More than a million Americans reported identity theft in 2024. The strongest defence is free.

How identity theft happens

Your personal information can be compromised through:

• ▸

  Data breaches — major breaches at companies you've used expose names, emails, passwords, SSNs, and financial data. Check haveibeenpwned.com to see if your data has been exposed.

• ▸

  Phishing — tricked into entering credentials on fake websites.

• ▸

  Social engineering — scammers calling banks or utilities impersonating you using information gathered from social media.

• ▸

  Physical theft — stolen mail, wallets, or documents.

• ▸

  Dark web marketplaces — stolen data is aggregated, packaged and resold in bulk. Prices quoted for a "full identity" circulate widely but trace to vendor marketing rather than any auditable source, so we do not put a figure on it.

• ▸

  Public Wi-Fi — unencrypted connections can be intercepted by attackers on the same network.

Many of these start with a single phishing message that harvests one password.

Received a notice about exposed data? Our Conduent breach-letter guide shows how to verify that particular notice and understand the next steps.

Signs your identity has been stolen

Watch for these warning signs:

• ▸

  Unfamiliar accounts or charges on your credit report.

• ▸

  Bills or collection notices for accounts you didn't open.

• ▸

  IRS notification that multiple tax returns were filed under your name.

• ▸

  Medical bills for treatments you didn't receive.

• ▸

  Denied credit applications when you have good credit history.

• ▸

  Unexpected authentication codes: check the account independently, but a code alone does not prove identity theft.

• ▸

  Login alerts from accounts you didn't access.

• ▸

  Mail that stops arriving (may indicate address change fraud).

The call that tells you to act now

Unfamiliar accounts and notices can reveal identity misuse, while unexpected calls may try to obtain additional access. Treat personal information the caller knows as a claim to check, not authentication.

An unexpected caller may know your name, address, partial account details or a transaction. That does not establish they represent your bank, and you cannot determine the source of their information from the call alone. Verify through the bank’s official route.

For the phone-number side of this, see what a scammer can do with your number and personal details. It distinguishes a convincing caller from someone who has actually taken control of your number.

Do not provide passwords or security codes to an unexpected caller. End the contact and use the institution’s official app or a number you already have. A legitimate identity check you initiate may require personal details, so the contact route and purpose matter.

A U.S. credit freeze restricts access to your credit file and helps prevent new-credit misuse. It is free and does not affect your credit score, but it does not protect every existing account or every form of identity theft. Lift it only through the bureau’s official route when needed. See the FTC’s freeze guidance.

Keep monitoring statements and credit reports as well as using independent contact. A credit freeze helps address new-credit risk; account security and reporting address other kinds of misuse.

Protect the phone number your accounts depend on, too. Our SIM-swap and port-out protection guide explains the difference between a SIM PIN and the account controls offered by US carriers.

Immediate recovery steps

If you suspect identity theft, act in this order (for the broader picture, see our scam recovery guide, and our reporting directory for the right agency in your country):

1. 1.

   Place a fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion) — they're required to notify the other two.

2. 2.

   Freeze your credit at all three bureaus — this restricts access to your credit file and helps prevent new-credit misuse. It does not protect every existing account or every form of identity theft.

3. 3.

   Review your credit reports for unfamiliar accounts — you're entitled to free reports at annualcreditreport.com.

4. 4.

   Report to the FTC at identitytheft.gov — they create a personalized recovery plan and provide affidavits.

5. 5.

   Follow the relevant reporting route and retain reference numbers; a police report may be useful or required for particular disputes.

6. 6.

   Contact every institution where fraud occurred — dispute unauthorized charges and accounts in writing.

7. 7.

   Change exposed or reused passwords from a trusted device and secure affected accounts. Enable multi-factor authentication where available.

8. 8.

   Use free credit reports and account alerts. If considering paid monitoring, check what it adds and remember that monitoring does not prevent every misuse.

Reviewed 23 September 2026. We corrected overbroad verification and recovery claims during our launch-content review. See the corrections log for the material changes.