Identity theft: how it happens, warning signs and what to do

Identity theft is not one crime but a family of them. The US Federal Trade Commission defines it simply: "when someone uses your personal or financial information without your permission" (FTC). That can mean a new credit card in your name, a stolen tax refund, medical treatment billed to your insurance, or a phone number hijacked to break into your bank. This guide explains the common types, how criminals get the information, the warning signs, and what to do step by step, drawing on the FTC, the IRS, the credit bureaus and, for UK readers, Report Fraud and Cifas. It ends with a balanced look at paid identity theft protection services and what you can do yourself for free.

The main types of identity theft

• Financial identity theft: using your card or bank details, or opening new credit cards, loans, or phone, electricity or gas accounts in your name. The FTC lists all of these as typical uses of stolen information.
• Tax identity theft: filing a tax return with your Social Security number to collect your refund. The FTC notes that credit monitoring will not alert you to this.
• Medical identity theft: using your name, Social Security number, insurance or Medicare number to get care, prescriptions or devices, or to submit insurance claims. The FTC warns that if the thief's health information is mixed with yours, it could affect the care and benefits you can get (FTC).
• Synthetic identity fraud: building a fake person from a mix of real and invented details. The Federal Reserve's industry definition is "the use of a combination of personally identifiable information (PII) to fabricate a person or entity" for gain (Federal Reserve FedPayments Improvement). Your real Social Security number can be part of an identity that is otherwise fictional.
• Child identity theft: using a child's Social Security number, name or date of birth to claim benefits, open accounts, take out loans or rent a home, often unnoticed for years (FTC).
• Account takeover: getting into an existing email, bank, shopping or social media account, usually with a stolen or reused password.
• SIM swapping: tricking or bribing a mobile carrier into moving your number to a SIM card the criminal holds. The FBI explains that once this happens, password reset messages and text-message codes go to the criminal, who can then take over accounts linked to your number.

How criminals get your information

USA.gov lists the common routes: stealing a wallet or purse, going through rubbish for bank statements or tax documents, installing skimmers on cash machines, tills and fuel pumps, intercepting data on public Wi-Fi, phishing by email, text or phone, and mining social media posts, photos and online quizzes for identifying details (USA.gov). Missing post is another sign it notes. Data breaches add to this: when a company is hacked, the stolen records can be sold or published, and the UK's National Cyber Security Centre warns that criminals then use the details to make phishing messages look legitimate (NCSC).

Warning signs

The FTC and USA.gov give the same practical checklist:

• A regular bill stops arriving, which can mean someone changed your billing address.
• Charges or withdrawals you did not make, or a bill you did not expect.
• Debt collectors calling about accounts you never opened.
• Accounts you do not recognise on your credit report.
• A loan application turned down for no clear reason.
• Post that stops arriving or goes missing.
• For medical identity theft, a bill or Explanation of Benefits statement for treatment you never had, or a notice that you have reached your benefit limit.

What to do if it happens: a step-by-step plan (US)

1. Call the companies where the fraud happened. Ask the fraud department to close or freeze the affected accounts and change passwords and PINs. USA.gov lists this alongside reporting to the FTC and the credit bureaus.
2. Report it at IdentityTheft.gov. The FTC says you will get "a free personal recovery plan with next steps," which you can update as you go, plus pre-filled letters and forms for credit bureaus, businesses and debt collectors. The site covers more than 30 types of identity theft; you can also call 877-438-4338 (IdentityTheft.gov).
3. Place a fraud alert or a credit freeze, or both. They work differently (see below).
4. File a police report if you need one. Some creditors ask for it, and a police report or an FTC identity theft report lets you place an extended fraud alert.
5. Deal with tax identity theft separately. USA.gov points victims who have not had an IRS notice to Form 14039, the Identity Theft Affidavit. Then get an IRS Identity Protection PIN (below).
6. Check your credit reports for anything else and dispute what is wrong. Free reports are available every week from AnnualCreditReport.com, the only site the FTC recognises for the free reports (FTC).

Fraud alert or credit freeze?

Both are free. The FTC explains the difference (FTC):

• Credit freeze: while it is in place, "nobody can open a new credit account in your name, including you." It lasts until you lift it, does not affect your credit score, and you must place it with each of the three bureaus: Equifax, Experian and TransUnion. You lift it temporarily when you apply for credit, a job or a flat. Anyone can freeze their credit at any time, not only victims.
• Initial fraud alert: tells businesses to check with you before opening a new account. It lasts one year and can be renewed, and you only contact one bureau, which must tell the other two.
• Extended fraud alert: for confirmed victims with an FTC identity theft report or police report. It lasts seven years.

Equifax states that "placing, temporarily lifting, or removing a security freeze is free" (Equifax), and Experian lets you unfreeze or schedule a thaw from your account (Experian). Parents can request a free freeze for a child under 16.

The IRS Identity Protection PIN

An IP PIN is "a six-digit number that prevents someone else from filing a tax return using your Social Security number" or ITIN. Anyone who can verify their identity can get one, even if they are not required to file, and a new PIN is issued every calendar year. The IRS adds: "The IRS will never ask for your IP PIN," so any call, email or text asking for it is a scam (IRS).

In the UK

In England, Wales and Northern Ireland, fraud and cyber crime are reported to Report Fraud, the national reporting centre whose site now appears at the former Action Fraud web address; people in Scotland are asked to report via 101 (Report Fraud). Cifas offers Protective Registration for people at heightened risk: it flags your details so that member organisations "carry out extra checks to make sure it's really you applying." It costs £30 for two years, does not affect your credit score, and is not insurance against losses (Cifas).

Prevention: what works

• Freeze your credit now. The FTC calls a freeze "always a good idea," and it costs nothing.
• Use strong, unique passwords and a password manager. Reused passwords are how one breach becomes many account takeovers.
• Turn on two-step sign-in. The FTC says it makes it harder for scammers to log in even with your username and password. The FBI recommends stronger methods than text messages, such as authenticator apps, physical security keys or biometrics, which also blunt SIM swapping.
• Protect your mobile account. Do not give carrier account details to anyone who calls you; ring your carrier's own number to check.
• Read statements and credit reports. Free weekly credit reports and your bank and card statements are where new accounts and unfamiliar charges show up first.
• Shred and secure documents. The FTC advises keeping Social Security and Medicare cards and financial records somewhere safe, shredding them before disposal, and collecting post promptly.
• Question requests for your Social Security number. The FTC notes that the IRS, your bank and your employer will not call, email or text to ask for it.
• Think before posting. USA.gov warns that scammers look through social media posts, photos and online quizzes for identifying information.

Identity theft protection services: an even-handed look

Paid services bundle several things, and the FTC describes each one plainly (FTC):

• Credit monitoring watches one, two or all three credit bureaus and alerts you to new accounts, credit checks, late-payment reports, changed personal details and similar events. It will not alert you when money is withdrawn from your bank account or when someone files a tax return with your number.
• Identity monitoring checks other databases: change-of-address requests, court or arrest records, new utility or wireless accounts, payday loan applications, social media, and "websites that identity thieves use to trade stolen information." Most will not catch someone claiming tax refunds or government benefits in your name.
• Identity recovery gives you case managers who help with letters, freezes and paperwork, and some will deal with creditors for you if you grant them authority.
• Identity theft insurance may cover out-of-pocket costs of reclaiming your identity, such as copying, postage, notarising, lost wages and legal fees. The FTC warns it "generally won't reimburse you for money scammers stole," and many policies will not pay if home or renters insurance already covers the loss.

What you can do yourself for free covers a lot of the same ground: credit freezes, fraud alerts, weekly credit reports, an IRS IP PIN, bank and card alerts, and IdentityTheft.gov's recovery plan. What a paid service adds is convenience, monitoring of sources you cannot easily check yourself, and a person to help if things go wrong. That can be worth paying for if you have been in several breaches, have a complicated financial life, or want help for older relatives.

To judge a service, ask the FTC's questions: which bureaus it monitors and how often, whether there are limits or fees for viewing your reports, what exactly the insurance covers and its deductible, and whether recovery help means a named case manager or a self-help library. Check how easy it is to cancel and what renewal costs. If you want to compare services on those points, our identity theft protection comparison sets out the main providers' features side by side.

The short version

Freeze your credit with all three bureaus, use unique passwords and two-step sign-in, read your statements, and know where to go if something happens: IdentityTheft.gov in the US, Report Fraud in most of the UK. Paid protection can help, but it is a convenience on top of those basics, not a replacement for them.