Identity theft is when someone uses your personal information — a Social Security number, credit card, or even just your name and birth date — without permission to commit fraud, typically to open credit, drain accounts, or receive services in your name. It comes in more forms than most people expect, and recognizing which type you’re dealing with is the first step in the right recovery process.
The 4 Main Types of Identity Theft
| Type | What happens | How you usually find out |
|---|---|---|
| Financial | New credit cards, loans, or bank accounts opened in your name | Unfamiliar accounts on a credit report or collection notices |
| Medical | Someone uses your insurance information to receive care or prescriptions | A bill or insurance statement for care you never received |
| Synthetic | Your real SSN gets combined with a fake name/details to build a new credit identity | Often not discovered until a lender check flags a mismatch, sometimes years later |
| Child identity theft | A minor’s SSN is used to open credit, since children have no credit history to check against | Usually discovered years later, e.g. when a teenager applies for their first credit card |
How Identity Theft Happens
- Data breaches at companies that store your information, entirely outside your control.
- Phishing — emails or texts designed to trick you into entering credentials on a fake site.
- Data broker exposure — see our Data Brokers guide for how aggregated public information becomes a tool for impersonation.
- Mail theft — pre-approved credit offers and financial statements pulled from an unlocked mailbox.
- Public WiFi interception on unsecured networks.
- Lost or stolen devices that aren’t protected by a lock screen or encryption.
- Social engineering — a scammer calling and simply talking someone into revealing information.
- Skimming devices on ATMs or gas station card readers.
Warning Signs Your Identity Has Been Stolen
- Accounts or credit inquiries you don’t recognize on your credit report.
- Bills or collection notices for accounts you never opened.
- Your tax return gets rejected because one was already filed under your SSN.
- A medical bill or insurance statement for care you never received.
- Unexpected declined transactions on cards you know are current.
- Notices from the IRS about income you didn’t earn.
- You stop receiving expected mail (a sign of a fraudulent change-of-address filing).
For a deeper, sign-by-sign breakdown with exactly what to do for each one, see 11 Warning Signs Your Identity Has Been Stolen.
How to Report Identity Theft
Start at IdentityTheft.gov, the FTC’s dedicated reporting site. It walks you through a personalized recovery plan based on exactly what type of theft you’re dealing with, and generates an FTC Identity Theft Report you can use with banks, credit bureaus, and debt collectors as official documentation. From there: contact the fraud department of any affected financial institution directly, and file a police report if the FTC site recommends one for your specific situation (usually when the identity thief is known, or a report is required by a specific creditor).
Recovery Steps
- File a report at IdentityTheft.gov and get your personalized recovery plan.
- Place a fraud alert or credit freeze with all three credit bureaus (Equifax, Experian, TransUnion) — see our step-by-step credit freeze guide for the full process, including contact info for each bureau.
- Contact the fraud department of every affected financial institution directly.
- Dispute fraudulent accounts and charges in writing, keeping copies of everything.
- Change passwords on affected accounts, and enable two-factor authentication while you’re there.
- Monitor your credit reports for several months — new fraudulent activity sometimes surfaces after the initial cleanup.
Common Mistakes People Make During Recovery
- Only fixing the account you noticed and not checking for others. Identity thieves who got one piece of information often use it in multiple places.
- Not keeping a written log of every call and letter. Recovery often takes multiple attempts with the same institution — dates and reference numbers matter.
- Assuming a credit freeze fixes everything. A freeze stops new credit from being opened; it doesn’t undo damage to existing accounts.
- Giving up after the first round of disputes. Some fraudulent items require a second or third dispute with additional documentation before they’re removed.
How Long Does Recovery Take?
Simple cases — a single fraudulent charge caught quickly — can resolve in days. Financial identity theft involving multiple accounts commonly takes weeks to a few months. Synthetic and child identity theft, precisely because they go undiscovered longest, can take considerably longer to fully untangle since the fraudulent credit history may be years deep by the time it’s found. There’s no single honest answer beyond “it depends on how early it’s caught and how many accounts are involved” — anyone promising a guaranteed timeline isn’t being straight with you.
Frequently Asked Questions
What should I do first if I suspect identity theft?
Go to IdentityTheft.gov and file a report — it generates a personalized recovery plan and an official FTC report you’ll need for the steps that follow, so it’s the right starting point before calling individual institutions.
Will a credit freeze stop identity theft that’s already happened?
No. A credit freeze prevents new credit accounts from being opened in your name going forward; it doesn’t reverse or fix accounts already opened fraudulently, which need to be disputed separately.
Do I need to file a police report?
Not always. IdentityTheft.gov will tell you whether your specific situation calls for one — typically when the thief is known to you or a specific creditor requires it as part of their dispute process.
Can identity theft affect my taxes?
Yes — a common sign is your tax return being rejected because a fraudulent return was already filed using your SSN. The IRS has a dedicated identity-theft process separate from the FTC’s for this specific situation.
How do I know if my child is a victim of identity theft?
Since children have no credit history, theft usually isn’t discovered until they apply for their first credit product, sometimes as a teenager. If you suspect it earlier, you can request a credit report check for a minor through each credit bureau’s specific process.
Is synthetic identity theft the same as regular identity theft?
Related but distinct — regular identity theft uses your full real identity, while synthetic identity theft blends your real SSN with fabricated personal details to build an entirely new credit profile, which is part of why it goes undetected longer.
Will I be responsible for fraudulent charges?
Federal protections generally limit consumer liability for fraudulent credit card charges reported promptly, and debit card protections exist too though with different timing requirements — report suspected fraud immediately regardless of card type to preserve those protections.
How can I reduce my risk of identity theft going forward?
The same foundational steps covered in our What Is Digital Privacy? guide — reducing data broker exposure, enabling two-factor authentication, and monitoring your accounts regularly (or letting a paid identity protection service do it for you) — meaningfully lower risk, even though no single step eliminates it entirely.
Recommended Next Reading
- 11 Warning Signs Your Identity Has Been Stolen — the deeper, sign-by-sign version of this guide’s warning-signs section.
- How to Opt Out of Data Brokers — verified, step-by-step opt-out instructions for the sites most likely to have your data.
- How to Remove Your Personal Information from the Internet — the practical next step once you understand why your data is exposed.
- What Are Data Brokers? — one of the most common sources of the exposure that leads to theft.
- What Is Digital Privacy? — foundational prevention steps that reduce your risk going forward.
- Identity Protection — the full category hub for this topic.