Identity theft: what is it and why it matters

I was exchanging messages on LinkedIn recently with a recruiter. They asked me to download a ZIP file containing information about a position.

A week later, LinkedIn sent me a message saying the recruiter I thought I was talking to was actually an impostor. The genuine person’s identity or account had apparently been used to gain my trust (a common way this happens is through insecure passwords).

Identity theft does not stop with the person whose identity was stolen. That is serious enough, of course, but if I had downloaded and opened the ZIP file, I could have become a secondary victim of the same crime.

What is identity theft?

Identity theft happens when someone uses another person's name, account, photograph, email address or other personal information to pretend to be them.

Sometimes the aim is financial fraud. In other cases, the stolen identity is used to gain trust.

A fake recruiter, delivery company, bank employee or even a friend may look convincing because the name, profile and contact details belong to a real person or organisation.

The person contacting you may not be who they appear to be.

Why does it matter?

An identity can be used to:

• persuade you to open a malicious file
• trick you into revealing a password or security code
• convince you to transfer money
• collect personal information
• gain access to your workplace or online accounts
• impersonate you when targeting somebody else

This means identity theft can spread. One compromised account can be used to target dozens or hundreds of other people.

What should you look out for?

Be cautious when someone:

• unexpectedly asks you to download a file
• sends a link to a login page
• creates urgency or pressure
• asks for passwords, PINs or security codes
• moves a conversation away from a trusted platform
• offers an opportunity that seems unusually generous
• refuses to verify their identity another way

A familiar name or professional-looking profile is not proof that the person is genuine.

What can you do?

Before opening a file or following a link:

1. Check the person's profile carefully.
2. Confirm the request through another contact method.
3. Search for the company or organisation independently.
4. Avoid signing in through links sent in messages.
5. Keep your browser, phone and computer up to date.
6. Use strong, different passwords and turn on two-factor authentication or passkeys.
7. Stop if something feels rushed, unusual or difficult to verify.

In my case, waiting and checking prevented a bad situation from becoming much worse.

The important lesson is simple: online trust should be verified, even when the person contacting you appears familiar, credible or professional.