Identity thieves are successful because they know that certain assumptions about how people will behave are generally true. For example, they know that many people want something for nothing. They also know that many people think they know more than they actually do, and so become over-confident. They also know that many people are careless with personal data simply because they aren't fully aware of the dangers out there, both on-and off-line, much less able to recognize them.
As a result, millions of people are extremely susceptible to "phishing" attacks - emails purporting to be from someone else in an attempt to gather personal information that can be used for criminal gain.
In a "phishing" attack, a person gets an email from, say, PayPal, asking them to confirm their account for one reason or another by clicking on a link in the email. Amazingly, even people who don't have PayPal accounts have clicked on these links and provided all sort of information, including social security numbers, credit card numbers, mother's maiden name, and other personal information that can then be used to open credit card accounts (which are then maxed out) and other financial crimes.
The easiest and best way to protect yourself against identity theft through "phishing" attacks? Don't click on any links in emails. Its as simple as that. (As an aside, remember that NO legitimate business will ask you - in an email - for ANY personal information. Not your name. Not your account number. Not your password. Nothing. Think about it this way...if they send you an email saying they have lost your account records and need you to confirm them, how do they know how to get ahold of you?)
While attempted Internet identity theft happens daily, more identity theft actually occurs offline. Lost or stolen wallets, misappropriation by family or friends, and theft of your mail from your mailbox or trash are among the most common ways thieves gain access to your personal information.
Credit card companies bombard us with credit card offers. All you have to do is fill out the information and send it in. Some companies even include the credit card! Simply throwing these applications in the trash is not enough. If you don't have a paper shredder...you can get one for $25...tear all those applications into pieces so that identity thieves cannot use them to apply for cards in your name. You can also call these companies and ask that your name be removed from their mailing lists.
Protecting yourself from identity theft is as simple as making sure you don't inadvertently provide your identity to strangers either online or off.