Identity theft occurs when someone uses another person's personal information without permission to commit fraud. This can involve a Social Security number, date of birth, address, or other personal details. New-account fraud — opening accounts in someone else's name — is one important form of identity theft, but it is not the only form. Identity theft can also involve misuse of existing accounts, tax fraud, medical fraud, or other types of fraud. Unlike credit card fraud, which typically involves a known, limited loss, identity theft can result in multiple fraudulent accounts, a damaged credit score, and a lengthy recovery effort.
The Difference Between Card Fraud and Identity Theft
Credit card fraud often involves unauthorized use of an existing card account. Identity theft can involve misuse of personal information to open new accounts or commit other forms of fraud. The distinction matters:
- •**Card fraud** is typically easier to resolve — your liability may be limited, and you can often get a new card. However, fraudulent charges are not always automatically reversed.
- •**Identity theft** can involve accounts you don't know exist, on credit reports you might not check for months, with creditors you've never dealt with. Recovery is often more complex.
How Identity Theft Happens
Data Breaches
Data breaches are one way personal information can be exposed. Your Social Security number, date of birth, and address can be sold alongside financial data in large breach datasets. The 2017 Equifax breach affected approximately 147 million people and exposed large amounts of sensitive personal information, including Social Security numbers, dates of birth and addresses. Not every affected consumer had every type of information exposed. Stolen information from a breach can be used to open fraudulent accounts, but it does not remain usable indefinitely.
Mail Theft
Your mail contains sensitive information — bank statements, pre-approved credit offers, tax documents, new card deliveries. Stolen mail can provide everything needed to impersonate you.
Social Engineering
Fraudsters may impersonate government agencies, banks, or other trusted organizations, claiming urgent problems that require personal information to resolve. Anyone can fall victim to sophisticated scripts.
Synthetic Identity Fraud
A growing category: synthetic identities can combine real information, such as a legitimate Social Security number, with fabricated information such as a false name, address, or date of birth to create entirely new identities. These synthetic identities are then used to open accounts and build fraudulent credit histories.
Warning Signs
- •Unexpected accounts on your credit report — Accounts you didn't open, with creditors you don't recognize
- •**Debt collection calls** for debts you don't owe
- •**Credit applications denied** unexpectedly, especially if your credit was previously good
- •**Tax return rejected** because someone already filed under your SSN
- •**Medical bills** for services you didn't receive
- •Missing mail — Bills or statements that stop arriving may indicate an address change was filed in your name
Detection: Monitor Your Credit Proactively
Consumers can currently access free credit reports online through AnnualCreditReport.com. A credit report shows your credit history and account information; it is not the same as a credit score. Checking your reports regularly can help you catch identity theft, though monitoring is not guaranteed to detect every case.
Some financial institutions and credit monitoring services offer alerts for certain changes to your credit file. Features vary by provider.
Prevention Strategies
Freeze your credit reports
A credit freeze is an important tool that can help protect against new-account identity theft. A credit freeze restricts prospective creditors' access to your credit file, making it harder for identity thieves to open new credit accounts in your name. A freeze is free to place and lift, and can be temporarily lifted online when you want to apply for credit.
A freeze does NOT prevent takeover or fraudulent use of existing accounts. To freeze all three nationwide credit files, consumers must contact Equifax, Experian, and TransUnion individually.
Use strong, unique passwords
Reused passwords mean one breach can compromise multiple accounts. Consider using a reputable password manager to generate and store strong, unique passwords for every account.
Enable multi-factor authentication
Two-factor authentication adds a second verification step — typically a code sent to your phone — before anyone can access your accounts. Enable it everywhere it's offered, especially on financial accounts and email.
Protect your Social Security number
Your Social Security number is sensitive personal information and should be protected. Give it out only when legally required (employment, tax filing, opening financial accounts). Medicare cards now use a different number — shred old Medicare cards that showed your full SSN.
Check your credit reports regularly
Review all three reports at least annually. Look for unfamiliar accounts, hard inquiries you didn't authorize, incorrect personal information (especially addresses), and accounts showing balances you shouldn't have.
What to Do If You're a Victim
Step 1: Place a fraud alert
Contact one of the three nationwide credit reporting companies and request an initial fraud alert. That company must notify the other two. A fraud alert requires lenders to take extra steps to verify identity before opening accounts in your name. An initial fraud alert lasts one year. Eligible identity-theft victims can request an extended fraud alert lasting seven years. A fraud alert does not prevent all new accounts from being opened, but it adds a verification step.
Step 2: Freeze your credit
After placing a fraud alert, also freeze your credit at all three bureaus. A credit freeze adds an important layer of protection against new accounts being opened using your identity.
Step 3: Report to the FTC
Go to IdentityTheft.gov and file a report. IdentityTheft.gov can provide an Identity Theft Report and a personalized recovery plan — documents you may need when disputing fraudulent accounts with creditors.
Step 4: Dispute and block fraudulent information
Contact each creditor where fraudulent accounts were opened. Send a dispute letter with a copy of your FTC Identity Theft Report. Identity-theft victims can request that fraudulent information be blocked from their credit reports by providing the required identity-theft documentation, proof of identity and identification of the fraudulent information, subject to applicable federal requirements. Credit reporting companies generally must block qualifying identity-theft information within four business days after receiving the required documentation. This four-business-day blocking process applies to identity-theft blocking requests and does not apply to every ordinary credit-report dispute. Not every fraudulent account is automatically removed, but the law provides a process for requesting removal or blocking.
Step 5: Consider filing a police report
A police report is not universally required. A victim may choose to file a local police report, and one may be useful or requested in some recovery situations, such as when a creditor or bureau asks for one. The FTC Identity Theft Report from IdentityTheft.gov is an important document in the federal identity-theft recovery process and is often the key document needed when disputing fraudulent accounts.
Step 6: Monitor ongoing
After resolving the immediate accounts, continue reviewing your credit reports and financial accounts regularly after identity theft, since additional suspicious activity may appear later.