Identity theft happens when someone uses your personal information without permission to get into an existing account, open a new one, obtain services, file a tax return, or impersonate you. If you think that's happening, lock down the account already at risk, contact the company through a number or site you already trust, protect your credit files, and write down every call, case number, and date.
For U.S. consumers, the next call isn't the same in every case. A credit-card charge, debit-card withdrawal, ACH transfer, wire, peer-to-peer payment, tax filing, medical bill, and phone-number takeover follow different procedures and deadlines.
How identity theft actually unfolds
It's usually a chain, not one dramatic hack. Data leaks first: phishing, a fake support chat, a company breach, malware, stolen mail, a reused password, or details sitting on a public profile. Someone then combines what they have (a name, address, birth date, Social Security number, email, phone, password, or insurance ID) and picks a target. That might be a bank login you already use, a new credit account, a tax return, a medical claim, a mobile number, or a shopping account with a stored card.
The use can look ordinary: a password reset, a purchase, a transfer, a loan application, a call that sounds like you. If they change recovery email, take over the inbox, or move the phone number, getting back in gets much harder. People often notice from an unfamiliar charge, a credit inquiry, a reset message they didn't request, a medical bill, an IRS letter, or a phone that suddenly has no service.
A data breach isn't proof that identity theft has already occurred. It means information may have been exposed. Identity theft is the unauthorized use, or attempted use, of that information.
Common types of identity theft
| Type | What happens | Warning signs |
|---|---|---|
| Existing-account takeover | Someone gets into an email, bank, card, shopping, or social account you already own. | Unfamiliar logins, changed recovery details, password-reset messages, or transactions |
| New-account fraud | A criminal uses your information to apply for credit, utilities, loans, or other services. | New accounts, hard inquiries, bills, or collection notices you don't recognize |
| Tax identity theft | Someone uses personal information to submit a fraudulent federal tax return. | An unexpected IRS notice, a rejected electronic filing, or a request to verify a return |
| Medical identity theft | Someone uses your identifying or insurance information to obtain care, services, or prescriptions. | Unfamiliar explanations of benefits, medical bills, prescriptions, or provider records |
| Synthetic identity fraud | Real information, such as a Social Security number, is combined with invented names, addresses, or other details. | Credit activity connected to an unfamiliar name or address that uses your identifier |
| SIM swapping or port-out fraud | A mobile number is moved to another SIM or carrier account, allowing access to calls and text-based codes. | Your phone suddenly loses service, shows emergency-only access, or stops receiving texts |
These overlap. A stolen email password can open a bank account. A SIM swap can intercept the text codes that were supposed to protect that same account.
Synthetic identity theft
This isn't a straightforward impersonation. The thief builds a file that can look passable because one real identifier (often a Social Security number from a breach) is mixed with a made-up name or address. Small credit applications come next, then extra activity meant to make the profile look established.
If your credit report shows an unfamiliar name, address, inquiry, or account tied to your Social Security number, contact the creditor and the credit reporting companies through channels you verify yourself. Don't treat the account as harmless just because the name isn't yours.
AI, phishing, and SIM-swap risks
AI can make a message, voice clip, or video look more convincing. It doesn't change the response: an unexpected ask for a password, one-time code, identity document, gift card, cryptocurrency, or money transfer is unverified until you confirm it independently.
Caller ID, a familiar voice, a company logo, a video call, a note that recites personal details, and pressure to act immediately are all easy to fake. End the contact. Reach the organization through its official app, website, statement, or card. Never use a callback number supplied by a suspicious message.
The FTC's guidance on SIM swap scams treats a sudden loss of phone service as a warning sign. If that happens unexpectedly:
- Use another phone or a trusted internet connection to contact your carrier.
- Ask whether the number was transferred or the SIM was changed.
- Ask the carrier to restore control and add an account PIN or any port-out protection it offers.
- Secure your email, financial, and social accounts immediately.
- Replace SMS authentication with an authenticator app, passkey, or security key where those options exist.
Warning signs worth investigating
One odd charge can be a merchant error. Unexplained activity still deserves a look.
That includes a bank, card, loan, utility, or shopping account you didn't open; charges, withdrawals, transfers, or payment-app activity you don't recognize; password-reset or multi-factor messages you didn't request; a credit inquiry or collection letter from an unfamiliar company; bills or explanations of benefits for services you didn't receive; IRS mail about a return or verification request you don't expect; a phone that stops receiving calls and texts; or an address, employer, or other personal detail on a credit report that isn't yours.
Check the account directly rather than tapping a link in an alert. Save the message, sender information, transaction details, and date before you delete anything.
How to prevent identity theft
Protect the accounts that unlock everything else
Email is often the recovery key for banking, shopping, and social logins. Use a long, unique password and multi-factor authentication, then review recovery email addresses, phone numbers, logged-in devices, and forwarding rules.
On other important services, don't reuse passwords. Store them in a reputable password manager. Prefer passkeys, authenticator apps, or hardware security keys over text messages when those options are offered. Turn on alerts for transactions, logins, password changes, and new devices. Remove old accounts and unused payment methods. Keep your phone, computer, browser, and security software updated. Don't enter financial credentials on an untrusted device or through an unsolicited link.
Credit freeze, fraud alert, and monitoring do different jobs
| Tool | What it does | What it doesn't do |
|---|---|---|
| Credit freeze | Restricts access to your credit report, making it harder to open many new credit accounts in your name. | It doesn't secure an existing bank or email account, stop tax fraud, or reverse an existing transaction. |
| Fraud alert | Asks businesses to take additional steps to verify your identity before extending new credit. | It doesn't block every application or protect non-credit accounts. |
| Credit monitoring | Notifies you about selected changes or activity. | It usually alerts you after information appears and doesn't prevent the underlying event. |
A freeze is free. You generally need to place it with Equifax, Experian, and TransUnion separately. USA.gov's credit-freeze guidance says online or telephone requests must be processed within one business day, while mailed requests must be processed within three business days. Online or phone unfreeze requests must be lifted within one hour. Save each confirmation and any PIN or account recovery information.
If you later need a lender to pull your report, you'll have to lift the freeze with the bureau that lender uses, then freeze it again when you're done.
A fraud alert is the lighter option. Experian's security-freeze guidance says that when you request a fraud alert, Equifax and TransUnion are notified so the alert is added at all three bureaus. That can be more convenient if you're about to apply for credit. A freeze is the stronger barrier against many new-credit applications.
Reduce phishing opportunities
Verify unexpected messages through a known phone number or website. Don't share one-time codes with an unsolicited caller. Be cautious with job offers, prize notices, delivery alerts, account warnings, and anyone asking for cryptocurrency or gift cards. Limit the personal details visible on social media. Shred documents that contain account numbers or identifying information. Keep your Social Security number private and ask why it's needed before providing it. Treat an urgent request from a supposed friend, employer, bank, or government agency as unverified until you confirm it yourself.
Protect children and older adults
Children may not have regular credit activity, so misuse can sit unnoticed. Parents or guardians can check whether a child already has a credit file and ask each bureau how to freeze it. Experian discusses freezes for children under 16; requirements may vary by bureau.
Older adults are frequent targets for callers posing as relatives, banks, delivery companies, or government agencies. With the person's consent, help set transaction alerts, review statements, and use a callback routine: end an unexpected call, then use a number you already know. A trusted helper should never demand or share another person's passwords.
What to do if identity theft happens
Move quickly. Don't send money or extra personal details to a caller or "recovery specialist" who found you first.
1. Stop ongoing access
If an online account is involved, use the official app or website to change the password, sign out other sessions, review recovery details, and enable stronger authentication. Secure the email account first if it may be compromised.
For a bank or card incident, call the number on the back of the card, a statement, or the institution's official website. Ask it to stop or review unauthorized activity, secure the account or replace compromised credentials, open a fraud case, explain what documents it needs, and give you a case or reference number.
Name the payment type accurately. An unauthorized credit-card charge, debit-card transaction, ACH transfer, wire, and peer-to-peer payment can follow different procedures and deadlines. Ask immediately whether a pending transfer can be stopped or recalled. Don't assume a refund is guaranteed.
2. Protect your credit files
If your identifying information may be used to open credit, place a freeze with all three bureaus or request a fraud alert. Use the official instructions in USA.gov's credit-freeze guide, not a link from an unexpected message.
A freeze doesn't close current accounts. Keep checking bank, card, and payment-app activity after the freeze is confirmed.
3. Report the identity theft
Use the FTC's identity theft reporting page. The FTC directs consumers to IdentityTheft.gov, which provides recovery steps, checklists, and sample letters.
That report is useful documentation. It doesn't replace contacting the affected bank, creditor, insurer, platform, or government agency. Follow each company's own recovery plan.
A police report isn't required for every incident. If a creditor, insurer, agency, or local officer asks for one, ask what information it needs and keep the report number and a copy.
4. Correct fraudulent accounts and records
Contact every company connected to the incident. Say clearly that the account or transaction was unauthorized and ask for its fraud-dispute process.
Keep copies of statements, notices, and messages; screenshots of transactions and account changes; dates, names, phone numbers, and case numbers; copies of identity documents you supplied through verified channels; and proof of mailing or submission.
If you mail documents to a credit bureau or company, send copies rather than originals. Don't send sensitive records to an address or email supplied by an unsolicited caller.
5. Handle tax identity theft separately
The FTC report and the IRS identity theft affidavit are different documents.
If you believe someone used your personal information to file a fraudulent federal tax return, review the IRS guidance on when to file Form 14039. The IRS says taxpayers may complete Form 14039 online or use the paper form when the listed conditions apply.
If the IRS sends a verification letter, follow that letter. You may be asked to verify your identity, sometimes in person at a Taxpayer Assistance Center. Don't submit duplicate Forms 14039. The IRS victim-assistance guidance warns that duplicate submissions can cause delays.
6. Address medical identity theft
Contact the healthcare provider and insurer using official contact details. Ask which fraud department handles the matter and how to flag an unfamiliar service or bill. Keep explanations of benefits, invoices, prescription records, and correspondence together.
Don't ignore a medical bill simply because you didn't receive the care. Ask the provider to investigate the record and explain the next step in writing.
How long recovery usually takes
There isn't one deadline that covers every case. A stolen password may be fixed the same afternoon. Fraudulent credit, tax, medical, and banking records can mean several separate investigations.
| When | Priority |
|---|---|
| Immediately | Secure email and affected accounts, contact the bank or provider, and address a phone-number takeover. |
| Same day | Place credit freezes or a fraud alert, save evidence, and report the incident to the FTC. |
| Next few days | Contact each creditor or company, submit requested disputes, and replace compromised cards or credentials. |
| Following weeks | Check that corrections were made, respond to official agency requests, and watch for related attempts. |
Keep the case log until every company confirms what it did. If an institution stops responding, ask for its written complaint or escalation process. Use the company's official support or complaints channel rather than paying an unknown third party that promises to recover your money.
Do you need a paid identity theft protection service?
A paid service may make monitoring and restoration assistance more convenient. It isn't a substitute for a credit freeze, strong account security, or reporting the incident.
Before you subscribe, check which credit reports and types of data are monitored; whether a human restoration specialist is included; coverage for children or other household members; the identity-theft insurance terms, exclusions, and limits; the price after an introductory period; renewal and cancellation conditions; and how the company stores and shares your personal information.
A free baseline still does the core work: unique passwords, stronger multi-factor authentication, bank alerts, credit freezes when appropriate, regular account reviews, and the FTC's recovery resource.
Frequently asked questions
Does a credit freeze stop all identity theft?
No. It mainly restricts access to your credit report and helps with many new-credit applications. It doesn't stop someone from taking over an existing email or bank account, using a stolen phone number, filing a tax return, or misusing medical information.
Is a data breach the same as identity theft?
No. A breach may expose personal information. Identity theft involves unauthorized use or attempted use of that information. After a breach, change reused passwords, enable multi-factor authentication, consider a credit freeze, and watch for follow-up phishing messages.
Should I file Form 14039 for every identity theft incident?
No. Form 14039 is an IRS identity theft affidavit for tax-related situations described by the IRS. Use the FTC reporting process for general identity theft and follow the affected company's own fraud procedure.
Will an identity theft report guarantee a refund?
No. Reimbursement depends on the type of payment, how quickly it was reported, the institution's investigation, account terms, and the applicable process. Report the incident promptly and ask the institution to explain its documentation and dispute requirements.
What should I do if my phone suddenly loses service?
Contact your mobile carrier immediately from another device, ask whether the number was transferred, and request restoration and available account protections. Then secure email, banking, and other accounts that rely on text-message codes.
If a charge, lockout, or IRS letter is already in front of you, use the official app or the number on the card or notice first. Then place the freezes and file at IdentityTheft.gov. Don't pay anyone who cold-calls offering to recover the money.