criminals can pull saved passwords and verification codes straight off your device, then use them to open new accounts or drain the ones you already have.

Below, we break down what the report found, the warning signs your phone has been compromised, and the steps that actually lock it down.

What the ITRC report actually found

The ITRC is a nonprofit that provides free, one-on-one help to victims of identity crime, and its annual report draws on the real cases it handles. This year's data covers 9,253 cases from 6,188 people who contacted the center between April 2025 and March 2026, according to the ITRC's announcement.

The standout number is the rise in device hacking. Unauthorized access to computers and mobile devices climbed 78% year over year, going from 15.3% of all identity compromises to 27.2%. Over the same stretch, scams that trick people into sharing personal information fell from 43.1% to 36.1%. Put those two trends together, and you get the milestone: for adults aged 35-64, getting hacked now beats getting conned.

Crimes are also piling on top of each other. The report found that 25.6% of victims were juggling two or more identity incidents at once, up from 23.5% the year before. The ITRC calls these "multi-layered" crimes. One compromise sets off a chain reaction. A compromised email or hacked phone lets a criminal intercept the verification codes that would normally warn you about everything else.

"Identity crimes are no longer isolated, single events," said Mona Terry, the ITRC's Chief Operating and Programs Officer. "A single compromise can trigger a chain reaction that spreads across multiple accounts and institutions, making it much harder for people to recover."

One caveat worth keeping in mind: the ITRC is clear that this data reflects the people who reached out to it, not a random national sample. It shows where the threat is heading for real victims, not a precise nationwide rate.

What this shift means for you

The same ITRC report found that recovery gets dramatically harder once money is involved. Among victims who reported no financial loss, 53% resolved their case. Among those who took any financial hit, only 9% did. For people facing three or more financial consequences, the resolution rate was zero.

Device hacking tends to lead straight to financial damage. Mobile malware can quietly harvest data from your phone, including passwords and one-time codes that protect your bank and email accounts.

Most people feel underprepared for exactly this. In an All About Cookies survey of 1,000 U.S. adults, 48% said they don't feel they have adequate protection against identity theft, and 14% had already had their identity stolen. More than a quarter of victims (27%) said they had no idea how thieves got their data in the first place. A quiet device compromise is exactly the kind of attack that leaves no obvious trail.

How to tell if your phone is hacked

A hacked phone rarely announces itself. Instead, it leaves a trail of small oddities, and the warning sign is usually a cluster of them showing up together rather than any single glitch. Watch for these signs that your phone is hacked:

• Your battery drains much faster than normal, or the phone runs warm when you aren't using it. Hidden processes running in the background eat power.
• Data usage spikes without a change in your habits. Malware often sends information out in the background.
• Apps you don't remember installing show up on your home screen, or you get flooded with pop-up ads.
• You receive two-factor authentication codes you never requested. That is a strong sign someone already has one of your passwords and is trying to get in.
• Settings change on their own, like location sharing switching on, or your camera or microphone indicator lights activate when you aren't using them.
• Friends report messages or posts from you that you never sent.

None of these alone proves a hack. Overheating can just mean an old battery. But when several land at once, treat it seriously. For a deeper walkthrough by operating system, see our guide on whether your phone is hacked.

How to lock down your phone right now

You don't need to be technical to close the most common gaps. Work through these steps in order.

If you think your phone may already be compromised:

1. Run a security scan with a trusted antivirus app and remove anything it flags. Our step-by-step guides cover how to remove malware on iPhone and how to remove malware on Android.
2. Delete any app you don't recognize or no longer use.
3. Change the passwords on your most sensitive accounts from a different, trusted device. Start with email, then banking, then your phone carrier account.
4. As a last resort for a stubborn infection, back up your photos and contacts, then do a factory reset.

If you want to prevent a compromise in the first place

1. Install the latest operating system update and turn on automatic updates. Most phone hacks exploit known flaws that have already been patched.
2. Replace reused passwords with strong, unique ones for every account, and store them in a password manager so you don't have to remember them.
3. Turn on two-step or multi-factor authentication wherever it's offered, and use an authenticator app instead of text messages whenever you can.
4. Lock down your phone carrier account with a PIN to make SIM swaps harder.
5. Consider identity theft protection with monitoring, so that if something does slip through, you find out early. In an All About Cookies survey, 71% of victims who subscribed to a monitoring service were alerted to the theft by that service, compared with just 20% of those who didn't.

Bottom line

The 2026 ITRC report shows the identity theft threat shifting from phishing schemes to attacks on your devices, with hacked phones now overtaking scams as the leading way identities are stolen for adults aged 35 to 64.

The fix is the same set of basics done consistently: keep your phone updated, use complex passwords with a password manager, turn on multi-factor authentication, and add monitoring so a quiet compromise doesn't become a financial one.

If your phone is already showing several warning signs, scan it, change your key passwords from another device, and act today rather than later.