An identity theft mitigation system. The system comprises a mobile communication device transfer data store, a non-transitory memory, a processor, and an application stored in the non-transitory memory. When executed by the processor the application monitors transfers of mobile communication device credentials between different mobile communication devices and stores records of the transfers of mobile communication device credentials in the mobile communication device transfer data store. The application further identifies when a mobile communication device is involved in a number of credential transfers that is above a predefined threshold during a period of time based on searching the mobile communication device transfer data store for records of transfers the mobile communication device was involved in, and takes action based on the number of credential transfers in which the mobile communication device is involved exceeding the predefined threshold.