So I actually worked for a credit card processor for awhile and now work at a credit monitoring/identity theft company. Unfortunately, we live in a brave new world and people work very hard to get your information and get well rewarded for it.

As far as the original poster, sounds like your buddy's information was stolen. Either a breach at one of the thousands of places that your ssn is uploaded to, malware on his computer, or he fell for a phishing scam. The last two are still one of the most common ways people lose their identities. CC breaches like those at Target and Home Depot, while large, only provides thieves with two things, the cc info(usually just # and exp) and then a zip of the store they were used at. Zip code is the only thing most companies use to do an address validation. Seeing how most people go to stores in their own zip code, this is very helpful to the bad people on getting good card numbers. Fraud charges on cc's are a pita, but are easily fixed and consumers almost never get stuck with the bill. Identity theft like the op's friend had is a little more difficult, and people using the ssn for stuff like IRS tax return and tax return fraud is a very bad experience.

While it all sounds horrible, its fairly easy to protect yourself for most of the bad things.
- Check your credit report. You get 3 free a year. One with each bureau. Don't use them all at once, use each one every four months to see if any new accounts have been opened. You can also set freezes with the bureaus where nothing can be opened without your permission, but its a pita as you have to reset every 90 days.
- Monitor your cc statements. With all the mobile apps and online tools, this is easy. You don't have to check 24x7, but keep tabs on them and report stuff if you don't recognize them. Alot of times, thieves run test charges for $1 or so on random online stuff to see if the card is good before going app sh!t with it.
- Protect yourself! Understand what phishing scams are and how to identify them. My wife can still fall for them to this day if I don't stay on her. Also....virus scans all the time. At one point malware was just a pain. Now it can lead to anything from turning your machine into a bot or recording info like logging into your bank account. Bad stuff! People always want to blame the big, evil, greedy companies for losing data, but you'd be surprised at the amount of data that gets lost because of a lack of personal responsibility on their own computer/logins/passwords/etc.

Personally, I like Credit Karma as a free service that does credit monitoring. Its always trying to upsell you stuff and other services, but its easy and free for people that just want more info without spending money. The pay companies offer more but its up to what you have to lose if you think its worth it.

If you're really interested in some of this stuff, krebsonsecurity is a cool site that talks about different breaches, hackers, etc that's relevant today.

Sorry for the rant. Just wanted to provide some info to people who are concerned as there is so much misinformation out there.

- stay safe!