If you spot an unfamiliar account, bill, tax notice, or login, treat it as possible identity theft and act before you know the full story. For U.S. consumers, start with the company or payment provider involved, secure your email and phone accounts, place a freeze with all three nationwide credit bureaus, and keep a dated record of every call and message.
If money is leaving an account now, call the bank, card issuer, or payment provider before filing general reports. A credit freeze is useful, but it only limits access to your credit file for many new-credit applications. It doesn't secure an existing bank account, correct a medical record, stop a fraudulent tax return, or guarantee the recovery of money sent by wire or payment app.
What to do if your identity is being used
The right order depends on what is happening. Use these steps as a working checklist.
- Contact the affected company through a trusted channel. Use the number on the back of a card, a statement, or the provider's official website. Don't use a number in a suspicious text, email, social media message, or unexpected call. Ask what type of account or transaction is involved and whether it can be locked, stopped, or returned.
- Secure the affected account. Lock cards, change the password, sign out other sessions, remove unknown devices, and review recent changes to the email address, phone number, and recovery options. Ask the bank whether transfers or payments can be stopped or reversed.
- Protect your email and mobile account. Email is often the reset key for other accounts. Change its password, turn on multifactor authentication, review signed-in devices, and store recovery codes somewhere safe. Ask your mobile carrier to check for unauthorized changes and add an account PIN if it offers one.
- Freeze your credit with Equifax, Experian, and TransUnion. A freeze is free, but you must place it with each bureau separately. Use the bureaus' official websites rather than a link sent by a supposed fraud investigator.
- File a report at IdentityTheft.gov. The FTC service creates a recovery plan and a report that can help when you contact creditors and other companies.
- Notify creditors and preserve evidence. Ask each company to close or secure the account, investigate the activity, and explain which documents it needs. Save case numbers, letters, screenshots, account statements, and copies of everything you send.
- File a police report when it serves a specific purpose. A creditor, government agency, or other organization may request one. Bring identification, account records, suspicious messages, and your FTC report if you have it.
Don't verify an alleged fraud case using a number from an incoming call or a public search result alone. After a breach, scammers may impersonate a bank, police department, the FTC, or a credit bureau and claim they can protect your money. No legitimate caller needs your password, one-time code, gift cards, cryptocurrency, or an immediate transfer to a "safe" account.
The FTC's Consumer Sentinel Network Data Book says Sentinel received 6.5 million consumer reports across 29 categories in 2024. That figure counts reports, not confirmed identity theft victims or verified losses.
What identity theft includes
Identity theft is the use of personal information without permission to obtain money, services, credit, employment, benefits, or access to an account. The information might include a Social Security number, account credentials, payment details, insurance information, or driver's license number.
| Type | What happens | Where to look first |
|---|---|---|
| New-account fraud | Someone opens a credit card, loan, utility, or phone account in your name. | Credit reports, bills, collection notices, and unfamiliar inquiries |
| Account takeover | A criminal enters an existing email, bank, shopping, or payment account. | Login alerts, changed contact details, new devices, and unauthorized transactions |
| Tax identity theft | Someone uses your information to file a tax return or claim a refund. | IRS notices, rejected e-filing, unfamiliar wage information, or tax transcripts |
| Medical identity theft | Someone uses your insurance or identifying information for care or prescriptions. | Medical bills, insurance claims, or incorrect information in health records |
| Employment or benefits fraud | Your information is used for a job, unemployment claim, or government benefit. | Wage records, agency letters, or notices about benefits you never requested |
| Synthetic identity fraud | A criminal combines real information, such as a Social Security number, with an invented name or date of birth. | Unfamiliar inquiries, accounts, or collection activity connected to your information |
A data breach isn't automatically identity theft. It means information may have been exposed. If a company confirms that your information was involved, change any reused passwords, turn on multifactor authentication, consider a credit freeze, and watch for activity that you don't recognize. Exposure is a reason to take precautions; it isn't proof that someone has already committed fraud in your name.
Signs your identity may have been stolen
One strange message may be spam. Several unrelated warnings, account changes, or bills deserve closer attention. Common signs include:
- An account, inquiry, address, or employer you don't recognize on a credit report
- A denial of credit that doesn't fit your credit history
- Bank, card, payment-app, or online-shopping activity you didn't authorize
- Password-reset messages or login alerts you didn't request
- A debt collection letter for an account you never opened
- An unfamiliar utility, phone, or insurance bill addressed to you
- An IRS notice about a return, refund, or wage record you don't recognize
- Medical bills, claims, prescriptions, or diagnoses that aren't yours
- Loss of mobile service or an unexpected change to your phone account
- Government correspondence about benefits, identification documents, or employment you didn't request
Get your reports through AnnualCreditReport.com, the official source for U.S. credit reports. Review all three because an account or inquiry may appear on only one. Credit reports also don't show every kind of account, so check bank statements, payment apps, insurance accounts, utility bills, and email security activity separately.
A dark-web or breach alert can be a useful warning, but it doesn't prove that someone opened an account. Use it as a prompt to change credentials and monitor for actual activity.
How to prevent identity theft
Use unique passwords and stronger sign-in protection
A password manager or passkeys can make unique credentials easier to maintain. Give every important account its own long password, and turn on multifactor authentication. An authenticator app or security key is preferable when an account offers those options.
Start with email. Someone who controls it may be able to reset banking, shopping, and social-media passwords. Review signed-in devices and recovery information, remove old phone numbers and email addresses, and keep recovery codes offline.
Never read a one-time verification code to someone who contacted you unexpectedly. The fact that the caller knows your name, address, or part of an account number doesn't prove the caller is legitimate.
Consider a credit freeze
A freeze is a strong free barrier against many new-credit applications. It makes particular sense if you don't expect to apply for a mortgage, car loan, apartment, or new credit account soon. You can temporarily lift it when a legitimate company needs access.
A freeze won't protect an existing account takeover or transactions that don't involve a credit report. Keep bank alerts, strong passwords, and account-security controls active after you freeze your files.
Limit exposure of your personal information
- Ask why a business needs your Social Security number and whether another identifier will work.
- Don't carry your Social Security card in your wallet.
- Shred documents containing account numbers, medical information, or identifying details.
- Secure incoming mail and use electronic statements only through accounts you control.
- Review privacy and app permissions, particularly for financial and health apps.
- Remove unused accounts and delete stored payment methods from services you no longer use.
- Keep phones, computers, browsers, and routers updated.
Recognize phishing and deepfake impersonation
An urgent request from a relative, boss, bank executive, or government official can be fabricated with AI-generated voice, video, or text. Check it through a separate channel you already trust: call a known number, contact the person directly, or ask a question an impostor is unlikely to know.
Don't send money, gift cards, cryptocurrency, passwords, or one-time codes because a voice or video sounds familiar. Pressure, secrecy, and a demand for immediate action are warning signs.
Respond carefully to breach notices
Use the company's known website or app to review a breach notice. Find out what information was exposed, how long any monitoring lasts, and whether you need to enroll yourself. Verify the notice before using an enrollment link in an unexpected message.
If an exposed password was reused elsewhere, change it on every affected service. If the exposed information includes a Social Security number or financial information, consider a credit freeze and watch for tax, banking, and credit activity.
Credit freeze versus fraud alert
Both tools address possible new-credit fraud, but they work differently.
| Feature | Credit freeze | Fraud alert |
|---|---|---|
| Main effect | Restricts most prospective creditors from accessing your credit file | Tells businesses to take reasonable steps to verify your identity before extending new credit |
| Where to place it | Separately with all three nationwide credit bureaus | Place it with one bureau, which should notify the other two |
| Duration | Stays in place until you lift or remove it | An initial alert lasts one year; an extended alert can last seven years for eligible identity theft victims |
| Best use | Stronger protection against new accounts | A quick warning to lenders when you suspect misuse |
| Main limitation | You may need to lift it for legitimate applications, and it doesn't cover existing accounts | It doesn't block applications and doesn't secure bank, medical, tax, or payment-app accounts |
You don't have to choose only one. A suspected victim can use a freeze for stronger protection and add a fraud alert when applying for credit or after confirmed theft. Keep the confirmation details for both.
Credit report and creditor recovery
Review each unfamiliar item and determine whether it reflects identity theft, an ordinary reporting error, or a mixed credit file. Contact the credit bureau named on the report and the company that supplied the information. Follow the dispute instructions for each one.
When you contact a creditor, ask:
- What account or transaction is connected to my information?
- Has the account been closed, locked, or flagged for fraud?
- Which documents are required?
- Will you send written confirmation of the investigation?
- What should I do if collection notices continue?
Provide copies of identification, proof of address, account statements, and an FTC or police report when requested. Keep the originals. Filing an FTC report doesn't automatically remove a fraudulent account; the creditor and credit bureau still need to handle their respective investigations and corrections.
If a debt collector contacts you about an unfamiliar debt, don't acknowledge it as your own just to end the conversation. Ask for written information, identify the account as disputed, and send identity theft documentation through a trackable method. Court papers need prompt attention because the response date printed on them still matters.
Report unauthorized payments through the correct channel
The payment method affects what happens next. Credit cards, debit cards, ACH transfers, wires, payment apps, and cryptocurrency don't use one universal dispute process.
| Payment type | Immediate step | Important limit |
|---|---|---|
| Credit card | Call the issuer using the number on the card or statement and dispute the transaction | Don't assume debit-card or bank-transfer procedures apply |
| Debit card or ACH | Contact the bank immediately, report the unauthorized transfer, and ask about stopping or returning it | Dates and documentation can affect the bank's investigation |
| Wire transfer | Contact the sending bank and the receiving institution immediately and request a recall | A recall isn't a guarantee that funds will be recovered |
| Payment app | Report the transaction in the app and contact the linked bank or card issuer | An app's reimbursement policy may differ from the underlying bank or card rules |
| Cryptocurrency | Notify the exchange or wallet provider and preserve transaction details | Transfers are often difficult or impossible to reverse |
Write down when you noticed the transaction, when you reported it, the representative's name, and the case number. Don't move money to a new account because an incoming caller says it will protect your funds. That instruction is a common impersonation tactic.
Tax identity theft
Tax-related misuse needs a tax-specific response. Read the IRS guidance on when to file an identity theft affidavit and the current instructions for Form 14039 when the IRS tells you to file or when your situation meets the form's requirements.
Examples include:
- The IRS says more than one return was filed using your Social Security number.
- Your electronic return was rejected because a return already used your identifying information.
- You receive an IRS notice about wages, income, or a refund that isn't yours.
- Someone used your information for employment and the resulting wages appear in tax records.
Form 14039 is for tax-related identity theft. Don't file it merely because a company reported a general data breach. Follow the IRS notice, keep copies of tax documents, and consider an IRS Identity Protection PIN to help prevent someone else from filing a federal return with your information.
Medical identity theft
Contact the provider, health plan, or medical billing department as soon as you find an unfamiliar claim or record. Ask for:
- A copy of the records or claims connected to the incident
- The provider's process for correcting inaccurate information
- A fraud flag or note on the affected account
- Confirmation that the incorrect record won't be used for future care or billing
Tell your doctor about the error before receiving treatment. An incorrect allergy, prescription, diagnosis, or blood-type entry can create a patient-safety problem as well as a billing problem.
Driver's licenses, passports, employment, and benefits
Contact the issuing agency if a driver's license, passport, or other government identification was lost, stolen, or used. Ask whether the old document can be flagged and what replacement evidence is required.
For employment or benefits fraud, contact the employer, payroll department, unemployment office, or government agency named in the notice. Request correction of the records and save all wage or benefits correspondence. A credit freeze may not address these forms of misuse.
Protecting children and older adults
Children
A child may have no credit history to review, so misuse can remain hidden until the child applies for credit, a job, housing, or insurance. A parent or legal guardian can ask each credit bureau about a minor or protected-consumer freeze and the documents needed to place it.
Keep a child's Social Security number out of school, sports, medical, and online forms unless it is genuinely required. When it is required, ask how the organization stores and disposes of it.
Older adults
Help an older family member verify suspicious calls without taking control of their money or accounts. Transaction alerts, a carrier account PIN, strong passwords, and a trusted-contact option may help if the financial institution offers them.
No legitimate caller should demand secrecy, remote access to a computer, gift cards, cryptocurrency, or an immediate transfer to a "safe" account. If exploitation is ongoing or the person is in danger, contact the financial institution and local authorities promptly.
Are paid identity theft protection services worth it?
Paid monitoring may be convenient, but it doesn't replace a credit freeze or direct reporting to a bank, creditor, the IRS, or a medical provider. A do-it-yourself approach may be enough if you can review reports, maintain account alerts, and handle disputes yourself.
Before paying for a service, check:
- Whether it monitors one, two, or all three credit bureaus
- Whether alerts cover only credit files or also bank, criminal, medical, phone, and data-breach information
- Whether restoration staff will act for you or only provide instructions
- The insurance policy's covered expenses, exclusions, deductibles, limits, and claim deadlines
- The price after any introductory period
- Automatic renewal, cancellation, and family-coverage terms
- How the company collects, stores, and shares your personal information
An advertised insurance limit isn't a promise that stolen money, lost wages, or every recovery expense will be reimbursed. Coverage depends on the policy and may not apply to unauthorized transactions handled under a bank, card, or payment provider's own rules.
Identity theft FAQ
Should I freeze my credit if I have no evidence of theft?
You can place a free freeze proactively. It's most useful if you don't expect to apply for new credit soon. It won't protect existing accounts, tax records, medical records, or payment apps, so monitor those separately.
Does a data breach mean my identity has been stolen?
No. A breach means information may have been exposed. Change reused passwords, activate multifactor authentication, consider a freeze when sensitive information was involved, and watch for actual account or tax activity.
Can IdentityTheft.gov remove a fraudulent account?
No. The FTC report provides a recovery plan and supporting documentation. The affected creditor and credit bureau handle account investigations and corrections.
Do I need a police report?
Not always. A company or agency may request one, especially when a government document or significant financial fraud is involved. File with the appropriate local agency and keep the report number.
What is the first thing to do after an unauthorized transaction?
Contact the bank, card issuer, or payment provider through a trusted channel. Ask what type of transaction it was, whether it can be stopped or reversed, and what deadline and documents apply. Then secure the related accounts and place a credit freeze if personal information may have been used.
Where should I start?
Use IdentityTheft.gov for the FTC recovery plan, AnnualCreditReport.com for credit reports, and the IRS instructions above for tax-related misuse. Start a dated log with your first call and add every case number, document, and written response until the affected company confirms what it corrected.