Call the company where the misuse occurred first. Use a number from a statement, the back of a card, or the company's official website, then ask its fraud department to close, freeze, or otherwise secure the affected account.
Protect the accounts that can unlock everything else next. Email, banking, and mobile-service accounts deserve attention because they can be used for password resets, recovery codes, and account changes. Use a device you trust, change compromised passwords, end unfamiliar sessions, and turn on two-factor authentication.
Start even if your notes are incomplete. This information applies to U.S. consumers.
A data breach is not automatically identity theft. A breach can expose information, while identity theft involves someone actually using it without permission to impersonate you or commit fraud. Exposure still warrants caution.
Identity theft in plain English
Identity theft can involve much more than a stolen card number. It may affect credit, taxes, medical records, employment records, or government benefits.
Turns out, one useful detail can be enough for a specific scam. An email password, insurance number, tax information, payment-card number, or a child's Social Security number may give a thief an opening.
| Type | What it can look like |
|---|---|
| Financial identity theft | Someone opens credit, borrows money, or buys goods using your information. |
| Account takeover | A thief gets into an existing email, bank, card, phone, or payment account. |
| Tax identity theft | Someone files a tax return or tries to claim a refund in your name. |
| Medical identity theft | Medical services, prescriptions, or insurance claims appear under your identity. |
| Employment identity theft | Your information is used for a job, or wages appear that you did not earn. |
| Child identity theft | A minor's information is used to open accounts or obtain benefits. |
| Synthetic identity theft | Real personal information is combined with invented details to build a new identity profile. |
The type of misuse helps identify the first organization to call.
How identity theft usually starts
Phishing, stolen mail, discarded documents, payment skimmers, and exposed databases can all provide pieces of personal information. A thief may also obtain data that was exposed somewhere else.
Reused passwords make account testing much easier.
With a working login or enough identifying details, a thief might test an account, alter recovery settings, redirect payroll, apply for credit, or send messages from a genuine mailbox, and the first signs can look ordinary because the activity comes from an account that other people already trust.
Account takeover can spread quickly. New recovery details and password-reset requests may lock you out of several accounts.
Warning signs that deserve a closer look
One unfamiliar charge can be a merchant error. Several unrelated notices across different accounts call for a faster response.
The FTC's guidance on credit freezes and fraud alerts lists an account in your name that you do not recognize as a possible sign of identity theft.
- [ ] A credit inquiry or new account appears that you do not recognize.
- [ ] A bank, card, payment, or investment transaction is unfamiliar.
- [ ] You get a password-reset or two-factor authentication notice you did not request.
- [ ] A bill, insurance statement, or explanation of benefits lists unknown care or services.
- [ ] The IRS or another tax agency contacts you about a return you did not file.
- [ ] Your Social Security account lists wages from an employer you do not know.
- [ ] Your phone loses service unexpectedly, or you receive a SIM-change notice.
- [ ] Mail arrives about a loan, account, or benefit you never requested.
Check through a known app or by typing the company's web address yourself. Don't use a link in a suspicious email or text to investigate.
Freeze, alert, or monitor? They are different tools
A credit freeze, a fraud alert, and credit monitoring solve different problems. The FTC says a credit freeze is free and stays in place until you tell the credit bureaus to remove it.
| Tool | Main purpose | Important limit |
|---|---|---|
| Credit freeze | Restricts access to your credit report for many new-credit decisions. | It does not close existing accounts or stop a thief who already controls a login. |
| Fraud alert | Tells businesses to take extra steps to verify your identity before extending new credit. | It does not stop every application. A standard alert lasts one year and can be renewed. |
| Credit monitoring | Alerts you to some changes in a credit report or monitored account. | It can miss misuse and may notify you only after activity appears. |
A freeze is placed directly with Equifax, Experian, and TransUnion. For a standard fraud alert, the FTC's consumer guidance says you can contact one of the three bureaus.
A fraud alert is not a freeze. If you do not expect to apply for new credit soon, a freeze offers stronger protection against new-account fraud, although you may need to lift it before a legitimate application.
Prevention steps that reduce exposure
Email needs strong protection because it often controls password resets. Give it a long, unique password, then do the same for bank, card, tax, and other important accounts. A password manager can make unique passwords easier to use.
Turn on two-factor authentication wherever it is available, especially for email and financial accounts. Never share a one-time code with a caller or message sender.
Set transaction alerts and review statements. If you are not looking for new credit, a free credit freeze may be worth considering.
Your mobile account needs protection too. Set a carrier account PIN and ask your carrier about available port-out protections. Those measures do not replace strong email and banking security.
Shred sensitive papers, protect your mail, and limit when you provide your Social Security number. Information that seems public can still help someone impersonate you.
Thing is, two-factor authentication protects a login, not every recovery route. After suspicious activity, check signed-in devices, email-forwarding rules, recovery email addresses, and recovery phone numbers.
What to do after you spot possible identity theft
Begin with the account where the misuse is visible. You can organize the paperwork as you go.
-
Contact the affected company. Call through an official number and ask for the fraud department. Explain that the activity is unauthorized, ask the company to close, freeze, or secure the account, and ask how it will handle the disputed activity.
-
Secure the entry points. Change the affected password from a trusted device, sign out of unfamiliar sessions, and enable two-factor authentication. Secure your email first if it can reset passwords for other accounts.
-
Create an FTC identity theft report. The FTC's recovery guidance explains how to report identity theft and contact companies involved. Save the report details.
-
Protect your credit. Place freezes with all three credit bureaus or add a fraud alert. Review your credit reports for unfamiliar accounts, inquiries, and addresses.
-
Dispute fraudulent records. Tell both the business and the credit bureau reporting an item that it is not yours. Ask which documents they require, send copies through a secure channel, and request written confirmation of the outcome.
-
Use the specialized route. Tax misuse needs an IRS response. Medical misuse should be reported to the provider and insurer. Employment misuse may require contact with an employer's payroll or human resources department.
Use official contact details at every stage. A suspicious call or text may be part of the fraud.
Keep a recovery file
Identity-theft recovery can get messy fast. A case number noted during a stressful call may save a later conversation.
| Save this | Record |
|---|---|
| Incident details | When you noticed the problem, what happened, and which accounts may be involved. |
| Evidence | Statements, notices, screenshots, emails, and transaction details. |
| Contacts | Company names, fraud department numbers, representatives, dates, and case numbers. |
| Submissions | Copies of reports, disputes, identity documents, and confirmation messages. |
| Results | Account closures, corrected records, credits, replacement cards, and unresolved issues. |
Keep original documents unless an agency specifically asks for them. Send copies where possible, and store the file securely. Don't put your full Social Security number in ordinary notes or email.
Special steps for tax, medical, employment, and child identity theft
Some forms of identity theft do not begin with a credit report. The right contact depends on the record that was misused.
Tax identity theft
A fraudulent federal tax return needs an IRS response. If you believe someone used your information to file one, review the IRS instructions for Form 14039, Identity Theft Affidavit. The form may be completed online or on paper when the IRS instructions say it applies.
Do not file Form 14039 only because a company announced a data breach. Tax-related misuse, or an IRS instruction to file the form, is what matters.
Follow the instructions in any IRS letter such as 5071C, 5747C, or 4883C. Do not follow a link in an unexpected message.
Unexpected wages need attention as well. The IRS identity theft guide for individuals covers taxpayers, children, dependents, nonfilers, and unfamiliar wage entries.
Medical identity theft
Medical identity theft can leave wrong services, prescriptions, or insurance information in a health record. You might find it through a bill, but not always.
Call the provider's billing, fraud, or privacy office, then contact your insurer. Ask which service, date, and record produced the charge, and ask how to request a correction.
A health record still needs attention even if no money left your bank account.
Employment identity theft
Contact the payroll or human resources office of an unfamiliar employer if wages appear under your name. Ask for the records linked to your information and explain that you did not perform that work.
Keep wage and tax notices with the rest of your recovery file.
Child identity theft
A child or dependent can be affected long before applying for credit. A parent or guardian can ask each credit bureau about a minor's credit file and a minor security freeze.
Requirements differ by bureau. You may need documents showing your identity, the child's identity, and your relationship, as described in Experian's guide to freezing a child's credit.
Use a secure submission method. Never post a child's Social Security number in a public form or social media message.
Should you pay for identity theft protection?
Start with the free protections available to you. Credit freezes, fraud alerts, credit reports, and account alerts address several common risks without a subscription.
To be honest, a paid service may make monitoring or recovery administration easier, but it cannot guarantee prevention. LifeLock's plan disclosures state that its Identity Lock and Credit Lock cannot prevent every account takeover, unauthorized account opening, or credit-file inquiry.
| Option | What it may provide | What to check |
|---|---|---|
| Free controls | Credit freezes, fraud alerts, credit reports, and account alerts. | You handle notices and follow-up yourself. |
| Paid monitoring | Combined alerts for credit files or selected financial and personal data. | Bureau coverage, alert timing, recurring price, and cancellation terms. |
| Recovery assistance | Help organizing disputes or restoration steps. | Support limits, hours, exclusions, and whether someone handles the case for you. |
| Reimbursement or insurance | Contractual coverage for certain losses or expenses. | Caps, exclusions, deductibles, documentation rules, and covered fraud types. |
Read the current terms before enrolling. Check whether the plan covers the problem you are trying to address, including a child's file or the type of loss involved.
How long can identity theft recovery take?
There is no fixed recovery timeline. Replacing a card can be quick, while a tax issue, medical-record correction, or credit-report dispute may require repeated follow-up.
| Stage | Main work |
|---|---|
| Today | Contact the affected institution, secure logins, and save evidence. |
| Next few days | File the FTC report, place a freeze or alert, and review credit reports. |
| Following weeks | Submit disputes, respond to verification requests, and follow up in writing. |
| After corrections | Check statements and reports again, then retain the recovery file. |
A closed account does not automatically mean a credit report has been corrected. Confirm both.
Questions readers often ask
Is a data breach the same as identity theft?
No. A breach means information may have been exposed. Identity theft means someone used it without permission.
Should I freeze my credit before confirming fraud?
You do not need to wait if your information may have been exposed. A freeze is free and remains in place until you ask the credit bureaus to remove it.
Can a credit freeze protect my bank account?
No. A freeze mainly affects access to your credit report for new-credit decisions. Contact your bank directly about an existing-account takeover or unauthorized transaction.
Do I need a paid monitoring service?
No. Free freezes, fraud alerts, credit reports, and bank notifications are useful starting points. Pay only if the monitoring, support, and reimbursement terms fit your needs.
Check your email, bank, and card accounts from a device you trust. If something is unfamiliar, call the institution using its official contact number, record the case number, and choose the credit protection that fits the risk.