Aggravated identity theft is a criminal offense involving the misuse of another person’s identifying information during certain underlying crimes, such as fraud, access-device abuse, or related cyber offenses. In practice, the “identifying information” can include names, account details, authentication codes, government identifiers, or other data used to impersonate a victim.
In cyber security, the term matters because attackers often do not need to break encryption or exploit software flaws if they can steal a victim’s identity artifacts and use them to gain access, reset accounts, or authorize transactions. It commonly appears in phishing, account takeover, and social engineering cases where stolen credentials or verification codes are used to act as the real user. Defenders reduce this risk with phishing-resistant authentication, strong identity verification, alerting on unusual sign-in activity, and user training that treats unexpected code requests as suspicious.