Identity Theft: How to Spot It and the Exact Steps to Recover

Discovering that someone has stolen your identity is one of those gut-punch moments that makes your stomach drop. Maybe a bill arrived for a credit card you never opened, or your tax return got rejected because someone already filed in your name. Whatever tipped you off, take a breath. This is fixable.

Identity theft feels enormous because it touches your money, your name, and your sense of safety all at once. But there is a clear, well-worn path to recovery, and thousands of people walk it successfully every year. This guide gives you the exact steps, in order, so you always know what to do next.

What identity theft actually is

Identity theft simply means someone is using your personal information — your name, Social Security number, card numbers, or login details — to pretend to be you, usually to get money or services. It is not one single crime. It is a category that takes many shapes.

Here are the forms it most commonly takes:

• Financial identity theft. Someone uses your existing cards or bank accounts, or opens brand-new accounts in your name.
• Tax identity theft. A thief files a fake tax return using your Social Security number to grab your refund before you do.
• Medical identity theft. Someone uses your identity to get medical care, prescriptions, or to file insurance claims.
• Child identity theft. A child's clean, unused Social Security number gets used to open accounts — often by a relative, and often undetected for years.
• Synthetic identity theft. A criminal blends real information (like your SSN) with fake details to create a whole new "person" that has access to credit.

The good news: no matter which type you are facing, the early steps are nearly identical. You lock things down first, then you work through a recovery playbook tailored to the specific problem.

The early warning signs

Identity theft is much easier to clean up when you catch it early, so it helps to know what the smoke looks like before the fire spreads. Most people notice one of these signals first.

• Unexpected bills or charges. A statement arrives for a card or loan you never applied for, or you spot small "test" charges on an account you do recognize.
• Denied credit out of nowhere. You get turned down for a loan or card despite good history, which can mean someone has trashed your credit or maxed out new accounts.
• Mail that stops or goes missing. Statements you normally receive suddenly disappear, which sometimes means a thief redirected your mail.
• Accounts you didn't open. You see unfamiliar accounts when you check your credit report, or you get a "welcome" email for a service you never signed up for.
• IRS or tax notices. The IRS contacts you about a return you didn't file, wages from an employer you never worked for, or a refund already claimed.
• Debt collectors calling about debts that aren't yours. This is a common and unsettling first clue.
• Medical surprises. An explanation-of-benefits statement lists treatments you never received, or you hit your insurance limit unexpectedly.

If you want a low-stress habit that catches problems early, check whether your email or passwords have turned up in known data breaches using a free tool like our breach check. A breach is often the opening act before identity theft.

The calm first steps when you suspect it

The single most important thing in the first hour is to slow down and act in the right order. Panic leads to skipped steps. Here is what to do, calmly, one at a time.

1. Write down what you noticed and when. Open a note or a fresh document and start a simple log: the date, what happened, and any reference numbers. You will thank yourself later.
2. Change passwords on your most important accounts first. Start with your email (because it controls password resets for everything else), then your bank and primary credit card logins. Use a unique password for each one.
3. Turn on two-factor authentication everywhere you can. This adds a second lock so a stolen password alone is not enough.
4. Contact the affected company directly. If a specific card or account was hit, call the number printed on the back of your card or the official website — never a number from a suspicious email or text.

If managing all these new passwords sounds overwhelming, a password manager like Bitwarden can generate and store a strong, unique password for every account so you never reuse one. For a deeper look at locking down your second layer of security, our guide on SMS, app, and hardware key two-factor authentication walks you through the options.

Place a fraud alert and freeze your credit

This is the step that stops the bleeding. A thief opening new accounts in your name needs access to your credit. Cut off that access and you cut off most of the damage.

Fraud alert

A fraud alert is a free flag on your credit file that tells lenders to take extra steps to verify it is really you before opening anything. You only have to contact one of the three major credit bureaus — Equifax, Experian, or TransUnion — and that bureau is required to notify the other two. An initial fraud alert lasts one year and is simple to set up online.

Credit freeze

A credit freeze is the stronger move. It locks your credit file entirely, so no one — not even you — can open new credit until you unfreeze it. It is free, it does not hurt your credit score, and you can lift it temporarily anytime you need to apply for something legitimate.

You must freeze with all three bureaus separately, because lenders may check any one of them. Our full walkthrough on how to freeze your credit covers the exact steps, the PINs to save, and how to thaw a freeze when you need to. If you take only one preventive action this year, make it this one.

Report to the FTC and file a police report

Reporting does two things: it creates an official record that helps you dispute fraudulent accounts, and it gives you legal rights that make creditors take you seriously.

Start at IdentityTheft.gov

The FTC runs a free, government website called IdentityTheft.gov that is genuinely well designed. You answer a few questions about what happened, and it generates a personalized recovery plan plus an official FTC Identity Theft Report. That report is the key document that lets you block fraudulent accounts and dispute charges. Save it and print a copy.

File a police report

For many situations — especially new accounts opened in your name, medical identity theft, or a stolen wallet — you will also want a local police report. Bring your FTC report, a government photo ID, proof of address, and any evidence of the fraud. Ask for a copy of the report and write down the report number. Some creditors require it before they will erase fraudulent debt.

Recovery playbooks for each type

Now that the broad protections are in place, here is what to do for the specific kind of theft you are dealing with. Find your situation and follow it step by step.

Stolen credit or debit card

There is an important difference here. With a credit card, federal law caps your liability at $50, and most issuers offer zero-liability policies, so reporting fraud quickly usually costs you nothing. With a debit card, the money leaves your actual checking account, and your protection depends heavily on how fast you report — which is why debit fraud is more urgent.

1. Call your bank or card issuer immediately using the number on the back of the card.
2. Report the fraudulent charges and ask them to close the compromised card and issue a new number.
3. Follow up in writing (email or the bank's secure message center) so you have a dated record.
4. Watch the next two statements closely for charges the thief made before the card was closed.

New accounts opened in your name

This is where your FTC Identity Theft Report earns its keep. For each fraudulent account:

1. Call the company's fraud department and tell them the account is fraudulent.
2. Send them your FTC report and ask them to close the account and remove it from your credit.
3. Ask each credit bureau to block the fraudulent information using your FTC report — this is a specific legal right.
4. Keep copies of every letter and note the name and date of everyone you speak with.

Tax-related identity theft

If your e-filed return is rejected as a duplicate, or the IRS notifies you of suspicious activity, respond to any IRS notice using the contact information on the notice itself. File IRS Form 14039, the Identity Theft Affidavit, which you can do through IdentityTheft.gov. Then request an IRS Identity Protection PIN — a six-digit number that only you know and that must accompany your future returns, making it far harder for a thief to file as you.

Medical identity theft

Request your medical records and a copy of your billing from each provider involved, and ask for a list of who has accessed your records. Dispute any charges or treatments that are not yours in writing with both the provider and your insurer. Ask your health plan for a corrected accounting, because errors in a medical file can affect future care decisions, not just your wallet.

Child identity theft

Children should have no credit file at all, so the simple check is to ask all three bureaus whether a credit report exists in your child's name. If one does, it almost always means fraud. Report it to the FTC, freeze the child's credit at each bureau (you can do this on behalf of a minor), and dispute the fraudulent accounts. Because child theft often goes unnoticed for years, it is worth checking before your child turns sixteen so it is resolved before they apply for a job, loan, or apartment.

A compromised Social Security number

Your SSN is the master key, so if it is exposed, lean hard on the protections above: freeze your credit at all three bureaus, set up an IRS Identity Protection PIN, and create a my Social Security account at the official SSA website so a thief cannot create one in your name. Contacting the Social Security Administration to replace the number itself is rare and only happens in extreme, ongoing cases — for almost everyone, freezing and monitoring is the right response.

Which documents and records to keep

Recovery is partly a paperwork project, and the people who recover fastest are the ones who stay organized. Keep one folder — physical, digital, or both.

• Your FTC Identity Theft Report and your personal recovery plan.
• Your police report and its report number.
• A running log of every call: date, company, the person's name, what they said, and any case number.
• Copies of every letter or email you send, and everything you receive.
• Copies of fraudulent statements, bills, and notices as evidence.

When you mail anything important, send it so you can confirm delivery, and never send your only copy of a document.

How to work with banks and creditors

Most banks and card companies have dedicated fraud departments that handle this every day, so you are not the first person to call with this problem. A few habits make these conversations go smoothly.

• Ask for the fraud department by name. The general customer service line cannot always do what you need.
• Get everything in writing. After a phone call, ask them to email a confirmation, or send your own follow-up summarizing what was agreed.
• Know your rights. With your FTC report, companies are legally required to give you copies of records related to the fraud and to stop reporting fraudulent debts.
• Be persistent but calm. If a representative cannot help, politely ask for a supervisor. You are not being difficult; you are protecting yourself.

Ongoing monitoring afterward

Once the immediate fires are out, shift into a lighter maintenance mode so a relapse cannot sneak up on you.

• Pull your free credit reports. You are entitled to free reports from all three bureaus at the official site AnnualCreditReport.com. Stagger them — one every four months — for year-round coverage at no cost.
• Keep your freeze on. Leave your credit frozen and only thaw it briefly when you need to apply for something.
• Set up account alerts. Most banks let you get a text for any transaction over a dollar amount you choose, which turns your phone into an early-warning system.
• Revisit your passwords. Make sure every important account has a unique password and two-factor authentication turned on.

If you are not sure where to focus, our Start Here page lays out the handful of habits that prevent the vast majority of repeat problems.

A word about the stress

It is worth saying plainly: identity theft does not just cost money, it costs sleep. Feeling violated, anxious, or angry is completely normal, and it does not mean you did anything wrong. Thieves target ordinary, careful people all the time, and being a victim is not a reflection of your judgment.

Be patient with yourself. You do not have to fix everything in one afternoon. Work the list one item at a time, lean on the free official resources built exactly for this, and let the structured process carry you. Each step you complete is a step the thief cannot undo.

Prevention going forward

Once you are through it, a few durable habits make a repeat far less likely — and most of them are one-time setups.

• Keep your credit frozen by default. This is the highest-value habit on the list.
• Use a password manager. Unique passwords mean one breached site cannot unlock the rest of your life. A tool like Bitwarden makes this effortless, and you can also use our password generator for one-off needs.
• Turn on two-factor authentication on email, banking, and anything tied to money.
• Shred sensitive mail and go paperless where you can to cut down on stolen documents.
• Be skeptical of unsolicited contact. Real banks and the IRS do not demand information or payment by surprise phone call, text, or email.
• Keep checking for breaches. Periodically run your email through our breach check so you know when to change a password before trouble starts.

If you want to build these habits step by step at your own pace, our free training turns all of this into a short, friendly checklist.

The quick version

• Identity theft is someone using your personal information to act as you — it comes in financial, tax, medical, child, and synthetic forms.
• Watch for unexpected bills, denied credit, missing mail, accounts you didn't open, IRS notices, and collectors for debts that aren't yours.
• First steps: stay calm, log everything, change your email and banking passwords, and turn on two-factor authentication.
• Lock it down: place a free fraud alert (one bureau notifies all three) and freeze your credit with all three.
• Report it at the FTC's IdentityTheft.gov to get your official Identity Theft Report, and file a local police report.
• Follow the playbook for your specific type — stolen card, new accounts, tax, medical, child, or a compromised SSN.
• Stay organized with one folder, work with fraud departments in writing, and monitor your credit afterward.
• Prevent a repeat by keeping your credit frozen, using a password manager, and enabling two-factor everywhere.
• Be kind to yourself — this is stressful, it is not your fault, and it is fixable one step at a time.