Skip to main content
M
Protect

Identity Theft Prevention & Recovery

Identity theft can happen to anyone. Learn to recognize the warning signs, take steps to prevent it, and know exactly what to do if it happens to you.

What Is Identity Theft?

Identity theft occurs when someone uses your personal information — your name, national ID number (e.g. Social Security number in the US, National Insurance number in the UK), credit card details, or other identifying data — without your permission, typically for financial gain. It is one of the most common and damaging crimes in the digital age, and it can happen to anyone regardless of age, income, or technical knowledge.

The consequences of identity theft go far beyond financial loss. Victims often spend months or years untangling fraudulent accounts, correcting credit reports, and dealing with the emotional toll of having their identity misused. Understanding the different forms of identity theft, recognizing the warning signs, and having a prevention and response plan can save you enormous time, money, and stress.

Types of Identity Theft

Identity theft takes many forms, and criminals are constantly finding new approaches. Here are the most common types:

Financial Identity Theft

This is the most recognized form. A criminal uses your personal information to open new credit cards, take out loans, make purchases, or drain existing accounts. You may not discover it until you receive bills for accounts you never opened, see unfamiliar charges on your statements, or are denied credit because of debts you did not incur.

Tax Identity Theft

An attacker files a fraudulent tax return using your national ID or tax identification number, claiming a refund before you file your legitimate return. You typically discover this when your real tax return is rejected as a duplicate. Resolving tax identity theft requires working with your national tax authority (e.g. IRS in the US, HMRC in the UK, ATO in Australia) and can delay your legitimate refund for months.

Medical Identity Theft

Someone uses your identity to receive medical care, prescriptions, or to file insurance claims. This is particularly dangerous because it can corrupt your medical records with incorrect information — such as wrong blood types, allergies, or conditions — which could lead to harmful medical decisions in an emergency.

Criminal Identity Theft

If someone provides your identity when arrested or during a police encounter, you could end up with a criminal record you know nothing about. This can surface during background checks for employment, housing, or travel.

Child Identity Theft

Children's national ID numbers (such as Social Security numbers in the US) are particularly attractive to identity thieves because the theft often goes undetected for years — until the child applies for their first credit card, student loan, or job. By then, extensive damage may have been done to their credit history.

Synthetic Identity Theft

In this sophisticated approach, criminals combine real information (such as your national ID number) with fabricated details (a fake name and address) to create a new, synthetic identity. This can be harder to detect because it does not immediately show up under your name, but it still ties back to your personal information.

Warning Signs of Identity Theft

Early detection is critical. The sooner you catch identity theft, the less damage it can cause. Watch for these red flags:

  • Unfamiliar charges on your credit or debit card statements, even small ones. Thieves often test stolen card numbers with small purchases before making large ones.
  • Bills or collection notices for accounts you did not open or debts you do not owe.
  • Unexpected credit score changes, especially sudden drops you cannot explain.
  • Mail you expected stops arriving, which could indicate that someone has changed your address to redirect your mail.
  • Denied credit applications despite having a healthy financial history.
  • Tax return rejections because a return has already been filed with your information.
  • Unfamiliar accounts appearing on your credit reports.
  • Health insurance claims for services you did not receive, or medical records that contain incorrect information.
  • Calls from debt collectors about debts that are not yours.
  • Data breach notifications from companies that have your personal information.

Prevention Checklist

While no strategy can guarantee you will never be a victim, these practices dramatically reduce your risk:

Secure Your Information

  • Use strong, unique passwords for every account and enable multi-factor authentication (see our password security and MFA guides).
  • Store sensitive documents — national ID cards, passports, financial statements — in a secure location, not in your wallet or an easily accessible drawer.
  • Shred physical documents that contain personal information before discarding them.
  • Never share personal information in response to unsolicited requests, whether by phone, email, or text message.

Monitor Your Accounts

  • Review your bank and credit card statements regularly, looking for any unfamiliar transactions.
  • Check your credit reports from your country's credit reporting agencies. In many countries you are entitled to free reports, and reviewing them helps you spot accounts or inquiries you do not recognize.
  • Set up account alerts for transactions above a certain amount, new account openings, and changes to your profile information.

Limit Your Exposure

  • Be cautious about what you share on social media. Information like your birthday, mother's maiden name, hometown, and pet names are commonly used security questions.
  • Opt out of pre-approved credit offers, which can be stolen from your mailbox.
  • Use a locked mailbox if possible, and do not leave outgoing mail with personal information in an unsecured mailbox.
  • Be wary of public Wi-Fi for any activity that involves sensitive information. If you must use public Wi-Fi, use a virtual private network (VPN) to encrypt your connection.

Protect Your Devices

  • Keep your operating system, apps, and browser up to date to patch known security vulnerabilities.
  • Use a lock screen with a strong passcode, fingerprint, or face recognition on all your devices.
  • Enable remote wipe capabilities on your phone and laptop so you can erase data if your device is lost or stolen.

If You Are a Victim: Step-by-Step Recovery

Discovering that your identity has been stolen is alarming, but acting quickly and methodically can limit the damage. Follow these steps in order:

Step 1: Document Everything

Start a log immediately. Record dates, times, names of people you speak with, reference numbers, and copies of all correspondence. This documentation will be invaluable as you work through the recovery process and may be needed if you pursue legal action.

Step 2: Place Fraud Alerts

Contact your country's credit reporting agencies to place a fraud alert. In the US, contact one of the three major bureaus (Equifax, Experian, or TransUnion) — that bureau is required to notify the other two. In the UK, contact Experian, Equifax, or TransUnion UK. Other countries have their own agencies — check with your national consumer protection authority. A fraud alert tells creditors to take extra steps to verify your identity before opening new accounts in your name.

Step 3: Review Your Credit Reports

Request your credit reports from all relevant agencies in your country and review them carefully. Look for accounts you did not open, inquiries you did not authorize, addresses where you have never lived, and any other unfamiliar information. Note every discrepancy — you will need this information for your disputes.

Step 4: Report to Your National Authority

File an identity theft report with the appropriate authority. In the US, file with the FTC at IdentityTheft.gov. In the UK, report to Action Fraud. In Canada, contact the Canadian Anti-Fraud Centre. In Australia, report to ReportCyber. This creates an official record of the theft and may generate a recovery plan tailored to your situation. The report is also essential when disputing fraudulent accounts with creditors and credit agencies.

Step 5: File a Police Report

Contact your local police to file a report. Bring your official identity theft report, a government-issued ID, proof of your address, and any evidence of the theft (fraudulent bills, collection notices, credit report entries). Some creditors and agencies require a police report before they will remove fraudulent accounts.

Step 6: Contact Affected Companies

Reach out to every company where fraud occurred. This includes banks, credit card issuers, utilities, and any other organizations where accounts were opened or existing accounts were compromised. Ask to speak with their fraud department. Request that fraudulent accounts be closed and that you receive written confirmation of the closure and a statement that you are not responsible for the charges.

Step 7: Dispute Fraudulent Information on Credit Reports

File disputes with each credit reporting agency for every piece of fraudulent information on your reports. Include copies (not originals) of your supporting documentation: your official identity theft report, police report, and any correspondence with the affected companies. The agencies are required to investigate and respond, typically within 30 days.

Step 8: Consider a Credit Freeze

A credit freeze restricts access to your credit report, preventing new accounts from being opened in your name. Unlike a fraud alert, which is advisory, a credit freeze is a hard block. You will need to temporarily lift the freeze when you want to apply for credit yourself, which can be done quickly through the bureau's website or phone line.

Credit Monitoring

Credit monitoring services watch your credit reports for changes and alert you to new accounts, inquiries, or significant changes in your credit score. While credit monitoring cannot prevent identity theft, it helps you detect it quickly, which limits the damage.

Many banks and credit card companies offer free credit monitoring to their customers. The major credit bureaus also offer monitoring services, and some are free. If you have been the victim of a data breach, the affected company may offer free credit monitoring for a period of time — take advantage of it.

Fraud Alerts and Credit Freezes Explained

These two tools are often confused, but they serve different purposes:

Fraud Alerts

  • A note on your credit file that asks creditors to verify your identity before extending credit.
  • Free to place and renew.
  • You only need to contact one credit bureau; they will notify the others.
  • Does not prevent creditors from accessing your report.
  • Good as an initial response or if you suspect your information may have been compromised but have not yet confirmed theft.

Credit Freezes

  • A hard lock on your credit report that prevents anyone from accessing it to open new accounts.
  • Free to place, lift, and remove.
  • Must be placed with each credit bureau individually.
  • Must be temporarily lifted when you want to apply for credit, rent an apartment, or undergo a background check that involves a credit pull.
  • Provides stronger protection than a fraud alert.
  • Does not affect your credit score.

For maximum protection, many security experts recommend placing a credit freeze proactively, even if you have not been a victim of identity theft. You can lift it temporarily whenever you need to, and it prevents unauthorized accounts from being opened in your name.

Long-Term Recovery and Ongoing Vigilance

Recovering from identity theft is rarely a quick process. Even after the immediate steps are completed, you should remain vigilant:

  • Continue monitoring your credit for at least a year after the theft. Criminals sometimes wait months before using stolen information.
  • Keep your documentation organized and accessible. You may need it again if new fraudulent activity surfaces or if a previously resolved issue reappears.
  • Update your security practices. Change passwords for all your accounts, enable MFA everywhere possible, and review your privacy settings.
  • Watch for tax fraud. If your national ID or tax number was compromised, file your tax return as early as possible each year to prevent someone from filing fraudulently with your information.
  • Check for medical identity theft. Request your medical records and insurance statements to ensure no one has received care under your name.
  • Be aware of follow-up scams. After a breach, scammers sometimes pose as your bank, the government, or a recovery service, claiming they can help fix the problem. Legitimate organizations will never ask you for sensitive information through unsolicited contact.

Protecting Children from Identity Theft

Children are especially vulnerable to identity theft because their credit files are blank slates, and the theft can go undetected for years. Here are steps to protect minors:

  • Check if your child has a credit report. Children should not have one. If a credit report exists for your child, it may indicate their information has been misused.
  • Freeze your child's credit. In countries with credit reporting systems, you can place a credit freeze for minors with each agency, which prevents anyone from opening accounts using your child's information.
  • Guard their national ID number. Be cautious about who you share your child's national ID number (e.g. Social Security number in the US) with. Ask why it is needed and how it will be stored.
  • Review when they turn 16. Before your child starts driving, working, or applying for college, check their credit reports to ensure everything is clean.

Next Steps

With identity theft prevention and recovery plans in place, the final piece of a comprehensive protection strategy is digital estate planning. Organizing your digital assets and accounts ensures that your loved ones can access what they need and that your digital life is handled according to your wishes.

Content last reviewed: February 2026