Identity theft rarely begins with a dramatic breach. More often, it starts with one exposed password, one recycled login, one careless click, or one overlooked