Identity theft is the unauthorized use of your personal information. It can involve a Social Security number, login credentials, card details, an address, or tax records.
When an unfamiliar account or charge appears, focus first on containment. Call the bank or company that controls the account, file a report at IdentityTheft.gov, and protect your credit file with a freeze or fraud alert. These steps apply to U.S. consumers. The dispute route depends on the payment rail: credit card, debit card, ACH or EFT, prepaid card, wire transfer, or peer-to-peer payment.
Signals and false alarms
Watch for these signs:
- An account, loan, or credit inquiry you didn't authorize
- Bills or collection notices for purchases you didn't make
- A bank, card, or online password that suddenly stops working
- A tax notice tied to a return or income you don't recognize
- Medical bills or insurance records for services you didn't receive
- Missing mail, checks, identification, or cards
- A changed password, email address, or recovery method
- A breach notice saying your information may have been exposed
A breach notice alone doesn't prove misuse. It does give you a reason to retire reused passwords, enable multifactor authentication, and consider a credit freeze if your Social Security number was exposed.
Don't assume every unfamiliar credit-report entry is fraudulent. It may be an authorized-user account, a name mix-up, or a creditor doing business under another name. Verify the entry through an official website or the contact information on a statement before you provide additional personal details.
Where personal data leaks
The source matters because it points to where else the information may be used.
| Source | What it looks like | How to respond |
|---|---|---|
| Phishing and impersonation | Messages posing as a bank, tax agency, delivery firm, or employer | Don't click unexpected links or share passwords and one-time codes. Go directly to the organization's official app or website. |
| Data breaches and reused logins | Login alerts, breach notices, or suspicious activity across multiple services | Use unique long passwords and turn on multifactor authentication. |
| Stolen wallets, mail, and discarded documents | Missing cards, checks, statements, or ID; unsecured paperwork | Carry fewer sensitive cards, secure your mailbox, and shred documents with account or personal information. |
| Card skimming | Unauthorized transactions after using an ATM, gas pump, or terminal | Cover your PIN, inspect the device for tampering, use trusted terminals, and enable transaction alerts. |
| Account takeover | Password-reset messages you didn't request, or changes to email, phone, or payment details | Change the password from a trusted device, end active sessions, secure your email account, and notify the provider. |
| Public-network pressure | Requests to log in or update account details while on an unknown network | Use cellular data or a trusted network. A VPN adds protection, but it doesn't make a fraudulent website safe. |
| Stolen data sold online | A breach involving your Social Security number, card number, or credentials | Don't search for or buy the data. Secure accounts, freeze credit where appropriate, and report the misuse. |
A convincing call, text, or video doesn't prove who is contacting you. Treat an unsolicited request for a password, security code, payment, or remote access as suspicious.
Credit freeze or fraud alert
A freeze and an alert do different jobs. Both are free under the federal guidance summarized by the Federal Trade Commission's credit freeze and fraud alert page.
Choose a credit freeze when you want a stronger block against many types of new-account fraud. A freeze restricts prospective creditors from accessing your credit file. You must place it separately with Equifax, Experian, and TransUnion, and it remains in place until you tell the bureaus to remove it. A freeze won't stop misuse of accounts you already have, and it doesn't cover tax, medical, or bank-account fraud.
Choose an initial fraud alert when you want lenders to take extra steps to verify your identity before extending credit. An initial alert lasts one year. You only need to contact one of the three nationwide credit bureaus, and that bureau should notify the other two. Use the official links provided by the FTC rather than a link in an unexpected email.
Credit monitoring can help you notice changes, but it doesn't prevent fraud. If your Social Security number was exposed, you found an account you didn't open, or you don't plan to apply for credit soon, a freeze is often the stronger choice. If you only suspect exposure and want applications reviewed more carefully, an alert may be useful.
Neither option solves every type of identity theft. Existing checking accounts, fraudulent tax returns, and medical records still require direct action with the bank, IRS, provider, or other organization involved.
Habits that lower exposure
Start with the accounts that reset other accounts
Email is often the master key. Someone who controls it can reset passwords for banking, shopping, and social media.
- Use unique passwords for email, banking, tax, phone, and payment accounts.
- Turn on multifactor authentication wherever it's available.
- Check recovery addresses, phone numbers, active sessions, and connected apps.
- Never give a one-time security code to someone who contacted you unexpectedly.
- Don't let an unsolicited caller install remote-access software.
- Set alerts for logins, password changes, new payees, transfers, and card purchases.
If you reused a password, change it everywhere, starting with email and financial accounts. A password manager can help you create and store unique credentials.
Reduce paper and physical exposure
Shred statements, checks, prescription labels, insurance documents, and other papers that contain personal or account information. Secure your mailbox and collect mail regularly. When traveling, arrange for mail to be held or collected instead of sitting unattended.
Carry only the cards and identification you need. Keep a private record of customer-service numbers and the last four digits of important accounts, but don't store full card numbers or your Social Security number in an unsecured note.
Treat unexpected contact as a verification request
Caller ID and logos can be faked. End the conversation and call back using a number from your card, statement, or the organization's official website.
Don't move money to a so-called safe account. Don't buy gift cards, send cryptocurrency, or provide remote access because a caller claims your account is under investigation. A legitimate representative won't ask you to bypass your normal security process.
Check statements and credit reports
Review account statements for small unfamiliar transactions as well as large ones. Thieves often test an account with a small purchase before trying a larger transaction.
Review your credit reports through the official resources linked from the FTC's credit freeze and fraud alert guidance. Look for unfamiliar accounts, addresses, collection activity, and inquiries. A freeze can make new-account fraud harder, but it won't remove an account that is already on your report.
For a child, keep the Social Security number and official documents out of public posts, unnecessary school forms, and unsecured files. The FTC also provides guidance on freezing a child's credit.
Recovery steps if identity theft has already happened
Work in this order when possible. If money is actively leaving an account, call the financial institution first.
1. Stop further access
Use the official contact information for the bank, card issuer, lender, phone company, or online service. Ask what happened, when the account was opened or changed, and what can be locked or replaced.
Depending on the account, you may need to:
- Block or replace a debit or credit card
- Change the online-banking or email password
- Remove an unauthorized device or payee
- Revoke suspicious third-party access
- Secure a phone account after a suspected SIM or number takeover
- Close a fraudulent account and request written confirmation
If an email account was compromised, secure it before changing passwords elsewhere. Otherwise, an intruder may intercept password-reset messages.
2. Create an FTC identity theft report
File at IdentityTheft.gov. The FTC's recovery process asks what happened and can produce a recovery plan and letters for affected companies.
Save the report number and download or print the documents. Some institutions or credit bureaus may ask for additional evidence, including a police report. Keep a dated record of every call, email, letter, confirmation number, and document you submit.
3. Freeze your credit or place a fraud alert
Contact the credit bureaus using the FTC's official guidance. A freeze must be placed separately with all three bureaus. An initial fraud alert can be requested through one bureau, which should notify the others.
If a bureau or creditor requests an identity-theft report or police report, provide the requested document through its official process. Don't send your Social Security number, identity documents, or account details to an unverified address.
4. Dispute unauthorized charges through the correct payment channel
Call the bank or card issuer promptly and ask what process applies. A credit-card billing dispute isn't the same as an unauthorized debit-card transaction, ACH or EFT withdrawal, prepaid-card transaction, wire, remittance, or peer-to-peer payment.
Tell the provider what type of transaction occurred and ask about:
- The notice deadline
- Whether the account or card should be blocked
- Which forms or supporting documents are required
- Whether a temporary credit or investigation is available
- How to submit a written dispute
- Where to send follow-up documents
The FTC provides a sample letter for disputing credit and debit card charges. Keep copies and retain originals. If you sent money by wire or a payment app, contact the provider immediately and ask whether a recall or fraud review is possible; recovery isn't guaranteed.
5. Challenge unfamiliar credit activity
List every unfamiliar account and inquiry. Include the creditor's name, account date, balance, and contact details. Contact the creditor's fraud department and follow the dispute instructions for each credit bureau showing the information.
A credit freeze won't erase fraudulent accounts. It prevents or limits some new applications while you work with the creditor and bureau to correct the existing record.
6. Handle tax identity theft with the IRS
If you believe someone used your personal information to file a fraudulent federal tax return, review the IRS instructions on when to file Form 14039, Identity Theft Affidavit. The form may be filed online or on paper, depending on the situation and the IRS's instructions.
Respond to IRS notices through the method and deadline shown on the notice. The IRS may require identity verification, and some taxpayers who can't verify remotely may be directed to a Taxpayer Assistance Center. Don't submit duplicate Forms 14039, because the IRS says duplicate submissions can delay the case. The IRS identity theft victim assistance page describes the agency's process.
7. Escalate unresolved complaints carefully
Give the financial institution a chance to investigate and keep its written response. Identify the institution's legal name and location from a statement, card, or official website.
For an unresolved issue involving an FDIC-supervised bank, review the FDIC consumer complaint process. The FDIC route isn't a universal complaint channel for every lender, payment app, credit union, or financial company.
If the crime involved an online scam, email, or compromised internet account, you can also report it to the FBI's Internet Crime Complaint Center. A report creates a record for law enforcement, but it doesn't replace calling the bank or payment provider to protect your account.
Keep a recovery file
Identity theft cases often involve several companies and agencies. Use one folder, physical or digital, for:
- Your FTC identity theft report
- Police or incident reports, if obtained
- Copies of disputed statements and credit-report entries
- Dates and names from conversations
- Case and confirmation numbers
- Letters sent and received
- Screenshots of suspicious messages or account changes
- Proof of delivery for mailed disputes
- IRS notices and copies of submitted forms
Send only the information requested, and redact unrelated account numbers when possible. Don't send original identification documents unless an official process specifically requires it.
Setbacks that slow recovery
- Waiting for a large loss before acting. Small charges and unfamiliar inquiries deserve attention.
- Using a contact link from a suspicious message. Find the bank or agency independently.
- Changing only one reused password. Update every account that shared it.
- Assuming a freeze fixes everything. Existing accounts, tax records, medical records, and payment apps need separate action.
- Relying only on monitoring. Alerts help you spot problems but don't block them.
- Treating every payment the same. Credit cards, debit cards, ACH, wires, and peer-to-peer transfers follow different provider procedures.
- Submitting duplicate IRS forms. Follow the IRS instructions for the specific case instead.
Quick answers
Is a credit freeze better than a fraud alert?
They serve different purposes. A freeze places a stronger restriction on access to your credit file and must be set separately with all three bureaus. A fraud alert asks businesses to verify your identity before extending credit and can be requested through one bureau. If you find evidence of identity theft, contact the affected companies and consider a freeze rather than relying on an alert alone.
Does a data-breach notice mean I'm a victim of identity theft?
No. It means your information may have been exposed. Change any reused passwords, turn on multifactor authentication, watch your accounts, and consider a freeze if sensitive information such as your Social Security number was involved.
What should I do about an unfamiliar charge?
Contact the bank or card issuer immediately through an official number. State whether it was a credit-card charge, debit transaction, ACH or EFT withdrawal, wire, prepaid transaction, or peer-to-peer transfer, then ask for the applicable dispute process and deadline. Follow up in writing and keep your records.
What if the identity theft involved my tax return?
Review the IRS instructions for Form 14039, respond to any IRS notice, and don't submit duplicate affidavits. The IRS may ask you to verify your identity online, by phone, or in person.
If you're not sure where to start, contact the bank, card issuer, or payment provider that controls the affected account first. Ask them to block or review the activity while you create the FTC report and protect your credit file.