Some definitions from the web are:

Identity theft occurs when somebody steals someone else's name and other personal information for fraudulent purposes.

Stealing victims' personal information and credentials, often to make purchases.

The act of impersonating another, by means of using the person's information, such as birth date, Social Security number, address, name, and bank account information.

The co-option of another person's personal information (e.g., name, Social Security number, credit card number, passport) without that person's knowledge and the fraudulent use of such knowledge.

and from Wikipedia: Identity theft (or identity fraud,) occurs when someone wrongfully acquires or uses another person's personal data, typically for their own financial gain. Sometimes it is referred to as "identity fraud" since the criminal impersonates rather than 'removes' the victim's identity.

Most of these definitions refer to financial gain. For the criminal there usually is a substantial financial gain. For the victim, the loss is usually much more then financial. Credit theft is the most common form of identity theft. It is the reason there is so much marketing around credit monitoring services. Unfortunately, only about 28% of the identity theft crimes are credit related. It's unfortunate because credit is much easier to repair then the damage caused by most other forms of identity theft. More about this in Identity Theft (Part II).

What identifies a person? First, take a small town view. In most cases a person is clearly identified by their first name or a nick name, and sometimes via a relationship to another person in town. That identity is usually good for a lot. Even today, in many small towns, a local can buy goods at the local mom and pop with just a smile and "put it on my tab". Try that at Wal-mart. So outside of small town USA how is business done? In many cases it's credit. Maybe not as friendly as the small town approach, but usually more reliable. The down side is it's not really a person that is identified. It's an account. An account that is represented by a number. A number that is link to some other numbers, a name and an address. And of course there are millions of accounts, names and addresses. How does a business validate the person before them with a credit card is really the person behind the credit in the first place? The business can't validate this, and that is the dark area the criminal operates in. The only piece of data a criminal needs from you is your name and Social Security Number. With that little bit of information they can virtually recreate you at a different address, with tons of credit cards and possibly much much more.

There is a lot of advise on how to avoid identity theft. Shred your mail. Don't give personal or private information over the phone. Check the mail every day and stop mail delivery when out of town. Keep all documents safe and secure. Do this, do that, watch out, jump over this bar, duck under this bar, snake through this hoop and cross fingers and prey like heck. These are good procedures to follow. They just won't help when the government leaves millions of records unsecured, or AOL releases millions of personal searches, or a business is hacked and it's databases are compromised. Go to Google News and do a search on "identity theft". Read the stories. There are hundreds, thousands and sometime millions of identities compromised every day. It is not a matter of if, it's a matter of when virtually every personal identity will be compromised.

The probability that an identity will be compromised is nearly 100%. No one person has complete control over own data. Identity theft protection cannot be accomplished though personal protection of one's data. Is this sounding a little redundant? It's because this point is too important to miss. Preventing an identity form being compromised is not possible. Protecting your identity is possible.