What Is Identity Theft?
Identity theft occurs when a fraudster unlawfully obtains and uses your personal information—such as your social security number, date of birth, financial account numbers, or driver's license information—without your knowledge or consent. The goal is almost always financial gain. A thief with your identity can open credit card accounts, take out loans, make purchases, access existing bank accounts, or commit tax fraud all in your name. What makes identity theft so damaging is that victims often don't discover the crime until months or even years after it occurs, when debt collectors call or they notice suspicious accounts on their credit report.
The Main Vectors for Identity Theft
Identity thieves use multiple methods to steal your personal information. Understanding these vectors helps you protect yourself from the most common attack methods.
Data Breaches
When companies experience data breaches, hackers gain access to millions of customer records containing names, addresses, social security numbers, and payment information. Major retailers, healthcare providers, and even government agencies have suffered breaches. Once stolen data enters the dark web, criminal syndicates buy and sell it to the highest bidder. You may never know your data was compromised until suspicious activity appears on your accounts.
Phishing Scams
Phishing emails or text messages impersonate legitimate organizations like your bank or the IRS, asking you to verify your personal information by clicking a link. The fake website looks identical to the real one, and unsuspecting victims willingly enter their credentials, social security numbers, and financial details directly into the scammer's system.
Social Engineering
Social engineers manipulate you into revealing sensitive information through psychological tactics. A scammer might call claiming to be from your bank's fraud department and ask you to confirm your account number and PIN to "verify your identity." By appearing to represent a trusted institution and creating urgency, they convince you to divulge information that should remain private.
Mail Theft
Criminals steal mail containing financial statements, credit offers, tax documents, or personal checks from mailboxes. With these documents, they can open new credit accounts, change addresses on existing accounts, or create synthetic identities. Mail theft often goes undetected until the victim misses important financial communications.
Dark Web Purchases
Identity information is commoditized on the dark web. Criminal marketplaces sell full identity packages—including social security numbers, addresses, dates of birth, and financial details—often purchased in bulk from data breaches or stolen from previous victims. Purchasing stolen identities costs remarkably little, making this an attractive entry point for amateur fraudsters.
Types of Identity Theft
Not all identity theft looks the same. Different types target different resources and cause different types of damage.
Financial Identity Theft
The most common form, financial identity theft involves opening credit card accounts, taking out personal loans, getting business lines of credit, or draining existing bank accounts in the victim's name. Scammers use the stolen information to make purchases, withdraw cash, or establish new credit that they never repay. The victim's credit score plummets, and they may face lawsuits from creditors.
Tax Identity Theft
Fraudsters file tax returns in your name before you file yours, claiming your refund. The IRS sees that a return has already been filed and may flag your legitimate return as suspicious. Tax identity theft can delay your refund for months or years and requires extensive IRS paperwork to resolve.
Medical Identity Theft
Criminals use your name and insurance information to obtain medical services, prescription drugs, or medical equipment. This can result in fraudulent charges on your insurance and, worse, create medical records under your name with false information that could compromise your actual medical care if not corrected.
Synthetic Identity Theft
Scammers combine real information (like your real social security number) with fake information (like a fabricated name or address) to create a new "synthetic" identity. This is harder to detect because it's not your name being used for fraud. Synthetic identity theft often takes months to discover and is particularly damaging to credit reporting systems.
What Criminals Do With Stolen Identities
Once a criminal has your identity information, they have multiple options for extracting value from it. Understanding what they do helps you know what to look for if you suspect compromise.
Opening New Credit Lines
Using your name and social security number, a thief applies for credit cards, auto loans, or personal loans. Credit card companies may send new cards to an address the victim has changed their mail to, or the thief may access the statements online. The thief makes purchases or withdraws cash advances, then disappears. The debt appears on your credit report, damaging your credit score and making it difficult for you to borrow.
Filing Fraudulent Tax Returns
Tax identity thieves file returns claiming refunds using stolen identities. If they file before you do, the IRS may reject your legitimate return as a duplicate. Resolving this requires proving your identity to the IRS and filing an amended return, a process that can take years.
Committing Insurance Fraud
Criminals file false insurance claims or use your health insurance information to obtain medical services and prescription drugs for themselves. Your insurance premiums may increase due to fraudulent claims, and your actual claims may be denied because the thief has exhausted your coverage limits.
Accessing Existing Accounts
If a thief obtains your username and password through phishing or a data breach, they may log directly into your bank, investment, or retirement accounts and transfer money or make unauthorized investments. Some victims have discovered their retirement accounts emptied.
How to Check If Your Identity Has Been Stolen
Early detection of identity theft is critical to minimizing damage. Proactive monitoring can catch fraud weeks or months before it becomes widespread.
Monitor Your Credit Reports
You're entitled to one free credit report annually from each of the three major credit bureaus: Equifax, Experian, and TransUnion. Visit AnnualCreditReport.com (the official source) and review each report for accounts you don't recognize, incorrect personal information, or suspicious inquiries. Look for fraudulent credit cards, loans, or accounts opened in your name.
Subscribe to Credit Monitoring
Paid services like LifeLock or the credit bureaus' own monitoring programs alert you immediately when new accounts are opened, significant credit inquiries occur, or changes are made to your credit report. These services cost $100 to $200 annually but provide early warning that can save you thousands in fraud damages.
Check for Dark Web Alerts
Services like Have I Been Pwned (haveibeenpwned.com) notify you when your email appears in known data breaches. Other dark web monitoring services alert you when your social security number, identity information, or credentials are being sold on criminal marketplaces. This warning gives you time to act before fraud occurs.
Watch for Unexpected Documents
Sudden receipt of credit card statements, loan documents, or tax forms you didn't apply for is a red flag. Tax refund denials or IRS notices about a return you didn't file also indicate tax identity theft. Medical explanation of benefits or bills for treatments you never received signal medical identity theft.
Monitor Your Bank and Investment Accounts
Set up account alerts for transactions over a certain amount, new account access, or transfers from your accounts. Review statements monthly. Many criminals make small test transactions before moving larger amounts, and quick detection stops the bleeding.
Fraud Alerts and Credit Freezes
Two powerful tools can prevent new fraud from being opened in your name: fraud alerts and credit freezes.
Fraud Alerts in the United States
Contact any one of the three major credit bureaus (Equifax, Experian, or TransUnion) and request an initial fraud alert. They must notify the other two bureaus. A fraud alert tells lenders they should verify your identity before extending credit. Initial alerts last one year; extended alerts (for victims of confirmed identity theft) last seven years. Fraud alerts are free and easy to place online or by phone.
Credit Freezes in the United States
A credit freeze prevents anyone—including you—from accessing your credit report without a unique PIN. This stops a thief from opening new accounts in your name. You must contact each credit bureau (Equifax, Experian, TransUnion) separately to freeze your credit. Freezing is free and permanent until you unfreeze it. You'll need to temporarily unfreeze your credit if you apply for a loan or credit card yourself.
Canadian Resources
In Canada, contact Equifax Canada and TransUnion Canada to place fraud alerts or credit freezes. The Canadian Anti-Fraud Centre (CAFC) maintains a fraud alert registry. Canadians cannot contact Experian directly, as that bureau serves a smaller portion of the Canadian credit market.
The Identity Theft Recovery Process
If you've confirmed your identity has been stolen, a systematic recovery process minimizes ongoing damage and removes fraud from your accounts and credit report.
File a Report with the FTC
Visit IdentityTheft.gov (run by the Federal Trade Commission) and complete an identity theft report. The FTC provides a customized recovery plan specific to your situation—whether you're dealing with credit card fraud, tax fraud, or account takeover. The report is free and takes about 30 minutes to complete. Print a copy; this document is proof of your identity theft claim and helps when disputing charges with creditors and credit bureaus.
File a Police Report
Contact your local police and file a report. You'll need the FTC report as documentation. A police report number strengthens your credibility when disputing fraud with banks and credit bureaus and is sometimes required by creditors before they'll reverse fraudulent charges.
Dispute Fraudulent Charges
For fraudulent credit card accounts, submit a fraud dispute to each credit card company. Legitimate credit card issuers are liable for fraud and usually remove fraudulent charges within 30 to 60 days. For fraudulent bank account transfers, contact your bank immediately; some have shorter windows for disputing unauthorized transfers (often 60 days).
Remove Fraudulent Accounts from Your Credit Report
Request that each fraudulent account be removed from your credit report by sending a written dispute to each credit bureau. Include your FTC report and police report as supporting documentation. Credit bureaus have 30 days to investigate and must remove unverified fraud.
Request New Accounts Be Flagged
Contact the fraud departments of institutions where identity theft occurred. Request that they flag your accounts to prevent future fraud and ask about whether the thief had access to your account for an extended period. This helps you understand your exposure.
Ongoing Protection After Identity Theft
Recovery doesn't end once fraudulent accounts are removed. Identity theft victims remain at higher risk of repeated fraud and must maintain vigilance.
Place a Long-Term Fraud Alert
After identity theft is confirmed, place an extended fraud alert (seven years in the US) with the credit bureaus. This provides longer-term protection than an initial alert.
Continue Credit Monitoring
Many victims increase their credit monitoring to daily or weekly reviews in the months after identity theft. Some purchase credit monitoring services to receive immediate alerts of new accounts or inquiries.
Freeze Your Credit Proactively
Keeping your credit frozen prevents new fraud even if a criminal obtains your personal information again. You unfreeze it temporarily only when you apply for credit yourself. Many victims choose to keep their credit permanently frozen as a defensive measure.
Change Passwords and Enable Two-Factor Authentication
Update passwords on all financial accounts, email accounts, and important websites. Enable two-factor authentication wherever possible. If a thief obtained your credentials in a data breach, changing passwords prevents them from accessing your current accounts.
Identity theft related to data breaches and social engineering often involves criminals harvesting personal information from employment backgrounds. Learn how employment scams can lead to data harvesting and identity theft through fake job opportunities.
Other Scams to Watch For
People researching this scam also check these related pages.
Employment Scam
Recognize fake job postings, advance-fee fraud, and check scams.
Check NowEmployment Job Scam
Detect fraudulent job offers and employment fraud schemes.
Check NowJob Offer Scam
Identify fake job offers, work-from-home fraud, and hiring scams.
Check NowFake Job Offer Scam
Spot fabricated job offers used to steal money or credentials.
Check NowLinkedIn Job Scam
Detect fake LinkedIn job postings and recruiter impersonation.
Check NowRemote Work Scam
Recognize fraudulent remote job offers and work-from-home scams.
Check NowFake Check Scam
Recognize fake check fraud and overpayment scams.
Check NowCheque Overpayment Scam
Detect cheque overpayment fraud and money mule schemes.
Check NowFrequently Asked Questions
How long does it take to recover from identity theft?
Recovery timelines vary widely. Resolving fraudulent credit cards may take 30 to 90 days, while removing fraudulent accounts from your credit report can take several months. Tax identity theft may take 1 to 3 years to fully resolve through the IRS. Most victims spend 100 to 200 hours dealing with recovery paperwork and communications.
Am I liable for fraudulent charges on accounts opened in my name?
Generally, no. For credit card fraud, the Fair Credit Billing Act caps your liability at $50 per card, and most major issuers waive this amount entirely. For bank account fraud, your liability depends on how quickly you report it; prompt reporting limits your liability to $50. However, non-payment of fraudulent accounts can damage your credit and lead to collection actions.
Will my credit score recover after identity theft?
Yes, but it takes time. Once fraudulent accounts are removed from your credit report, your score begins to improve. However, the negative information remains visible for seven years in most cases. Responsible credit use going forward—paying bills on time and keeping credit utilization low—accelerates recovery. Some victims see meaningful score improvement within 6 to 12 months of resolving the fraud.
Can I prevent identity theft entirely?
You cannot eliminate all risk, especially in cases of large data breaches. However, you can significantly reduce your risk by using strong unique passwords, enabling two-factor authentication, monitoring your credit regularly, using a credit freeze, and being cautious about sharing personal information. Proactive monitoring and quick response to suspected fraud minimize damage.
What should I do if I think someone has my social security number?
Place a fraud alert with the credit bureaus immediately, monitor your credit reports weekly for three months, enable credit monitoring alerts, consider a credit freeze, and watch for suspicious mailing activity. You don't necessarily need to replace your social security number—the Social Security Administration rarely reissues them. However, monitor the accounts and credit associated with that number vigilantly.