Identity theft happens when someone uses your personal or financial information without your permission. The thief might make purchases with your card, take over an online account, apply for credit in your name, file a fraudulent tax return, claim benefits, or use your health insurance information.
It often begins with something ordinary: an unexpected text, a reused password, stolen mail, a lost wallet, or a data breach at a company you used years ago.
The catch is that you may not notice immediately. The first warning might be an unfamiliar charge, a new account on your credit report, a rejected tax return, or a debt collector asking you to pay a bill you have never seen.
If that happens, move quickly. Contact the affected company, secure your accounts, review your credit reports, and report the theft through IdentityTheft.gov to receive a personalized recovery plan.
Key takeaways
- Identity theft is the unauthorized use of your personal or financial information.
- Thieves may use stolen information to access existing accounts or create completely new ones.
- Phishing, data breaches, password reuse, hacked email, stolen mail, and lost documents are common starting points.
- You may discover the theft through account alerts, credit reports, collection calls, tax notices, or medical bills.
- A credit freeze can help block new-account fraud, but it does not stop every type of identity theft.
- IdentityTheft.gov provides free reporting tools, recovery steps, checklists, and sample letters.
What identity theft really means
Your identity is more than your name.
It includes the information companies use to decide that you are you. That may include your Social Security number, date of birth, address, driver’s license number, bank details, card numbers, insurance information, email address, phone number, usernames, and passwords.
An identity thief uses some of that information to impersonate you or gain access to something that belongs to you. The FTC defines identity theft as someone using your personal or financial information without permission.
The thief may not need every detail
People sometimes imagine that identity theft requires a criminal to obtain a complete file containing their name, Social Security number, birth certificate, and every bank account.
It can happen with much less.
A stolen card number may be enough to make unauthorized purchases. A compromised email account may allow someone to reset passwords for several other accounts. A name, birth date, address, and Social Security number may provide enough information to attempt a credit application.
The amount of information needed depends on what the thief is trying to do.
Identity theft and fraud are related, but not identical
Fraud is a broader category. A scammer who convinces you to send money for a fake investment has committed fraud, but the scam may not involve using your identity.
Identity theft begins when someone uses your information as though they were you.
The two can overlap. A phishing scam may steal your login details, which the scammer then uses to take over your bank account. What began as a deceptive message has now become account fraud and identity theft.
It is more common than the reports show
The FTC’s 2024 Consumer Sentinel Data Book recorded 449,032 reports in the credit card identity theft category alone. The FTC also warns that its figures are based on reports submitted by consumers and are not a survey or complete count of every incident.
Many people never report what happened. Others may not discover it for months or years.
What information do identity thieves target?
Identity thieves look for information they can turn into money, access, services, or believable impersonation.
Common targets include:
- Your full name and previous names
- Current and previous addresses
- Date of birth
- Social Security number
- Driver’s license or state identification number
- Passport information
- Credit and debit card numbers
- Bank account and routing numbers
- Email addresses and phone numbers
- Online usernames and passwords
- Health insurance or Medicare numbers
- Tax and employment information
- Answers to account security questions
One detail may appear harmless on its own. The danger grows when several pieces are combined.
Public information can fill in the gaps
A criminal may already know your email address from a data breach. A public social media profile might reveal your birthday, hometown, pet’s name, employer, and family members.
Those details can help a scammer make a message sound convincing or guess answers to weak security questions. The FTC recommends avoiding security answers that can be found online or in public records and treating those answers like passwords when better questions are unavailable.
The photo of your birthday dinner is not the problem by itself.
The public birth date, location tag, family names, and visible workplace badge can become useful pieces of a much larger puzzle.
How identity theft happens
Identity theft is not always the result of sophisticated hacking. Some thieves use technical attacks. Others rely on an urgent text message and the hope that you are too busy to stop and check.
Phishing emails and text messages
Phishing messages pretend to come from a company, bank, delivery service, government agency, or person you trust. The message may claim that a payment failed, a package is waiting, an account is locked, or suspicious activity needs immediate attention.
The link may lead to a fake sign-in page that records your username, password, card number, or Social Security number. An attachment may install malicious software instead.
The message usually creates urgency because urgency reduces checking.
Do not use the link or callback number in an unexpected message. Open the company’s official app or contact it through a number or website you already know is legitimate.
Data breaches
A data breach can expose information held by a retailer, health provider, employer, financial company, school, government agency, or website.
The stolen data might include email addresses, passwords, account numbers, dates of birth, Social Security numbers, or other identifying details. What you should do next depends on the type of information exposed.
Do not ignore a breach notice because the account is old.
A password from an abandoned shopping account can still create a problem if you reused it for your email or bank account.
Reused passwords
Criminals can obtain username and password combinations from one breach and automatically test them on other websites. This works because many people reuse the same login details.
If the password from an old entertainment account also opens your email, the thief may be able to request password resets for financial, shopping, and social media accounts. The FTC recommends using unique passwords and turning on two-factor authentication.
Changing one compromised password is not enough when the same password is used in six places.
A hacked email account
Your email account can be the control room for much of your digital life.
A thief who gets inside may read account notices, find financial statements, request password resets, intercept security messages, and delete warnings before you see them. The FTC warns that a compromised email account can be used to reset passwords and lock you out of other services.
Secure the email account first when several accounts appear to have been compromised at once.
SIM swap attacks
A SIM swap happens when a criminal convinces or tricks a mobile provider into moving your phone number to a device controlled by the criminal.
Your phone may suddenly lose service. Meanwhile, the thief may receive text messages and one-time security codes sent to your number.
Text-message authentication is better than using a password alone, but an authentication app or security key provides stronger protection against SIM swap attacks when those options are available.
Stolen mail and fraudulent address changes
Bank statements, replacement cards, tax documents, checks, insurance letters, and government notices can contain valuable personal information.
A thief may steal mail directly or submit a fraudulent change of address or mail hold. The United States Postal Inspection Service accepts reports involving identity theft, fraudulent address changes, and stolen mail.
Missing mail is easy to dismiss. A bill that suddenly stops arriving may be a sign that someone changed your mailing information.
Lost wallets, phones, and documents
A wallet can contain identification, payment cards, health insurance information, and enough personal details to support further fraud.
A phone may provide access to email, stored passwords, banking apps, photos of documents, and text-message verification codes.
Use a strong device lock, activate remote-location and remote-erasure tools, and report lost financial cards immediately. Your legal protection against unauthorized card transactions can depend partly on the type of card and how quickly you report the loss.
What can someone do with a stolen identity?
The financial damage is only one part of identity theft. Stolen information can also affect taxes, health records, government benefits, employment, housing, and interactions with law enforcement.
Use an existing financial account
A thief may make purchases with a stolen card number, withdraw money, change contact details, redirect statements, or take control of an online account.
This is often discovered through a transaction alert or account statement. Report unauthorized activity to the financial institution quickly and ask the fraud department what documents it requires.
Open new accounts in your name
Someone may use your identity to apply for credit cards, loans, mobile phone service, utilities, or other accounts. The first sign may be a hard inquiry, an unfamiliar account on your credit report, a bill, or a collection call.
New-account fraud can sit unnoticed when the thief uses a different mailing address.
File a fraudulent tax return
Tax identity theft can occur when someone uses your Social Security number to file a fraudulent return and claim a refund. You may discover the problem when your genuine return is rejected as a duplicate or the IRS contacts you to verify a suspicious return.
Respond only through the official process described in the IRS notice. Do not call a phone number from an unrelated email or text claiming to be the IRS.
Use your medical identity
Medical identity theft happens when someone uses your name, insurance information, Medicare number, or other personal details to obtain care, prescriptions, equipment, or insurance payments.
This can create bills and collection accounts, but the risk goes further. Information about the other person’s treatment could become mixed with your medical records and affect future care or insurance benefits.
Use a child’s identity
A child has little reason to apply for credit, which can allow fraud to remain hidden for years.
A thief may use a child’s Social Security number and other details to open financial accounts, obtain benefits, arrange utilities, take out a loan, or rent a home. Parents and guardians can request freezes for children under the applicable process to make new-account fraud harder.
Obtain employment or benefits
Stolen identity information may be used to get a job, claim government benefits, obtain housing, or access other services. The victim may discover the problem through a tax record, benefit notice, employment verification problem, or government letter.
Give your identity during an arrest
The FTC also warns that someone may impersonate another person when arrested. This can create records and legal problems under the victim’s name.
This type of identity theft usually requires legal and law-enforcement help rather than only a credit dispute.
Warning signs someone may be using your identity
Identity theft is easier to limit when you notice the early signs.
Watch for:
- Charges or withdrawals you did not make
- Bills for products or services you did not receive
- Accounts or credit inquiries you do not recognize
- A credit application being denied unexpectedly
- Debt collection calls about unfamiliar accounts
- Mail stopping or arriving for an unknown person
- Password reset messages you did not request
- Security alerts showing logins from unfamiliar devices
- Your phone unexpectedly losing mobile service
- An IRS notice about a return you did not file
- Medical bills or insurance statements for care you did not receive
- A child receiving credit offers, bills, or collection notices
The FTC recommends reviewing bills, bank statements, and credit reports and watching for unexpected accounts or missing mail. The CFPB also recommends checking reports for unfamiliar inquiries, accounts, and incorrect amounts.
One strange charge may be card fraud
An unfamiliar card purchase does not always mean the thief has enough information to open accounts elsewhere.
Still, do not assume the problem ends with replacing the card.
Ask how the information was compromised, change the account password, check contact details, and review other accounts for similar activity.
Several warning signs suggest a wider problem
A card charge, password reset, missing mail, and unfamiliar credit inquiry appearing around the same time should be treated as a broader identity theft warning.
Secure the accounts first. Investigation can follow.
What to do if your identity is stolen
You do not need to solve the entire problem in one phone call. Work in order and keep records.
Contact the affected company
Call the fraud department using a verified phone number or the company’s official app. Explain that the account or transaction resulted from identity theft.
Ask the company to:
- Block unauthorized transactions
- Close or restrict fraudulent accounts
- Replace compromised cards
- Restore your access
- Correct contact information
- Send written confirmation of its findings
Do not use contact details supplied by the suspicious message that started the problem.
Secure your email and other accounts
Change compromised passwords, starting with your main email account. Use new, unique passwords rather than slightly changing the old one.
Review recovery email addresses, phone numbers, logged-in devices, forwarding rules, and recent activity. Turn on two-factor authentication, preferably through an authentication app or security key for important accounts when available.
Report the identity theft
IdentityTheft.gov is the federal government’s one-stop resource for reporting identity theft and creating a free, personalized recovery plan. It provides checklists, sample letters, and an FTC Identity Theft Report that can help you deal with businesses and credit reporting companies.
Save the report and every document generated through the process.
Place a credit freeze or fraud alert
A credit freeze restricts access to your credit file and can make it harder for a thief to open new accounts. You need to contact Equifax, Experian, and TransUnion separately to freeze all three files.
A fraud alert tells businesses reviewing your credit to take additional steps to verify your identity. Placing an initial alert with one nationwide bureau causes that bureau to notify the other two.
A freeze is generally the stronger tool for blocking new credit. Neither tool stops unauthorized use of an account the thief has already accessed.
Review your credit reports
Check all three reports for unfamiliar accounts, inquiries, addresses, balances, and collections.
Dispute fraudulent information with each bureau displaying it and with the company that supplied it. The CFPB recommends using IdentityTheft.gov when a report error resulted from identity theft.
Keep an identity theft log
Record:
- The company or agency contacted
- The date and time
- The representative’s name
- The case or confirmation number
- What you requested
- What the company promised
- The follow-up date
Save letters, account statements, screenshots, reports, and delivery confirmations.
Recovery can involve several companies. Your notes prevent the fifth conversation from starting at zero.
How to reduce the risk of identity theft
No product can guarantee that your identity will never be stolen. You can still make the thief’s job harder and catch misuse earlier.
Use unique passwords
Use a different strong password for every important account. A reputable password manager can create and store long, unique passwords without requiring you to memorize all of them.
When a company reports a password breach, change that password and any similar password used elsewhere.
Turn on stronger authentication
Two-factor authentication requires another form of proof in addition to a password.
For important accounts, an authentication app or security key is generally safer than text-message codes because text messages may be intercepted through SIM swap attacks. A text code is still better than password-only access when stronger options are unavailable.
Freeze your credit when appropriate
A credit freeze can be useful even before fraud occurs, particularly after a lost wallet, exposure of sensitive information, or a data breach. Freezing does not affect your score, but you will need to lift it when applying for legitimate credit.
Check accounts and reports
Review bank and card transactions instead of assuming the company’s fraud system will catch everything.
Turn on alerts for purchases, withdrawals, password changes, contact-information changes, and new payees. Review your credit reports periodically for accounts and inquiries you did not authorize.
Protect your mail and documents
Collect mail promptly, use secure outgoing mail options for sensitive documents, and shred records containing financial or identifying information before disposal.
Store Social Security cards, passports, tax records, and other important documents securely rather than carrying them every day.
Share your Social Security number carefully
Before providing it, ask:
- Why is it required?
- How will it be used?
- How will it be protected?
- Is another identifier acceptable?
A legitimate request may still deserve a clear explanation.
Verify unexpected messages
Do not click first and investigate later.
When a message claims to come from your bank, employer, delivery service, or government agency, contact the organization independently. Use its official app, a statement, or a website you typed or saved yourself.
What identity protection cannot do
Credit monitoring, identity monitoring, recovery services, and identity theft insurance can be useful, but they solve different problems.
Monitoring generally alerts you after information changes. It does not stop every fraudulent transaction.
A credit freeze helps with new credit accounts. It does not prevent a thief from using an existing card, filing a fraudulent tax return, seeking medical care, or attempting benefit fraud.
Identity theft insurance may cover certain recovery expenses under the policy. It does not reimburse every stolen dollar automatically or erase fraudulent records for you. The FTC recommends reviewing exactly what a monitoring or recovery service covers before paying for it.
The best protection is layered: strong account security, careful verification, transaction alerts, credit freezes where appropriate, report reviews, and a quick response when something looks wrong.
Frequently asked questions
Is credit card fraud the same as identity theft?
Unauthorized card use can be a form of identity theft because someone is using your financial information without permission. It may be limited to one card, or it may be part of a broader compromise involving other accounts.
Can someone steal my identity with only my name and address?
A name and address may not be enough for every type of fraud, but they can help a criminal impersonate you, create believable phishing messages, or combine those details with information obtained elsewhere.
Can identity theft happen without affecting my credit?
Yes. Tax, medical, employment, benefit, and existing-account fraud may occur without immediately creating a new credit account or score change.
Does checking my credit report hurt my score?
No. Reviewing your own credit reports does not create a hard inquiry or lower your score.
Should I place a credit freeze before identity theft happens?
You can. A proactive freeze may make sense when you are not applying for credit regularly or when sensitive information has been exposed. You must freeze each nationwide bureau separately.
Will a credit freeze stop someone from using my current credit card?
No. A freeze restricts access to your credit file for new applications. Contact the card issuer immediately when an existing account is compromised.
How do I know whether an identity theft email is real?
Do not trust the link or number in the message. Contact the company independently using its official app, a statement, or a known website. A real warning can be confirmed without using the suspicious message.
What should I do after a data breach?
Follow the response steps based on the information exposed. Change compromised and reused passwords, turn on stronger authentication, monitor affected accounts, and consider a credit freeze when sensitive identifying information was involved. IdentityTheft.gov provides breach-specific guidance.
Can a family member commit identity theft?
Yes. The person misusing your information does not need to be a stranger. Treat unauthorized accounts seriously even when you know who opened them, and get legal advice when family relationships make reporting or financial responsibility unclear.
How long does recovery take?
It depends on what the thief did. Replacing a compromised card may take days. Correcting fraudulent credit accounts, tax records, collections, or medical files can take much longer.
Keep following up until every affected company has corrected its own records.
Do I need to pay for identity theft recovery help?
No. IdentityTheft.gov provides a free recovery plan, FTC Identity Theft Report, checklists, and sample letters. Paid services may offer convenience or insurance, but they are not required to report the theft or begin recovery.
Identity theft often starts small
An identity thief does not always begin by taking out a large loan.
The first move may be a small card purchase, a password reset, a stolen letter, or a fake delivery text. The damage grows when the activity goes unnoticed or the same information opens several doors.
Pay attention to account alerts, statements, credit reports, tax notices, and medical records. Use unique passwords, stronger authentication, and credit freezes where appropriate.
If something looks wrong, do not wait for more proof to arrive in the mail. Secure the account, contact the affected company, report the identity theft, and document every step.
The sooner you close the first door, the fewer rooms the thief can enter.