Identity theft is the use of your personal information without permission. The Federal Trade Commission includes your name, address, account numbers, Social Security number, and medical insurance details in that category.
For U.S. consumers, the pattern is usually one of these:
- A credit card, loan, or utility account opened in your name
- A takeover of a bank, email, or payment account you already use
- A tax return filed with your Social Security number
- A job or wage report attached to your identity
- Medical care or billing created with your insurance information
- A synthetic identity built from one real detail plus invented ones
- Credit applied for with a child's unused history
An unfamiliar charge, letter, or account still isn't proof. It can be a billing error, a family member you authorized, or a merchant operating under another business name. Match the address, dates, and contact details before you treat it as fraud. If you still can't explain it, act quickly. Bank, IRS, insurer, and credit-bureau processes are not interchangeable, and a fix that works for a stolen card will not close a fraudulent tax return.
Types of identity theft and the first clue
| Example | How it works | What you may notice |
|---|---|---|
| New-account fraud | Someone uses your identifiers to apply for credit or services | An inquiry, account, bill, or collection call you don't recognize |
| Account takeover | Stolen logins or a support trick change access to an account you already own | Password-reset alerts, new contact details, or unauthorized transactions |
| Tax identity theft | A Social Security number is used to file a return or claim a refund | A rejected electronic return or an IRS notice about a return you didn't file |
| Employment identity theft | Your Social Security number is used for hiring or payroll | Unfamiliar wage information, a tax document from an unknown employer, or contact about a job you never held |
| Medical identity theft | Insurance or medical account information is used without authorization | A bill, explanation of benefits, or record for care you didn't receive |
| Synthetic identity fraud | Real data is mixed with invented details to create a new identity | Accounts under a slightly different name, address, or date of birth |
| Child identity theft | A child's information is used before any credit activity should exist | Collection letters or credit offers addressed to a child |
The first warning can arrive long after a data breach, a lost wallet, or a phishing message. Those events create risk. They do not prove someone has already used your identity.
How new-account and takeover cases unfold
New-account fraud often starts in a place you never see. A thief gets enough identifiers to apply for credit or services, the lender or utility opens a file, and you find out later through a hard inquiry, a bill, or a collector. Call the company named on that account using a number from its official website, app, or a statement you already have. Skip any number that arrived in a suspicious text or email.
If the account is on a credit report, pull Equifax, Experian, and TransUnion separately. The same fraud does not always appear the same way on all three.
Account takeover is a different problem because the criminal is inside something you already own. A fake bank, delivery, payroll, or support message sends you to a counterfeit login page. After that, the thief may steal a password or one-time code, reset access, swap the email and phone number on file, and add transfers, purchases, or new payees.
Change the password from a device you trust. Start with email if that inbox could be used to reset everything else, pick a password you don't reuse, and turn on multifactor authentication. Then reach the bank or service through its official app or a statement and ask it to lock the account and review the activity. Never give a one-time code to someone who contacted you first. Knowing your name or part of an account number does not make the caller legitimate.
Tax, medical, employment, and synthetic cases
Tax identity theft often becomes visible when your own electronic return is rejected because a return using your Social Security number was already accepted. You may also get an IRS notice about a filing or refund you don't recognize. Letters such as 4883C, 5071C, or 5747C need a prompt response using the instructions printed on them.
The FTC's tax identity theft guidance walks you through reporting and a personal recovery plan. The tool can produce an FTC Identity Theft Report, an IRS Identity Theft Affidavit, and next steps for your situation. Ignore any incoming caller who says you must pay immediately to "clear" your Social Security number. Use an official IRS channel or the address on the notice.
The Taxpayer Advocate Service's identity theft page notes that, in some cases, a police report can go to the IRS instead of Form 14039. Follow the instructions that apply to your notice rather than an address a stranger gives you. If tax-related theft is a concern going forward, review the IRS Identity Protection PIN program. The Taxpayer Advocate Service's IP PIN guidance explains the extra verification step it adds to federal filing.
Medical identity theft shows up as an explanation of benefits, a bill for care you didn't receive, or a provider file that doesn't belong to you. Call the provider and insurer with official contact information, ask which account, date, and service produced the charge, and request corrections. Keep the bills, explanations of benefits, and letters.
Employment identity theft is quieter until wage records appear. You might get a tax document from an employer you don't know, see wages you didn't earn, or hear from a company about a job you never held. Ask that employer's payroll or human-resources office for dates and records. If the problem touches a tax filing, use the IRS steps above and keep every document tied to the correction.
Synthetic identity fraud is harder to spot because part of the file can be real, often a Social Security number paired with an invented name, address, or date of birth. Compare the full line on each credit report, not just the account title. Watch for a slightly different name, an address where you've never lived, an odd date of birth, inquiries from lenders you don't know, and collection notices for debts you never opened. A credit freeze can limit new access to your reports. It will not clean up information that is already there, so you still have to dispute accounts that aren't yours.
A forum thread can help you recognize a pattern. It is not a source for deadlines or refunds. Use it as a prompt to check your own records, then stay with the company or agency on the account.
What to do after you find it
Verify the warning sign before you blow up working accounts. Confirm whether an authorized user, a household member, a renamed merchant, or a legitimate service explains the activity. If a message wants a click, a code, or a payment, don't use the contact details inside it. Open the official app or type the company's known address yourself.
Next, lock down anything that may be exposed. Change compromised passwords and any account that reused them. Secure email first if it can reset the rest, review recovery emails and phone numbers, turn on multifactor authentication, and sign out of sessions you don't recognize. For bank, card, and payment accounts, contact the provider through an official channel and ask about new credentials, blocked cards, removed payees, and a review of recent activity.
Preserve evidence as you go:
- Dates and times of suspicious messages, calls, and transactions
- Account numbers, merchant names, and disputed amounts
- Copies of statements, letters, emails, and screenshots
- Names or reference numbers from company and agency contacts
- Copies of reports and disputes you submit
Keep the originals. Send copies unless an agency specifically asks for an original.
Report the incident at IdentityTheft.gov or the FTC's identity theft reporting page. The resulting report and recovery plan help you organize the case and show businesses the information was used without permission. That filing does not, by itself, produce a refund or close every account. You still notify each affected bank, card issuer, creditor, provider, or employer.
Then freeze your credit reports. A security freeze restricts prospective creditors from pulling a report. USAGov's credit-freeze guidance covers how to place, lift, or remove a freeze with Equifax, Experian, and TransUnion. The freeze is free and does not lower your score. Online or phone freeze requests should generally be completed within one business day; mail can take up to three. Online or phone unfreeze requests should be lifted within one hour.
A freeze will not stop someone who already has your bank or email login, reverse a fraudulent charge, delete an inaccurate account, or block every form of medical, employment, or tax identity theft. If you need to apply for credit, lift it temporarily and keep the confirmation details and PINs each bureau gives you.
After that, get your reports at AnnualCreditReport.com and mark every account, inquiry, address, or collection item you don't recognize. The FTC's guidance on disputing credit-report errors explains why those entries matter: the data can affect borrowing, renting, insurance, and some employment decisions.
For each error, identify the entry and explain why it isn't yours, attach evidence such as an identity theft report, statement, or police report, use the bureau's approved dispute process, contact the business that supplied the information, and save confirmations. Recheck the updated report. A credit-report dispute only challenges inaccurate reporting. It does not replace a bank's investigation of an unauthorized debit, card purchase, wire, or payment-app transfer.
Which report or agency controls the next step
The paperwork only does the job it was built for:
- FTC report: Documents the incident and builds a recovery plan. It does not decide whether a bank must reimburse you.
- Credit freeze: Limits new access to a credit report. It does not investigate an existing account.
- Credit dispute: Challenges inaccurate information on a report. It does not cancel a legitimate debt.
- Bank or card issuer: Investigates unauthorized transactions and account access under its own procedures and the rules for that payment method.
- IRS: Handles tax returns, tax notices, and tax-related identity verification.
- Medical provider or insurer: Investigates unauthorized care or billing and corrects its own records.
- Employer or payroll department: Investigates employment records tied to someone else's identity.
Tell each organization what happened, when you noticed it, and the specific action you want. Ask for a case number and the preferred way to send documents.
Prevention that matches the actual risk
Place a freeze if you don't expect to apply for new credit soon. Use a different password for every important account, especially email and banking, and review recovery settings after you turn on multifactor authentication. Read statements for small unfamiliar charges, not just large withdrawals, and check all three credit reports through the official site from time to time.
Ask why a Social Security number is required, how it will be stored, and whether another identifier will do. Treat urgent calls about a suspended Social Security number, a criminal investigation, or an immediate tax payment as a scam warning and verify independently. Shred papers that show account numbers and keep incoming mail out of easy reach.
If a child's information is the concern, ask each credit bureau how to check or freeze a minor's file. An IRS Identity Protection PIN is worth considering if tax-related theft is already on your radar.
Paid monitoring can send alerts. It is not a substitute for a freeze, strong passwords, or reading statements, and an alert is not proof that a charge is fraudulent. Investigate before you dispute it.
Frequently asked questions
Is a data breach the same as identity theft?
A breach means information may have been exposed. Identity theft is the next step: someone uses that information without permission. After a breach, watch accounts and consider a freeze. Don't assume misuse until you have evidence.
Does a credit freeze stop all identity theft?
It mainly restricts access to your credit reports for new-credit decisions. It does not protect an existing bank account, payment app, tax return, medical insurance account, or employment record.
Will an FTC identity theft report guarantee a refund?
The report documents the incident and organizes recovery. The affected bank, card issuer, merchant, or payment provider still investigates an unauthorized transaction under its own process.
What should I do if my tax return was rejected?
Don't answer an unexpected caller or click a link in a tax message. Report the issue through the FTC's tax identity theft guidance, then follow the IRS instructions on your notice. Keep proof of every submission.
Do I need a police report?
Not in every case. A business, insurer, or agency may ask for one, and it can help document what happened. For some IRS identity theft situations, the Taxpayer Advocate Service says a police report may be submitted instead of Form 14039, subject to the instructions that apply to your notice.
If you already have a letter, charge, rejected return, or collection call you can't explain, start with the company or agency named on it using official contact information. Then file at IdentityTheft.gov and freeze all three credit reports so new credit is harder to open while you clean up the rest.