Perhaps you’ve read articles or seen news reports on identity theft and the latest identity theft scams. Maybe you’ve taken some basic precautions — you shred your mail containing credit card offers and financial information, you check your credit report regularly, and you use strong passwords for all financial accounts.

To get around new security measures, thieves have become smarter and are constantly coming up with new ways to steal personal information and commit fraud. This means you must constantly stay on top of information about new schemes and precautions. In the case of identity theft, what you don’t know can definitely hurt you.

Here are three things about identity theft that may surprise you:

1. Identity thieves are filing taxes.

Yes, it seems like the last thing a criminal would do — file with the IRS. But tax identity theft is when a criminal files a fraudulent tax return using your personal information with the intention of stealing your refund. Most people don’t know what has happened until they file their own return. At this point, it’s hard to find the criminal because many deposit the refund to a difficult-to-track prepaid credit card. To prevent becoming a victim, file your tax return early — because the IRS only allows one return per SSN.

2. You are at highest risk for being a victim of fraud when shopping online.

Buying online is part of everyday life for many people these days and in 2016 79 percent of American consumers have bought something online. Roughly 8-in-10 Americans shop online, with 15% who buy online on a weekly basis. The 2018 Identity Fraud Study by Javelin Strategy & Research notes that despite industry efforts to prevent identity fraud, fraudsters netted 1.3 million victims in 2017. With the adoption of EMV (embedded chip) cards and terminals, the types of identity fraud continued to shift online and away from physical stores, making online shopping riskier. Card Not Present Fraud is now 81% more likely than Point of Sale fraud.

3. Applying for a mortgage can increase your risk of identity theft.

After you apply for a mortgage or preapproval, the credit ureaus sell the fact that you are in the market for a mortgage to companies that sell mortgage products. This is called a “mortgage trigger lead.” Criminals use this information to call people who have recently applied for a mortgage and ask personal questions to gain information they can use to commit fraud. If someone calls you about a lower-cost mortgage, verify their identity, ask if they can mail you the information, and don’t give out sensitive information over the phone.

Identity theft isn’t something you can just learn about once and assume you know how to protect yourself. To protect yourself and your financial future, you must stay informed and constantly learn about new ways criminals are committing identity fraud.