Identity theft is a crime in which an attacker illegally obtains and uses another person's personal data — such as CNIC number, passwords, credit card numbers, or bank account details — for fraudulent purposes such as financial gain, impersonation, or accessing restricted services.
| Data Type | Examples |
|---|---|
| Financial | Credit/debit card numbers, bank account details |
| Identity | CNIC, passport number, date of birth |
| Credentials | Usernames, passwords, PINs |
| Contact | Email address, phone number, home address |
Phishing is a social engineering technique where attackers send deceptive emails or create fake websites that mimic legitimate organisations (banks, government portals) to trick users into entering their personal information.
Example: You receive an email claiming to be from your bank saying "Your account will be suspended — click here to verify." The link leads to a fake site that captures your login credentials.
Red flags of phishing:
paypa1.com)Attackers physically search through discarded documents (bank statements, utility bills, medical records) to find personal information.
Hackers compromise databases of companies or services, exposing millions of users' personal records at once.
Observing someone entering a PIN or password in a public place.
Malicious software installed on a device records keystrokes or captures screenshots to steal credentials.
MFA requires users to verify identity through two or more factors:
Trade-off: MFA significantly increases security but reduces usability by adding extra steps to the login process. This is a classic usability vs. security trade-off.
Encryption converts data into a coded format (ciphertext) that is unreadable to unauthorised users. Even if data is intercepted, it cannot be understood without the decryption key.
Many identity theft prevention measures introduce friction into the user experience:
| Security Measure | Security Gain | Usability Cost |
|---|---|---|
| MFA | High | Extra login steps |
| Complex passwords | High | Harder to remember |
| Password Manager | High | Initial setup effort |
| HTTPS enforcement | High | Minimal |
| Regular monitoring | Medium | Time investment |
Organisations and individuals must balance efficiency, cost, privacy, and ethics when choosing cybersecurity measures. A highly secure system that users find too cumbersome may lead to workarounds that reduce overall security.