While computerized identity theft can target consumers in any location, many criminals still favor good old-fashioned dumpster diving and mail theft, Foley says, which again makes high-density population areas attractive to thieves.

Popular tourist areas like Las Vegas that attract pickpockets are also a breeding ground. "Identity thieves -- that's who pickpockets sell to," Foley says. "They're not interested in that Rolex on your wrist; they want your wallet with the private information in it -- and they know exactly who to sell it to." This is another reason, she points out, not to keep your Social Security card in your wallet.

Foley also notes that California, Arizona, Texas (No. 4) and Florida (No. 6) have more people coming into the country illegally who need new identities.

It's demography, not geography
Meanwhile, Arizona officials attribute their dubious perch at the top to a couple of key demographic trends: a large elderly population that isn't always attuned to the latest identity-theft tactics, and high methamphetamine use.

"Identity theft seems to be the trade of choice for meth users," says Andrea Esquer, spokesperson for the Arizona State Attorney General's Office.

In California, No. 3 on the list, Detective Jim Clausen of the Sacramento County Sheriff's Department seconds that. He's been investigating identity theft for nine years and says that drugs and identity theft "go hand in hand." That's because it's a fairly easy and nonviolent way to finance a drug habit, says Clausen. "It's not difficult to do," he says. "Years ago, if someone wanted to fabricate a check, it used to be a lot cruder." Now, computers are capable of creating fakes that fool banks. (For more, read here.) The use of technology has also made Clausen's job more difficult, he says, noting that "cases are more complicated, have more victims and you have more networked cases with multiple suspects."

Another theory behind the rankings: In the states where law enforcement has been cracking down on identity theft and educating its citizens, consumers are more apt to report being victimized. That's the explanation Nevada's state attorney general's office would like to believe about the state's No. 2 ranking, though public information officer Nicole Moon concedes there's no data to back that up.

Is your state next?
What everyone seems to agree on is the need for tougher laws. Clausen, who says he's never seen the problem at such a high level, attributes it in part to the fact that in most cases, financial crimes are "wobblers" that can be prosecuted either as misdemeanors or as felonies. "The crimes should be straight felonies and the punishments should be a lot harsher," he says.

Right now, California is thought of as the model state for breach-notification laws. It requires businesses, nonprofits and government organizations to notify consumers when an unauthorized party gains access to their personal information. California is also one of several states with freeze laws that allow consumers to lock their credit reports and prevent information from being given out without their express permission. As of the end of June, at least 14 other states similarly required breach-notification; nine had passed freeze laws.

But Foley, of the Identity Theft Resource Center, notes that federal bills currently wending their way through Congress would weaken many of these laws. And the federal bills don't obligate the government to notify consumers when their private information has been accessed, Foley says. This includes state colleges; nearly half the data breaches since January 2005 have occurred at universities.

Foley and others would like to see federal standards that can be improved upon by individual states as they see fit. But if laws are not equally tough across all states? "I'll make a prediction right now that the identity thieves are going to migrate to (states with) no information protections in place," she says.

What you can do
To find out whether your state is soft or tough on financial crimes, check here for a list of states with freeze laws. Check here (PDF) for states with breach-notification laws. Don't like what you see? Contact your state representative and ask for stricter protections.

In the meantime, take steps to protect yourself.