When it comes to the risk of identity theft, death isn’t the end—it can often be the beginning.

It’s called ghosting, according to the AARP, and every year, the estates of 2.5 million deceased individuals are victimized by this form of identity theft.

Ghosting is a form of digital grave robbing. Using the personal information of a deceased individual, a thief can do a lot of damage before the deceased’s family even notices something is amiss. This is because it can take six months for financial institutions and credit-reporting bureaus to receive, share, or register death records. And since the dead don’t monitor their own credit, and it’s likely their family isn’t monitoring it either, a thief often has an extended period of time to commit further fraud.

Most often, a thief will randomly choose a Social Security number (not a targeted attack), but often ghosting is a crime of opportunity. Nearly 800,000 of those 2.5 million victims each year represent targeted attacks.

Thieves can glean personal information from obituaries, hospitals and funeral homes—information like birth date, home address, and full name. And with those pieces of information, a thief may be able to purchase the deceased’s Social Security number illicitly online.

In many instances, thieves will use the information they’ve gained to file tax returns under the identity of the dead and collect refunds. In fact, in 2011, the IRS paid out $5.2 billion in fraudulent returns.

While surviving family members are not responsible for fraudulent charges and tax filings, a thief can leave quite a mess to untangle in a loved one’s estate.