Identity Theft: Signs, Prevention Tips & What to Do Fast

What Is Identity Theft and Why It Keeps Growing

Identity theft happens when someone steals your personal information to impersonate you. Criminals use your Social Security number, credit card details, or account credentials to open accounts, take loans, or commit fraud in your name. The damage can last years and cost thousands of dollars to repair.

The FTC received more than 1 million identity theft reports in 2023[1] through IdentityTheft.gov, and more than 1.1 million in 2024[2]. Data breaches, phishing attacks, and weak account security feed this volume. Every stolen record becomes a tool for financial fraud.

Recovery is rarely a single phone call. Victims often have to close accounts, dispute charges, correct credit reports, and follow up with each company, which is why the FTC publishes a step-by-step recovery plan[3] for people who report a theft.

Strong passwords, multi-factor authentication, encrypted internet connections, and credit freezes are your most effective defenses. But knowing how identity theft happens and spotting it early makes the biggest difference.

How Identity Theft Happens in Practice

Criminals use several proven methods to steal identities. Understanding each one helps you block the most common attack paths.

Data Breaches Expose Millions of Records

Large-scale breaches at companies like Equifax, which exposed the personal information of 147 million people in 2017[4], and T-Mobile, whose 2021 breach affected 76.6 million people[5] according to the FCC, put personal data into criminal hands. Names, dates of birth, and Social Security numbers are exactly what an identity thief needs to open accounts in someone else’s name.

Phishing Attacks Trick You Into Sharing Details

Phishing emails and texts impersonate banks, the IRS, or companies you trust. They direct you to fake login pages that capture your credentials. The FBI’s Internet Crime Complaint Center logged 298,878 phishing and spoofing complaints in 2023[6]. These attacks succeed because they create urgency and mimic legitimate communications.

Public Wi-Fi Interception Captures Unencrypted Data

Public Wi-Fi at coffee shops, airports, and hotels is less risky than it used to be, because most websites now use encryption[7] (look for the lock symbol or https). The exposure that remains is traffic that is not encrypted, such as some apps and older sites, plus fake networks that imitate a real one.

A VPN encrypts the traffic between your device and the VPN server, so other people on the same network cannot read it. It is a useful extra layer on networks you do not trust, but it does not replace unique passwords or multi-factor authentication, and it does not stop phishing.

Physical Theft Still Works

Stolen mail, dumpster diving, and wallet theft remain effective. Pre-approved credit card offers, bank statements, and tax documents contain enough information to open fraudulent accounts. Criminals also steal from accessed cars, gym lockers, and office desks.

Synthetic Identity Fraud Combines Real and Fake Data

The Federal Reserve describes synthetic identity fraud as a crime in which perpetrators combine fictitious and sometimes real information[8], such as Social Security numbers and names, to create new identities. The same paper cites McKinsey’s estimate that it is the fastest-growing type of financial crime in the United States, and notes it is hard to detect because no single real person raises an alarm immediately.

Warning Signs and Red Flags of Stolen Identity

Catching identity theft early limits the damage. Watch for these specific indicators.

Warning Sign	What It May Indicate
Unfamiliar charges on bank or credit card statements	Financial account compromise
Unexpected credit denials or score drops	Fraudulent accounts opened in your name
Bills or collection calls for accounts you didn’t open	Identity used to take on debt
Missing mail or expected statements	Address changed by a fraudster
Unfamiliar accounts on your credit report	New credit lines opened fraudulently
IRS notice for duplicate tax filing	Tax identity theft
Locked out of an existing online account	Credentials compromised and changed
Medical bills for services you never received	Medical identity theft
Two-factor codes arriving that you did not request	Someone attempting account takeover

Check your credit report at least once per quarter. All three nationwide bureaus offer free weekly reports[9] through AnnualCreditReport.com. Look for accounts you did not open, addresses you have never lived at, and hard inquiries you did not authorize.

Monitor your bank and credit card statements weekly. Set up transaction alerts for every purchase, however small. Many banks offer real-time push notifications that flag suspicious activity within seconds.

Immediate Steps to Take If Your Identity Is Stolen

Speed matters. The faster you act, the less damage criminals can do. Follow these steps in order.

Step 1: Freeze Your Credit at All Three Bureaus

Contact each bureau directly to place a freeze. There is no cost to place or remove a freeze[10], and it blocks anyone from opening new credit in your name.

• Equifax: freeze online at equifax.com
• Experian: freeze online at experian.com
• TransUnion: freeze online at transunion.com

Under federal law, a bureau must place a freeze within one business day[11] of a phone or secure online request, and must remove it within one hour of a phone or secure online request. A freeze does not affect your credit score.

A credit freeze differs from a fraud alert. A freeze blocks new accounts entirely, even for you, until you remove it. A fraud alert makes lenders verify your identity[10] before granting new credit, but it does not stop businesses from seeing your credit report. A fraud alert needs only one bureau, which notifies the other two. Use both.

Step 2: File Reports with the FTC and Local Police

Report the theft at IdentityTheft.gov. The FTC gives you a free personal recovery plan with next steps[3], and the Identity Theft Report it creates proves to businesses that someone stole your identity.

File a police report with your local department if you need one. Combining the FTC report with a police report gives you a fuller Identity Theft Report. Bring your FTC report, a government-issued ID, and proof of your address.

Step 3: Contact Every Affected Financial Institution

Call each bank, credit card issuer, and financial institution where fraud occurred. Ask to speak with the fraud department. Request account closure or new account numbers. Ask for written confirmation of every fraudulent charge removed.

Change passwords on every affected account. Use a unique password for each account, and make it at least 16 characters[12]. Enable multi-factor authentication everywhere it is available.

Step 4: Dispute Fraudulent Accounts on Your Credit Reports

File formal disputes with each credit bureau showing fraudulent accounts. Include your FTC Identity Theft Report and police report number. A credit reporting company generally must investigate a dispute within 30 days[13] of receiving it, and some disputes can take up to 45 days.

Step 5: Monitor Everything for 12 Months Minimum

Identity thieves often wait weeks or months before using stolen data. Continue checking credit reports, bank statements, and tax records. Set calendar reminders for quarterly credit pulls.

Long-Term Prevention Strategies That Actually Work

Prevention costs far less time and money than recovery. These methods reduce your exposure to identity theft by blocking the most common attack vectors.

Use Unique, Strong Passwords on Every Account

Reusing a password means one breach can expose every account that shares it. CISA’s advice is to use a different strong password for each account[12] and a password manager to keep track of them. Never reuse a password across multiple sites.

Enable Multi-Factor Authentication Everywhere

Microsoft says multi-factor authentication (MFA) can block over 99.9 percent of account compromise attacks[14]. Where you can, use an authenticator app or a security key instead of SMS codes, because the FTC warns that text message verification may not stop a SIM card swap[15].

Encrypt Your Internet Connection on Public Networks

Check for https on every site you use on a network you do not control. A VPN adds a second layer by encrypting the traffic between your device and the VPN server, which keeps other people on the same network from reading it.

Shred Physical Documents Before Discarding

Cross-cut shred all documents containing personal information. This includes bank statements, medical records, pre-approved credit offers, and tax documents.

Opt Out of Pre-Approved Credit Offers

Call 1-888-5-OPT-OUT (888-567-8688) or visit optoutprescreen.com to opt out of prescreened credit and insurance offers[16] for five years or permanently. These mailings contain enough personal information for criminals to open accounts if intercepted.

Lock Your Mailbox and Go Paperless

A locked mailbox prevents mail theft. Switching to paperless statements for banks, credit cards, and utilities eliminates physical documents from your mail entirely. Set up USPS Informed Delivery[17], which is free, to get daily email previews of incoming mail.

What Recovery Involves by Type of Theft

How long recovery takes depends on the type and extent of the theft, and no authority publishes a reliable average for each type. What each type needs is more predictable.

Type of Identity Theft	Key Steps
Credit card fraud	Dispute charges, replace cards, monitor statements
New account fraud	Freeze credit, dispute accounts, file an FTC report
Tax identity theft	File IRS Identity Theft Affidavit (Form 14039) and respond to IRS notices
Medical identity theft	Contact providers, correct medical records, dispute insurance claims
Criminal identity theft	Work with law enforcement and the courts to correct records
Synthetic identity theft	Complex disputes, may require legal counsel

Tax cases are the slowest to measure. The National Taxpayer Advocate reported that the average time to resolve many IRS identity theft victim assistance cases reached 676 days at the end of fiscal year 2024[18], against an IRS goal of 120 days. If the IRS rejects your return because someone already filed with your number, submit the Identity Theft Affidavit, Form 14039[19], and keep copies of everything you send.

Resources for Identity Theft Victims

Identity theft can devastate your finances, credit, and personal life. But understanding exactly how this crime works and taking proactive steps makes you a much harder target.

Stay alert for the warning signs outlined above. Act within 24 hours if you suspect compromise. Freeze your credit, file your FTC report, and secure every account immediately. The faster you respond, the less damage criminals can cause.

For ongoing protection, combine strong passwords, multi-factor authentication, encrypted connections on public networks, and regular credit monitoring. No single tool stops every threat. Layered defenses work because they force criminals to bypass multiple barriers instead of one.

Guard your identity now. The alternative is months or years of chaos, debt, and anxiety untangling a crime you could have prevented.

References

1. Federal Trade Commission. 2024. As Nationwide Fraud Losses Top $10 Billion in 2023, FTC Steps Up Efforts to Protect the Public. Retrieved October 16, 2026 from https://www.ftc.gov/news-events/news/press-releases/2024/02/nationwide-fraud-losses-top-10-billion-2023-ftc-steps-efforts-protect-public.Archived: Wayback Machine snapshot
2. Federal Trade Commission. 2025. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024. Retrieved October 16, 2026 from https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024.Archived: Wayback Machine snapshot
3. Consumer Advice. 2024. How to recover from identity theft. Retrieved October 16, 2026 from https://consumer.ftc.gov/consumer-alerts/2024/09/how-recover-identity-theft.Archived: Wayback Machine snapshot
4. Federal Trade Commission. 2019. Equifax Data Breach Settlement. Retrieved October 16, 2026 from https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement.Archived: Wayback Machine snapshot
5. FCC. n.d. DA 24 860A1. Retrieved October 16, 2026 from https://docs.fcc.gov/public/attachments/DA-24-860A1.pdf.
6. IC3. 2024. 2023 IC3Report. Retrieved October 16, 2026 from https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf.Archived: Wayback Machine snapshot
7. Consumer Advice. 2026. Are Public Wi-Fi Networks Safe? What You Need To Know. Retrieved October 16, 2026 from https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know.Archived: Wayback Machine snapshot
8. Fedpaymentsimprovement. n.d. Frs Synthetic Identity Payments Fraud White Paper July 2019. https://fedpaymentsimprovement.org/wp-content/uploads/frs-synthetic-identity-payments-fraud-white-paper-july-2019.pdf.Archived: Wayback Machine snapshot
9. Consumer Advice. 2023. Free Credit Reports. Retrieved October 16, 2026 from https://consumer.ftc.gov/articles/free-credit-reports.Archived: Wayback Machine snapshot
10. Consumer Advice. 2021. Credit Freezes and Fraud Alerts. Retrieved October 16, 2026 from https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts.Archived: Wayback Machine snapshot
11. Consumer Financial Protection Bureau. n.d. What is a credit freeze or security freeze on my credit report? Retrieved October 16, 2026 from https://www.consumerfinance.gov/ask-cfpb/what-is-a-credit-freeze-or-security-freeze-on-my-credit-report-en-1341/.Archived: Wayback Machine snapshot
12. Cybersecurity and Infrastructure Security Agency CISA. n.d. Use Strong Passwords. Retrieved October 16, 2026 from https://www.cisa.gov/secure-our-world/use-strong-passwords.Archived: Wayback Machine snapshot
13. Consumer Financial Protection Bureau. n.d. How long does it take to repair an error on a credit report? Retrieved October 16, 2026 from https://www.consumerfinance.gov/ask-cfpb/how-long-does-it-take-to-repair-an-error-on-a-credit-report-en-1339/.Archived: Wayback Machine snapshot
14. M. Maynes. 2019. One simple action you can take to prevent 99.9 percent of attacks on your accounts. Microsoft Security Blog (August 20, 2019). Retrieved October 16, 2026 from https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/.Archived: Wayback Machine snapshot
15. Consumer Advice. 2019. SIM Swap Scams: How to Protect Yourself. Retrieved October 16, 2026 from https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself.Archived: Wayback Machine snapshot
16. Consumer Advice. 2023. What To Know About Prescreened Offers for Credit and Insurance. Retrieved October 16, 2026 from https://consumer.ftc.gov/articles/what-know-about-prescreened-offers-credit-and-insurance.Archived: Wayback Machine snapshot
17. Usps. n.d. Informed Delivery® - Mail & Package Notifications. Retrieved October 16, 2026 from https://www.usps.com/manage/informed-delivery.htm.
18. IRS. n.d. ARC24 MSP 03 Identity Theft. Retrieved October 16, 2026 from https://www.taxpayeradvocate.irs.gov/wp-content/uploads/2024/12/ARC24_MSP_03_Identity-Theft.pdf.Archived: Wayback Machine snapshot
19. IRS. n.d. F14039. Retrieved October 16, 2026 from https://www.irs.gov/pub/irs-pdf/f14039.pdf.Archived: Wayback Machine snapshot

Resources for this page

Charts and reference images from our research, free to view and share.

• 

• Identity Theft: Signs, Prevention Tips & What to Do FastPDF · 1.3 MB

Frequently Asked Questions

AllHow it worksThreatsProtectionBest practices

What is identity theft and how common has it become?

Identity theft occurs when someone steals your personal information, like a Social Security number or account credentials, to open accounts or commit fraud in your name. The FTC received more than 1 million identity theft reports in 2023 and more than 1.1 million in 2024. Recovery usually means closing accounts, disputing charges, and correcting credit reports one company at a time.

What are the most common ways criminals steal your identity?

Criminals rely on data breaches, phishing, public Wi-Fi interception, physical theft, and synthetic fraud. The 2017 Equifax breach exposed the personal information of 147 million people, and T-Mobile’s 2021 breach affected 76.6 million. The FBI’s Internet Crime Complaint Center logged 298,878 phishing and spoofing complaints in 2023.

What is synthetic identity fraud and why is it so hard to catch?

Synthetic identity fraud combines fictitious and sometimes real information, such as a Social Security number and a name, into a new identity. Criminals build credit under this blended profile before maxing out accounts. The Federal Reserve cites an estimate that it is the fastest-growing financial crime in the US, partly because no single victim notices right away.

What warning signs suggest my identity has already been stolen?

Key red flags include unfamiliar charges on statements, sudden credit score drops or denials, bills for accounts you never opened, an IRS notice about a duplicate tax filing, being locked out of an existing account, and two-factor codes arriving that you didn’t request. Any of these can mean your information is already being misused.

What should I do in the first 24 hours after suspecting identity theft?

Freeze your credit at Equifax, Experian, and TransUnion immediately, since a freeze is free and blocks new accounts outright. File a report at IdentityTheft.gov, which generates a personalized recovery plan and pre-filled dispute letters. Then file a local police report, since some creditors require the report number to remove fraud.

What’s the difference between a credit freeze and a fraud alert?

A credit freeze blocks new credit in your name, must be placed within one business day of an online or phone request, and must be removed within an hour of one. A fraud alert makes lenders verify your identity first but does not stop them seeing your report. A freeze needs all three bureaus; an alert needs only one.

How do I dispute fraudulent accounts showing up on my credit report?

File formal disputes with each credit bureau, attaching your FTC Identity Theft Report and police report number as documentation. Credit reporting companies generally must investigate within 30 days, and some disputes can take up to 45 days. Keep checking your report afterward in case entries reappear.

What’s the most effective way to prevent identity theft before it happens?

Layer multiple defenses instead of relying on one. Use a password manager for unique 16-plus character passwords on every account, enable multi-factor authentication everywhere available, encrypt public Wi-Fi traffic with a VPN, cross-cut shred financial documents, and opt out of pre-approved credit offers by calling 888-567-8688 or visiting OptOutPrescreen.com.

Should I use SMS codes or an authenticator app for two-factor authentication?

Use an authenticator app like Google Authenticator or Authy instead of SMS codes, since SIM-swapping attacks let criminals intercept text messages directly. Microsoft says multi-factor authentication can block over 99.9 percent of account compromise attacks, making it one of the highest-impact defenses available. Pair it with unique passwords, since one reused password can expose every account that shares it.

What tools should I use to monitor for identity theft on an ongoing basis?

Pull free weekly credit reports from Equifax, Experian, and TransUnion through AnnualCreditReport.com, checking at minimum once per quarter for accounts you didn’t open or addresses you’ve never lived at. Pair this with bank transaction alerts for real-time fraud notifications, plus a password manager and VPN for daily account and connection security.

How does a VPN actually protect against identity theft on public Wi-Fi?

A VPN encrypts the traffic between your device and the VPN server, so other people on an unsecured public Wi-Fi network cannot read it. Most websites already use https, which the FTC says makes public Wi-Fi usually safe, so a VPN is an extra layer rather than a cure. It does not stop phishing.

How long does it actually take to recover from identity theft?

Recovery time depends heavily on the type of theft, and no authority publishes a reliable average for each type. Tax cases are the best measured: the National Taxpayer Advocate reported an average of 676 days for many IRS identity theft victim assistance cases at the end of fiscal year 2024.

What does an IRS notice about a duplicate tax filing mean?

It’s a clear sign of tax identity theft, meaning someone filed a return using your Social Security number before you did. File IRS Identity Theft Affidavit Form 14039 right away and keep copies of everything you send. The National Taxpayer Advocate reported that many such cases averaged 676 days to resolve at the end of fiscal year 2024.