Identity theft is when someone steals your personal information — name, Social Security number, card or account details — to open accounts, make purchases, or commit fraud in your name. If it happens, act fast: freeze your credit, report to the authorities, and document everything. Speed dramatically limits the damage.
How identity theft happens
Your personal information can be compromised through:
- ▸
Data breaches — major breaches at companies you've used expose names, emails, passwords, SSNs, and financial data. Check haveibeenpwned.com to see if your data has been exposed.
- ▸
Phishing — tricked into entering credentials on fake websites.
- ▸
Social engineering — scammers calling banks or utilities impersonating you using information gathered from social media.
- ▸
Physical theft — stolen mail, wallets, or documents.
- ▸
Dark web marketplaces — stolen data is aggregated, packaged and resold in bulk. Prices quoted for a "full identity" circulate widely but trace to vendor marketing rather than any auditable source, so we do not put a figure on it.
- ▸
Public Wi-Fi — unencrypted connections can be intercepted by attackers on the same network.
Many of these start with a single phishing message that harvests one password.
Signs your identity has been stolen
Watch for these warning signs:
- ▸
Unfamiliar accounts or charges on your credit report.
- ▸
Bills or collection notices for accounts you didn't open.
- ▸
IRS notification that multiple tax returns were filed under your name.
- ▸
Medical bills for treatments you didn't receive.
- ▸
Denied credit applications when you have good credit history.
- ▸
Authentication codes you didn't request arriving via SMS or email.
- ▸
Login alerts from accounts you didn't access.
- ▸
Mail that stops arriving (may indicate address change fraud).
The call that tells you to act now
Most identity theft is discovered after the fact, in a credit file or a letter about an account you never opened. But the moment that costs people the most is a phone call, and it is worth separating that moment out, because it is the one part of identity theft where you get a decision to make.
Someone calls from the fraud department. They know your name, your address, the last four digits, perhaps a recent transaction. That is not evidence they are your bank. It is evidence they have your data, which is the thing that was stolen in the first place. The details they recite are the product of the breach, not proof of identity.
End the call and phone the number printed on your card or in your banking app. If the call was genuine, the fraud team will pick up the same case. Nothing is lost by doing this, and no real institution will ever penalise you for it.
A real fraud department expects that and is often relieved by it. They already hold your file, which is precisely why they never need you to read them a password, a full national insurance or social security number, or a code that has just arrived by text. A caller who needs those things is not confirming who you are. They are collecting what they are missing.
The second version of this test is the strongest thing you can do after a theft, and it works the same way. A credit freeze costs a legitimate lender nothing but time. A genuine application simply waits until you lift it, on your schedule, and the lender will say so. A fraud cannot wait, because the stolen identity has a short shelf life and the whole value is in opening accounts before you notice. So if anyone tells you the freeze has to come off immediately, or offers to lift it for you, or explains that it will damage your credit score, they have told you what the freeze is doing.
None of this means stop watching for the signs. The warning signs above are how most people find out at all, and checking your credit file remains the single best habit. The claim is narrower: what a caller knows about you can no longer confirm who they are, because knowing things about you is what the criminal bought. Use the signs to detect it. Use the callback and the freeze to decide.
Immediate recovery steps
If you suspect identity theft, act in this order (for the broader picture, see our scam recovery guide, and our reporting directory for the right agency in your country):
- 1.
Place a fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion) — they're required to notify the other two.
- 2.
Freeze your credit at all three bureaus — this prevents new accounts from being opened in your name.
- 3.
Review your credit reports for unfamiliar accounts — you're entitled to free reports at annualcreditreport.com.
- 4.
Report to the FTC at identitytheft.gov — they create a personalized recovery plan and provide affidavits.
- 5.
File a police report — you'll need this documentation for disputes with creditors.
- 6.
Contact every institution where fraud occurred — dispute unauthorized charges and accounts in writing.
- 7.
Change passwords on all accounts, especially email and banking. Enable two-factor authentication everywhere.
- 8.
Consider an identity theft protection service for ongoing monitoring.
The emotional toll of identity theft is underestimated. Victims describe feeling violated, paranoid, and exhausted by months of phone calls and paperwork. If you're going through this, know that it does end — and every step you take makes it harder for the thief to continue using your information.
Written from real-world experience. All statistics sourced from verified organizations.
Frequently Asked Questions
Sources & References
Every statistic in this guide is sourced from verified organizations. Click to verify any claim.
Think your identity has been stolen?
Get expert guidance on the recovery process and protecting yourself from further damage.
Book a Consultation →