2022's States Most Vulnerable to Identity Theft & Fraud

In recent years, many Americans’ personal information has become compromised by big data breaches. In 2022, the average data breach in the U.S. cost $9.44 million and took 277 days to identify and contain. Several big companies and organizations were impacted, including Microsoft, Cash App and the Red Cross.

Each new year brings new strategies taken by identity thieves and fraudsters, but older schemes, such as tech support scams and fake IRS calls, still abound. Some Americans are more susceptible than others to such crimes, though. In order to determine who is most likely to be exposed to and affected by identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across 14 key metrics. Our data set ranges from identity-theft complaints per capita to the average loss amount due to fraud.

Main Findings

States With the Most Identity Theft & Fraud

*No. 1 = Most Vulnerable
With the exception of “Total Score,” all of the columns in the table above depict the relative rank of that state, where a rank of 1 represents the worst conditions for that metric category.

Identity-Theft Complaints per Capita

Most

• T-1. Rhode Island
• T-1. Kansas
• T-1. Illinois
• 4. Louisiana
• 5. Georgia

Fewest

• 47. Alaska
• 48. Iowa
• 49. Wyoming
• 50. Montana
• 51. South Dakota

Best State vs. Worst State: 38x Difference

Rhode Island vs. South Dakota

Avg. Loss Amount Due to Online Identity Theft

Highest

• T-1. Vermont
• T-1. Nebraska
• T-1. California
• 4. Massachusetts
• 5. Minnesota

Lowest

• 47. Alaska
• 48. Rhode Island
• 49. Indiana
• 50. Montana
• 51. Nevada

Best State vs. Worst State: 21x Difference

Vermont vs. Nevada

Fraud Complaints per Capita

Most

• 1. District of Columbia
• 2. Georgia
• 3. Maryland
• 4. Delaware
• 5. Nevada

Fewest

• 47. Wyoming
• 48. Nebraska
• 49. Iowa
• 50. North Dakota
• 51. South Dakota

Best State vs. Worst State: 3x Difference

District of Columbia vs. South Dakota

Avg. Loss Amount Due to Fraud

Highest

• 1. Hawaii
• 2. Nevada
• T-3. Alaska
• T-3. California
• 5. Florida

Lowest

• 47. Ohio
• 48. Missouri
• T-49. Kentucky
• T-49. West Virginia
• 51. Vermont

Best State vs. Worst State: 2x Difference

Hawaii vs. Vermont

Show More

Quick Tips for Avoiding Identity Theft & Fraud

• Emphasize Email Security: It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account.
• Sign up for Credit Monitoring: Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report.
• Leverage Account Alerts & Update Contact Info: Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard.
• Use Common Sense Online: Don’t open emails you don’t recognize. Don’t download files from untrustworthy sources. Don’t send account numbers and passwords via email or messenger applications. And don’t enter financial or personal information into websites that lack the “https” prefix in their URLs.

For more tips and information, check out WalletHub’s Identity Theft Guide.

Ask the Experts

As an internet-oriented culture, it’s natural to wonder whether and how our daily habits assist hackers in stealing our personal information. We consulted a panel of experts for answers to such questions and advice on how to safeguard our data against cybercriminals. Click on the experts’ profiles to read their bios and thoughts on the following key questions:

1. What can individuals do to guard against identity theft?
2. Should victims of identity theft be able to change their Social Security number? How can we make this number more difficult to steal and use (e.g., add more digits)?
3. What are some common scams and fraud attempts people should be vigilant about?
4. Is the expansion of social media facilitating more identity thefts?
5. Should the Federal government intervene to establish a clear process for victims of identity theft looking to clear their name?

Ask the Experts

Roman V. Yampolskiy
Ph.D. – Distinguished Teaching Professor (Tenured), Director – Cyber Security Laboratory, Computer Science and Engineering – J.B. Speed School of Engineering, University of Louisville
Read More

Lori Sussman
Assistant Professor of Technology and Cybersecurity; Director, USM Cybersecurity Awareness, Research, and Education Support (CARES) Center; Coordinator: Cybersecurity Graduate Studies; Trustee for the Beta Xi Chapter, Epsilon Pi Tau Technology Honor Society; Department of Technology – University of Southern Maine
Read More

Katina Michael
Professor, School for the Future of Innovation in Society and Professor, School of Computing and Augmented Intelligence – Arizona State University
Read More

Methodology

In order to determine where American consumers are most vulnerable to identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across three key dimensions: 1) Identity Theft, 2) Fraud and 3) Policy.

We evaluated those dimensions using 14 key metrics, which are listed below with their corresponding weights. Each metric was graded on a 100-point scale, with a score of 100 representing the most vulnerable.

Finally, we determined each state and the District’s weighted average across all metrics to calculate its overall score and used the resulting scores to rank-order our sample.

Identity Theft – Total Points: 47.5

• Identity-Theft Complaints per Capita: Full Weight (~15.83 Points)
• Change in Identity-Theft Complaints per Capita (2021 vs 2020): Full Weight (~15.83 Points)
• Average Loss Amount Due to Online Identity Theft: Full Weight (~15.83 Points)
  Note: This metric was calculated using the following formula: Total Loss Amount / Total Number of Online Identity-Theft Complaints.

Fraud – Total Points: 47.5

• Fraud & Other Complaints per Capita: Full Weight (~9.50 Points)
• Change in Fraud & Other Complaints per Capita (2021 vs 2020): Full Weight (~9.50 Points)
• Median Loss Amount Due to Fraud: Full Weight (~9.50 Points)
  Note: “Total reported amount paid” is based on the total number of fraud complaints for which the amount paid was reported by the victims. The amount paid ranges from $1 to $999,999.
• Persons Arrested for Fraud per Capita: Full Weight (~9.50 Points)
• E-Commerce Attack Rates: Full Weight (~9.50 Points)

Policy – Total Points: 5.0

• Availability of Security-Freeze Law for Minors’ Credit Reports: Full Weight (~0.83 Points)
  Note: This binary metric considers the presence or absence of legislation allowing parents, legal guardians or other representatives of minors to place a security freeze on the minor’s credit report.
• Availability of Identity-Theft Passport Program: Full Weight (~0.83 Points)
  Note: This binary metric considers the presence or absence of Identity-Theft Passport programs that help victims of identity theft reclaim their identity. When presented to a law-enforcement agency, an “identity-theft passport” allows a victim to prevent his or her arrest for offenses committed by an identity thief.
• Data Disposal Laws by State: Full Weight (~0.83 Points)
  Note: This is a binary metric that measures the presence or absence of data disposal laws in each state. Businesses and government collect personal information and store it in various formats-digital and paper. Several states have enacted laws that require entities to destroy, dispose or otherwise make personal information unreadable or undecipherable.
• Presence of State Laws Addressing "Phishing": Full Weight (~0.83 Points)
  Note: This is a binary metric that measures the presence or absence of laws addressing “phishing” in a state. “Phishing” is a cybercrime in which a target is contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.
• Presence of State Spyware Laws: Full Weight (~0.83 Points)
  Note: This is a binary metric that measures the presence or absence of laws addressing “spyware” in a state. “Spyware” is classified as a type of malware, malicious software designed to gain access to or damage your computer, track your online activities or collect confidential information.
• Presence of Statewide Cybersecurity Task Forces: Full Weight (~0.83 Points)
  Note: This is a binary metric that measures the presence or absence of cybersecurity task forces in a state.

 
Sources: Data used to create this ranking were collected from the Federal Trade Commission, Internet Crime Complaint Center, Federal Bureau of Investigation, Experian Information Solutions and National Conference of State Legislatures.

Supporting Video Files:

• YouTube (for web embedding)
• Raw video files (for editing into clips)