The report first distinguishes between "identity theft" and "identity fraud." "Identity theft" occurs when someone's personal information is taken by another individual without explicit permission. "Identity fraud," on the other hand, is the actual misuse of someone's personal information for financial gain. This occurs when offenders use illegally obtained personal information to make purchases or withdrawals in the victim's name, create false accounts or modify existing ones, and/or attempt to obtain services such as health care. The report next describes some methods criminals use to obtain another person's personal information (identity theft) for the purpose of committing identity fraud. The methods include searching trash for unshredded paperwork that contains personal or financial information, theft of mail from the individual's mailbox, or diversion of mail by a fraudster who changes the address in order to obtain the victim's account statements, and through a security data breach at a business or organization that stores personal information. The report then explains what a person should do after receiving a "breach notification" letter, which is notification that security has been breached in a company or organization that stores one's personal information. Recommended actions include monitoring financial accounts, closing affected accounts, placing a fraud alert on a credit report, and placing a credit freeze on an account with the three primary credit bureaus. The report concludes with listings of recommendations for how to prevent, detect, and resolve victimizations that involve identity theft and identity fraud. The recommendations are based on the results of a 2011 report on identity theft and identity fraud and are backed by the most up-to-date findings available on identity fraud. Appended glossary for common fraud scams and terms