Stealing Digital Assets: From Financial Fraud to Identity Theft and Beyond

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.7 Free with a free account

Stealing Digital Assets: From Financial Fraud to Identity Theft and Beyond

Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.7 · lesson 84 of 11611 min · free with a free account

← Defacing Websites, Destroying Data, and Other Acts of Digital DestructionNext lesson: From Ancient Ciphers to Modern Algorithms: How the Art of Secret Writing Has Evolved →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Recognize what was taken and choose the right recovery action.

  • Distinguish identity theft, card fraud, and account takeover.
  • Explain password reuse and phone-number hijacking.
  • Describe cryptocurrency theft and the limits of reversing transfers.
  • Match each theft type with prompt, appropriate recovery steps.

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,377 words). Read along, or search it.

Chapter 13

Stealing Digital Assets

Digital theft can target an identity, a payment card, an existing account, or a phone number. These assets are related, but they are not interchangeable. This lesson explains the differences and why recovery must match the actual loss. We will examine how breached credentials create risk at unrelated services. We will also explain how hijacking a number undermines verification by text message. Next, we will consider cryptocurrency theft and why reversing transfers is often difficult. Prevention matters, but reporting a loss promptly still has value. Finally, we will compare practical recovery steps, including the U.S. identity-theft tools in the source. Determine what was taken, then choose the corresponding response rather than assume one action resolves every exposure.

A Family of Thefts

Related Attacks Target Different Assets and Require Different Responses

Identity theft misuses personal information to act in another person’s name. Card fraud instead uses a card or its details for unauthorized payments. Account takeover compromises a real account that already exists, rather than necessarily opening a new one. Phone-number hijacking redirects control of a number that may support verification elsewhere. These categories describe different assets, and they can overlap within the same incident. For example, a hijacked number may help an attacker recover an email account. Stolen personal details can also support several kinds of fraud. Identifying the actual asset and unauthorized activity helps choose the provider, recovery process, and protective action that matter.

Identity and Card Information

Replacing a Card Is Different from Resolving Identity Misuse

Identity theft can use a Social Security number, date of birth, or address. The misuse may open accounts, obtain services, or produce a fraudulent tax return. Long-lived personal information is not usually replaced as easily as a password. Its effects can recur, and recovery may continue for months or years. Card details can come from a stolen card, skimming, or a retailer’s breach. An issuer can often cancel the exposed number and issue a replacement relatively quickly. That replacement does not automatically settle disputes, and protections depend on card type and reporting time. Report promptly in either case, while distinguishing replaceable payment credentials from broader misuse of someone’s identity.

Existing Accounts

Takeover Can Misuse a Real Account and Lock Out Its Owner

Account takeover concerns unauthorized control or misuse of an existing account. The attacker may change credentials, locking the legitimate owner out of the service. Email, banking, and shopping accounts can each provide something valuable to misuse. An email account can also support recovery of other accounts, depending on their controls. Credential stuffing tests breached username and password pairs against other services. It relies on exposed credentials remaining valid, especially where passwords were reused. A complex password can still be exposed and reused; guessing its characters is unnecessary in that case. Successful login depends on the service’s other required checks; further misuse also depends on account permissions.

Cross-Site Consequences

One Breach Can Supply Credentials for Unrelated Services

The source’s diagram begins with breached login pairs becoming available outside the original service. Automated tests then try those pairs elsewhere; the second company need not have been breached. Many attempts fail because credentials do not match, have changed, or meet additional defenses. Reused credentials can nevertheless remain valid on another service. Successful access may allow funds to move or enable other fraud, depending on account capabilities. The consequences can surface months after the original breach. Use distinct passwords for different services, rather than rely only on one password’s apparent complexity. A password manager can help maintain those distinct secrets without requiring every one to be memorized. Credential stuffing is an important takeover route, but not the only one; phishing and other compromises can also provide access.

SIM Swapping and Port-Out Fraud

A Hijacked Number Redirects Codes, Not Every Account Automatically

A phone-number hijack can begin with personal details gathered from public information or an earlier breach. An attacker may impersonate the customer while requesting a fraudulent carrier change. A SIM swap moves service to another SIM controlled by the attacker. Port-out fraud instead transfers the number to an account at another carrier. Both can redirect calls and text messages intended for the owner. The legitimate phone may lose service, which requires investigation but can also have other causes. An intercepted text message may contain a login or recovery code. That undermines the text-message factor, without automatically supplying every password or bypassing all other checks. For an account that relies on the number, the outcome also depends on other verification and recovery controls.

Cryptocurrency Theft

Account Deception and Altered Destinations Can Both Lead to Loss

Cryptocurrency theft can start with phishing for credentials to a real exchange account. Phone-number hijacking can undermine that account’s text-message verification or recovery. Clipboard malware can instead replace a copied wallet destination before a transfer is confirmed. Checking the actual destination matters because a confirmed transfer typically cannot be undone by the sender. Ordinary card chargeback mechanisms do not apply to many cryptocurrency transfers. That makes prevention valuable, while recovery after theft can be difficult and uncertain. However, some platforms or assets have freezing mechanisms, and lawful seizure can sometimes recover funds. Those possibilities are different from reversing the original transaction; they neither guarantee recovery nor justify abandoning prompt reporting.

Identity Recovery and Credit Freezes

Restrict New Credit and Follow a Personalized Recovery Plan

The source’s identity-recovery guidance concerns U.S. tools, including the FTC’s Identity Theft website. Report the misuse at Identity Theft dot gov to obtain a personalized recovery plan. The plan provides relevant steps and documents, based on what information was stolen. A credit freeze restricts access to a credit report, helping prevent new credit using that report. Contact each of the three national bureaus: Equifax, Experian, and TransUnion. Placing and lifting freezes is free, and legitimate credit access may require temporarily lifting one. The freeze does not secure an existing account or undo every kind of identity misuse. Continue reviewing affected records, disputing fraudulent activity, and following the recovery steps specific to the actual loss.

Card and Account Recovery

Stop Unauthorized Use and Restore Control Through Real Providers

For card fraud, contact the issuer immediately through an independently established official channel. Request appropriate freezing or cancellation, dispute unauthorized charges, and arrange a replacement number. Protections and reporting deadlines differ by card type and circumstances; acting promptly matters. For account takeover, use the service’s official recovery process to restore control. Replace the compromised password, and change it on every other account that reused it. Use distinct passwords and enable an appropriate non-text verification method where the service offers one. Review account changes as part of recovery, rather than assume a new password settles every consequence. A recovery message can itself be deceptive, so reach the real provider through a known website, app, or other verified route.

Phone and Cryptocurrency Recovery

Act Promptly and Distinguish Public Addresses from Secret Credentials

For a hijacked number, contact the carrier immediately to reclaim control. Strengthen the cellular account’s PIN or password, and check related accounts for unauthorized changes. Where available, use an authenticator app or security key instead of relying on text codes. Review recovery options too, because they may still depend on the number. For cryptocurrency theft, promptly contact the relevant exchange or provider and report to law enforcement. Preserve transaction information that can support investigation, without sharing private keys or seed phrases. An exposed wallet secret must be treated as compromised; a public address alone is not that secret. Exchange action or lawful recovery may help in some cases, but neither is guaranteed. Be cautious about promises of certain recovery, especially requests from strangers for money or further sensitive information.

Key Terms

Connect Identity Misuse, Existing Accounts, Numbers, and Credit Reports

Identity theft concerns personal information used to act in another person’s name. Credential stuffing tests exposed login pairs against services where they may remain valid. Account takeover concerns unauthorized control or misuse of an existing account. SIM swapping moves number service to a fraudulent replacement SIM, while port-out fraud changes carriers. A credit freeze restricts report access to help prevent new credit accounts. Each term identifies a mechanism or protective tool, rather than every consequence of a theft. Distinct passwords reduce links between services, and stronger verification can reduce dependence on text messages. Those precautions support prevention, while an actual compromise still requires the appropriate provider and recovery process.

Review and Apply

Match the Cause, Exposed Asset, and Recovery Tool

Identity misuse can persist because long-lived personal information is difficult to replace. A card number can often be replaced faster, although disputes still require prompt attention. One breach can affect unrelated services wherever exposed credentials remain valid through reuse. A hijacked number redirects text codes to the attacker-controlled service, undermining that verification factor. Cryptocurrency prevention matters because confirmed transfers typically lack ordinary reversal, and recovery remains uncertain. A credit freeze targets report access used for new credit, rather than existing-account security. Different thefts can overlap, so more than one recovery action may be needed. Identify the exposed asset, contact the responsible provider promptly, protect related accounts, and follow the specific recovery plan.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Stealing Digital Assets: From Financial Fraud to Identity Theft and Beyond

What is credential stuffing?
Credential stuffing is an automated attack that tries username and password pairs leaked in one breach on other, unrelated websites. It works because many people reuse passwords, so the second site never needs to be breached itself. Even a long, complex password is useless once it is exposed and reused. The best defense is a distinct password for every service, which a password manager makes practical, plus multifactor authentication where available.
What is a SIM swap, and how is it different from port-out fraud?
A SIM swap moves a victim's phone number to a SIM card the attacker controls, while port-out fraud transfers the number to an account at a different carrier. Both usually start with the attacker impersonating the customer using stolen personal details, and both redirect calls and text messages, including login and recovery codes. Protect yourself with a carrier account PIN or password and by using an authenticator app or security key instead of text-message codes.
What should you do if your identity is stolen in the United States?
Report it at IdentityTheft.gov, the Federal Trade Commission's site, which creates a personalized recovery plan based on what was taken. Place a credit freeze with each of the three national credit bureaus, Equifax, Experian, and TransUnion; freezing and unfreezing are free. A freeze helps block new credit in your name but does not secure existing accounts, so also review statements, dispute fraudulent activity, and change passwords on affected accounts.
How do criminals steal cryptocurrency?
Criminals commonly steal cryptocurrency by phishing exchange login credentials, hijacking a phone number to defeat text-message verification, or using clipboard malware that swaps a copied wallet address for their own just before a transfer. Because a confirmed transfer usually cannot be reversed by the sender, double-check the destination address before sending. Never share a private key or seed phrase; anyone who has it controls the funds, although sharing a public address is safe.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →