How to Calculate Your Identity Theft Exposure: The 4-Variable Formula for Homebuyers, Points Collectors, and Side Hustlers (September 2026)
Three people read the same Friday headlines. NerdWallet's "Mortgage Rates Today, Friday, September 18: No Change" says rates took a breather while bond markets digested the week's Fed news. The Bureau of Labor Statistics page ("Major Economic Indicators Latest Numbers") shows CPI +0.4% in August 2026, an unemployment rate of 4.1%, and payroll employment of +162,000 (preliminary).
One reader is lining up a home purchase with down payment assistance. One just booked a family cruise to chase a million points. One is picking a side hustle. In the worked example below, their identity theft exposure ceilings come out at $53,200, $16,400, and $5,200. The gap between the first and last is more than 10x, and it comes from four variables that a "$200 to $47,000" range never asks about.
This is the formula, with every step shown so you can swap in your own numbers.
Why the one-number answer fails you
Most identity theft advice gives you a range and leaves you to guess where you sit in it. The range is real. In earlier Pavelinox breakdowns I've used these planning figures for all-in recovery cost by fraud type:
| Fraud type | Working figure |
|---|---|
| Credit card fraud | $200 |
| Tax or payment-app fraud | $3,200 |
| Rewards and travel fraud | $8,500 |
| Mortgage fraud | $47,000 |
These are planning assumptions, not measurements. Your real number could land well above or below them, which is the point of the rest of this post. For a fuller tour of the ranges, see identity theft recovery costs by fraud type.
The 4 variables
Variable 1: Credit-file openness. Are you about to apply for a mortgage, or are you carrying only existing cards? Use $47,000 if a mortgage is in play and $200 if it's cards only.
Variable 2: Stored value. What could someone drain from your accounts in one session? Points and miles balances, cash apps, and brokerage cash all count. Use your actual balance in dollars, not a category average.
Variable 3: Income-document footprint. How many organizations hold your Social Security number plus tax documents? Use $3,200 if you file as self-employed, get 1099s, or hand tax returns to third parties. Use $0 if you don't.
Variable 4: Your time. Hours to recover × what an hour of your time is worth. Skip this variable if your version of Variable 1 or 3 already includes time, so you don't double count. My working figures are out-of-pocket and fees, so I add time separately.
Ceiling = V1 + V2 + V3 + V4.
This is a stress-case ceiling, not a prediction. Adding all four assumes the worst case shows up in each category. The ceiling tells you how much is on the line, not how likely a loss is. The break-even section below handles likelihood separately.
What this week's five articles change in the variables
The cruise article moves Variable 2
NerdWallet's "How I Earned 1 Million Points With My Family Cruise Booking" describes how booking through an airline-branded cruise portal can earn thousands of miles and possibly elite status, especially with an airline credit card. If you follow that playbook, you now have a large balance sitting in a loyalty account.
Points are stored value. In my example I price them at 1.5¢ each, an assumption, because point values vary by program and redemption:
1,000,000 points × $0.015 = $15,000
That's $6,500 above the $8,500 rewards-fraud planning figure. It's the reason a flat number breaks down for anyone with a big balance. At 1¢ per point, the value is $10,000, which still exceeds the flat figure. I compared the flat range with a real balance in 1 Million Points or a $47,000 Mortgage Fraud Bill.
The homebuying article moves Variables 1, 3, and 4
NerdWallet's "Locked Out: Should You Take 'Free Money' to Buy a Home?" says homebuying assistance programs can lower your upfront costs, but you should weigh the trade-offs first. Add one more trade-off to that list: every program you apply to is another organization asking for your documents.
In my example, a buyer shopping four lenders and one assistance program means five organizations holding an SSN, pay stubs, bank statements, and tax returns. That's an example count, not a statistic. Your count is whatever you actually submit to. More touchpoints raise the number of places a leak could happen and the number of places you'd have to contact during recovery, which pushes up Variable 4.
The side-hustle quiz moves Variable 3
NerdWallet's "Quiz: What's the Best Way to Make Money?" helps readers find a side hustle that fits (feet pics and plasma didn't make the list, thankfully). The exposure angle is that new income means new documents. Platform payouts, 1099s, and a tax return with a Schedule C are all things someone can file against you before you do. That's why Variable 3 flips from $0 to $3,200 the day the side income starts.
The mortgage rate article moves timing, not dollars
"No Change" on September 18 means there was no daily move forcing anyone's hand. Rushing to lock a rate is when people skip verification steps, like confirming a lender is legitimate, sending documents through a secure portal, and checking who receives them. A flat-rate day isn't a reason to slow down your purchase, but it means you can afford to verify each lender before you send anything.
The BLS numbers scale everything
CPI rose 0.4% in August. If that pace repeated every month for a year, the math is:
1.004¹² ≈ 1.049, or about 4.9% higher
That's an illustration of sensitivity, not a forecast, and recovery costs don't track CPI one-for-one. Still, on the $47,000 mortgage figure, 4.9% is roughly $2,300. The 4.1% unemployment rate and the +162,000 payroll number matter for a different reason. If you're job hunting or changing jobs, more employers and background-check vendors hold your SSN. The BLS summary lists average hourly earnings at +$0.10 (preliminary) for the month but doesn't give the level in the excerpt. For Variable 4, use your own hourly value.
This is the kind of analysis Pavelinox runs for you, so you don't have to build the spreadsheet yourself.
Worked example: three profiles, one formula
Everything below is an example using my working figures and an assumed $30/hour time value. Your numbers will differ.
| V1: Credit file | V2: Stored value | V3: Income docs | V4: Time | Ceiling | |
|---|---|---|---|---|---|
| Sam, homebuyer with assistance, 4 lenders | $47,000 | $0 | $3,200 | 100 hrs × $30 = $3,000 | $53,200 |
| Dana, cruise family with 1M points | $200 | $15,000 | $0 | 40 hrs × $30 = $1,200 | $16,400 |
| Alex, new side hustle, renting | $200 | $0 | $3,200 | 60 hrs × $30 = $1,800 | $5,200 |
Some notes on the table:
- Sam's ceiling is dominated by Variable 1. Mortgage fraud is the only category here where the ceiling exceeds most people's monthly income many times over.
- Dana's is dominated by Variable 2. At 1¢ per point, her ceiling drops to $11,400. At 2¢, it rises to $21,400. Her exposure depends almost entirely on how she values the points, so run your own valuation.
- Alex's ceiling is the smallest, and that's fine. A $5,200 ceiling is a real number that deserves attention, but it doesn't call for the same response as Sam's.
If Sam applied the 4.9% CPI sensitivity from above to his ceiling: $53,200 × 1.049 ≈ $55,800.
The break-even math on paid protection
Assume a paid protection plan costs $29 a month, which is $348 a year. That price is an example, and plans vary. The question isn't "is protection good?" but "does what it saves me exceed $348, weighted by the chance I need it?"
The formula:
Break-even probability = $348 ÷ (ceiling × share of the ceiling the protection removes)
I'll assume protection removes 30% of the ceiling, through faster restoration (fewer hours), alerts that catch fraud earlier, and reimbursement where offered. That 30% is an assumption, and I'll test it below.
| Profile | Ceiling | 30% reduction | Break-even probability |
|---|---|---|---|
| Sam | $53,200 | $15,960 | 2.2% |
| Dana | $16,400 | $4,920 | 7.1% |
| Alex | $5,200 | $1,560 | 22.3% |
How to read this: for Sam, paid protection pays for itself if he believes there's at least a 2.2% chance per year of a ceiling-level event. For Alex, it would take a 22.3% chance, which is a much higher bar. For someone whose ceiling is only $200, 30% is $60, which is less than $348, so protection can't break even at any probability.
Because the ceiling is a stress case, the real break-even probability is higher than these figures. A typical incident won't hit every category. I'm not going to hand you a probability I can't source. That input has to come from your own judgment about your exposure.
Sensitivity to the 30% assumption
Take Sam:
| Share removed | Value | Break-even probability |
|---|---|---|
| 10% | $5,320 | 6.5% |
| 30% | $15,960 | 2.2% |
| 50% | $26,600 | 1.3% |
The answer swings by about 5x depending on how much you believe protection actually helps. If the plan you're considering only offers alerts and no restoration help, use the low end. If it includes hands-on restoration and reimbursement, read the terms closely and consider the higher end. For a deeper comparison, see free identity monitoring vs. $29/month protection.
You can model this for your specific situation at Pavelinox.
The honest trade-offs
Case for paying: if you sit where Sam does, with a large Variable 1 and a low break-even probability, $348 is small relative to the ceiling. Restoration help also shrinks Variable 4, which is the part of recovery you can't outsource yourself.
Case against paying: you may get much of the benefit for free. A credit freeze costs nothing, and so does an IRS Identity Protection PIN if you're eligible. Card alerts and account-level two-factor authentication also cost nothing. The freeze trade-off is friction. A freeze has to be lifted when a lender pulls your credit, which matters if you're shopping four lenders. How easy that is varies by bureau and lender, so check before you start.
Where each option fails: free tools don't do your paperwork if something goes wrong. Paid tools don't stop a breach. Neither replaces verifying who receives your documents.
For most people I'd expect the answer to be a mix: freeze and alerts for everyone, and paid restoration only where the ceiling justifies it. But that's a general pattern, and the math for your situation may say otherwise. The 5-trigger decision checklist walks through the specific triggers that flip the answer.
Run this with your numbers
Your numbers will differ from Sam's, Dana's, and Alex's in every column. Here's a quick way to run it:
- V1: Are you applying for a mortgage or other large loan in the next 12 months? Yes = $47,000. No = $200.
- V2: Add up points, miles, and cash-app balances in dollars at your own valuation.
- V3: Do you file self-employed, get 1099 income, or send tax returns to third parties? Yes = $3,200.
- V4: Estimate recovery hours and multiply by your own hourly value.
- Total the four for your ceiling, then divide $348 by 30% of it to get your break-even probability.
Then ask whether you believe your annual chance is above that number. If you're between two answers, run it again at 10% and 50% to see how much the decision depends on the assumption.
For a longer version of this formula with more variables, the 4-variable exposure calculator from September shows how it works with mortgage and CPI inputs.
The bottom line
Same headlines, same rates, and three very different ceilings: $53,200, $16,400, and $5,200. That's the case for running the numbers instead of applying a rule of thumb.
If you want the math done for your own mortgage timing, rewards balances, and income documents, you can run it at Pavelinox. Whatever the result, you'll know which number you're actually protecting against.
Sources
- Major Economic Indicators Latest Numbers — Bureau of Labor Statistics
- How I Earned 1 Million Points With My Family Cruise Booking — NerdWallet
- Locked Out: Should You Take ‘Free Money’ to Buy a Home? — NerdWallet
- Quiz: What’s the Best Way to Make Money? — NerdWallet
- Mortgage Rates Today, Friday, September 18: No Change — NerdWallet