Identity Theft Protection Tips: Freeze, Monitor, Recover

Last reviewed: September 2026. Some rules described here — such as fraud alert durations and credit-reporting rights — are set by federal law and change infrequently. Where a detail could shift (like specific enrollment steps), this guide points to the official source to confirm current information.

What Is Identity Theft?

Identity theft is the unauthorized use of another person's personal identifying information — such as a Social Security number, date of birth, financial account numbers, or medical insurance details — typically to obtain money, credit, medical services, tax refunds, employment, or other benefits in that person's name.

It's different from a one-time scam. A scam usually ends when the interaction ends. Identity theft specifically involves someone else misusing your identity, and its effects can surface months or even years after your information was first exposed — long after you've forgotten about the data breach notice that started it.

A few things are true about identity theft that are worth knowing before anything else:

• It's often outside your control. Many cases begin with a data breach at a company, hospital, or government agency you had no way to prevent. Identity theft is not solely, or even primarily, a matter of personal carelessness.

• Nothing makes you "identity-theft-proof." No product, habit, or paid service eliminates the risk entirely. Protection is about reducing your exposure and being able to detect and respond quickly — not achieving zero risk.

• It takes several distinct forms. Financial, medical, tax-related, criminal, synthetic, and child identity theft each surface differently and require different recovery steps.

• Some forms hide for years. Child identity theft and synthetic identity theft, in particular, often produce none of the usual warning signs — like a declined credit card — because they don't touch your existing accounts.

• Strong free protections already exist. A credit freeze, for example, is free for every U.S. consumer under federal law and is, for the specific purpose of blocking new-account fraud, often as effective as a paid monitoring service.

• Recovery is possible but takes effort. Free federal resources can guide you through it, though the time and steps involved vary depending on the type of identity theft and how quickly it was caught.

Identity Theft at a Glance

• Reported to the Federal Trade Commission's Consumer Sentinel Network: 6.5 million total fraud and identity theft reports in 2024, with $12.5 billion in reported losses — a 25% increase in losses over the prior year (FTC Consumer Sentinel Network Data Book, 2024).

• A credit freeze is free at all three nationwide credit bureaus, by federal law, and does not expire until you remove it.

• Everyone is entitled to a free credit report from each of the three nationwide bureaus every week through AnnualCreditReport.com — a pandemic-era program the bureaus made permanent in 2023.

• An initial fraud alert lasts one year; an extended fraud alert, available to confirmed identity theft victims, lasts seven years.

• IdentityTheft.gov, run by the FTC, is the free federal starting point for reporting identity theft and building a personalized recovery plan.

Identity Theft vs. Financial Scams: How They Relate

A scam is a deceptive interaction that tricks you into acting — sending money or handing over information. Identity theft is the unauthorized use of your personal or financial identity, which can happen through a scam or entirely independent of one.

These two things overlap but aren't the same. A phishing email that tricks you into typing your Social Security number is a scam that leads to identity theft. A retailer's database getting breached while you're asleep, with no interaction from you at all, is identity theft without a scam.

This guide focuses specifically on preventing, detecting, and recovering from identity theft. If you're dealing with an active scam attempt right now — a suspicious call, text, or email trying to get you to act immediately — the FTC's general scam-recognition resources at consumer.ftc.gov can help with that specific situation. The rest of this guide stays focused on protecting your identity.

Types of Identity Theft

Identity theft isn't one thing. Each type below misuses a different piece of your identity, surfaces differently, and calls for a different first step.

Financial (account) identity theft is the unauthorized use of your identity to open new credit accounts or make charges on existing ones. It typically surfaces through unfamiliar accounts on a credit report, unexpected charges on a statement, or a sudden credit score drop.

Tax-related identity theft happens when someone files a fraudulent tax return using your Social Security number, usually to claim a refund. It's often discovered when your legitimate e-filed return gets rejected because a return has already been filed under your number.

Medical identity theft is the unauthorized use of your identity to obtain medical care, prescriptions, or insurance benefits. Beyond financial harm, it can corrupt your medical records with someone else's health information, which can affect future treatment. It's often discovered through an unfamiliar charge or a benefits statement listing care you never received.

Criminal identity theft occurs when someone uses your identity during an interaction with law enforcement — for example, giving your name during an arrest. This can create a fraudulent criminal record under your name, sometimes only discovered during a background check or traffic stop.

Synthetic identity theft blends real information — often a Social Security number, sometimes a child's or an otherwise unused number — with fabricated details to build a new, fictitious identity used to open fraudulent accounts. Because the identity doesn't map cleanly to a single real person's existing credit file, this type can go undetected for a long time.

Child identity theft is the use of a minor's Social Security number to open fraudulent accounts or claim benefits. It's especially hard to catch because children typically have no credit history, so there's no existing account to notice fraud on. It's frequently discovered only when the child applies for a loan, credit card, or apartment as a young adult.

Types of Identity Theft at a Glance

How Identity Theft Typically Happens

Understanding how identity theft happens helps you recognize risk — this section stays at a conceptual level so it can't double as instructions for committing it.

Most cases trace back to one of these general patterns:

• Data breaches. A company, hospital, school, or government agency holding your information is hacked or mishandles data, exposing records that may include names, Social Security numbers, or account details.

• Phishing, smishing, and vishing. Deceptive emails, texts, or phone calls trick people into revealing personal information or login credentials.

• Mail theft. Physical mail — bank statements, pre-approved credit offers, tax documents — is stolen from a mailbox before it reaches you.

• Card skimming. Devices placed on ATMs, gas pumps, or payment terminals capture card information during an otherwise normal transaction.

• Document theft. Discarded statements, medical bills, or tax paperwork are retrieved from the trash rather than shredded.

• Lost or stolen devices. A phone or laptop with saved passwords or personal files ends up in the wrong hands.

• Unsecured public Wi-Fi. Sensitive information sent over an unprotected public network can potentially be intercepted.

• Misuse by someone with legitimate access. Less commonly, someone within a household, workplace, or care facility misuses information they were authorized to see for another purpose.

No single cause explains most cases, and many victims never learn exactly how their information was exposed. That's part of why ongoing monitoring — not just avoiding one particular risk — matters.

Warning Signs of Identity Theft

Common warning signs include unfamiliar accounts or credit inquiries, bills for accounts you never opened, a tax return rejected as a duplicate, and unexpected charges on financial or medical statements.

Specific signs to watch for:

• Accounts or hard inquiries on your credit report that you don't recognize

• Bills or collection notices for accounts you never opened

• A legitimate e-filed tax return rejected because one was already filed under your Social Security number

• Being denied credit unexpectedly, with no clear reason

• Unfamiliar charges on a bank or credit card statement

• Medical bills or insurance statements for care you never received

• A sudden, unexplained drop in your credit score

• Mail related to accounts you never opened, or mail that stops arriving as expected

It's worth repeating: synthetic and child identity theft frequently produce none of these signs for years, since they usually don't touch your existing accounts or credit file at all. That's a reason to check proactively (see the sections on monitoring and protecting children's identities) rather than wait for a warning sign that may never come in those specific cases.

Core Protective Habits

No single habit prevents identity theft, but a combination of ongoing practices meaningfully reduces your exposure and helps you catch problems faster.

• Use a strong, unique password for every account, ideally managed with a password manager rather than memorized or reused.

• Turn on two-factor or multi-factor authentication wherever it's offered, especially for email, banking, and financial accounts.

• Review statements regularly, not just once a year — a five-minute monthly check catches problems faster than an annual one.

• Set up transaction alerts with your bank and card issuers so unusual activity reaches you immediately.

• Be selective about your Social Security number. Ask why it's needed and whether an alternative identifier will work before handing it over.

• Secure your physical mail with a locking mailbox, prompt retrieval, and USPS Informed Delivery, which lets you preview what's arriving each day.

• Shred documents containing account numbers, Social Security numbers, or other sensitive data before throwing them away.

• Limit what you share publicly on social media — birthdates, hometowns, and pet names are commonly used as security-verification answers.

• Keep software and devices updated so known security flaws get patched.

• Be cautious on public Wi-Fi for anything involving passwords or financial accounts; use a trusted VPN or your phone's cellular connection instead.

Protecting Your Social Security Number

Your Social Security number is one of the most sensitive pieces of identifying information you have, because it's tied to your credit file, tax records, and government benefits — protect it by limiting who gets it and monitoring for misuse, since it generally can't be replaced.

Practical steps:

• Share your SSN only when it's genuinely required — for tax forms, employment, and certain financial or government applications. If a business asks for it for something like a store loyalty program or a simple retail purchase, ask whether an alternative identifier will work.

• Don't carry your Social Security card in your wallet day to day. Keep it in a secure place at home.

• Use the Social Security Administration's online my Social Security account tools to monitor for unauthorized use of your number in earnings records.

• Understand the limits: once your SSN has been exposed, it generally can't be treated as fully secret again, and the SSA changes Social Security numbers only in narrow, documented circumstances. Protective effort shifts toward monitoring how the number is used going forward rather than assuming it can be re-secured.

Credit Freezes and Fraud Alerts Explained

A credit freeze restricts access to your credit report so new accounts generally can't be opened in your name; a fraud alert doesn't block access but requires lenders to verify your identity first; a credit lock looks similar but is a separate, bureau-run product rather than a federal legal right. All three are worth understanding, because they're often confused with each other.

Credit freeze (security freeze)

A credit freeze is free for every consumer, at every nationwide credit bureau, under federal law (the Fair Credit Reporting Act, as amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018). Placing, lifting, and removing a freeze all cost nothing, and a freeze doesn't affect your credit score.

Key mechanics:

• You must freeze your file separately at all three nationwide bureaus — Equifax, Experian, and TransUnion — since a freeze at one doesn't carry over to the others.

• Bureaus must place a freeze within one business day of an online or phone request, or three business days for a mailed request.

• When you need to apply for credit, you can temporarily lift the freeze — bureaus must process an online or phone request to lift it within about an hour.

• A freeze restricts new creditors from viewing your file; it doesn't affect your existing accounts, employer screening you've authorized, or your own credit checks.

• A freeze is a strong tool against new-account fraud specifically. It does not prevent misuse of existing accounts, tax-related identity theft, medical identity theft, or criminal identity theft, since those don't require a new-credit application.

Fraud alert

A fraud alert doesn't block access to your credit report — it flags your file so a lender must take extra steps to verify your identity before extending new credit.

• An initial fraud alert is free, available to anyone, requires no proof of fraud, and lasts one year.

• An extended fraud alert is available to confirmed identity theft victims who provide an FTC Identity Theft Report or police report, and lasts seven years.

• An active duty alert is available to deployed military members and lasts one year, renewable for the length of deployment.

• Placing a fraud alert at any one bureau requires that bureau to notify the other two, so you generally only need to contact one.

Credit lock

A credit lock performs a similar function to a freeze — blocking new access to your file — but it's a commercial product offered directly by a credit bureau, governed by that bureau's own terms of service rather than the federal freeze framework. Locks are sometimes free and sometimes bundled into paid monitoring subscriptions, and a bureau can change lock terms on its own. The practical effect can feel similar to a freeze, but the legal guarantees behind a freeze — including bureaus' hard deadlines to place and lift it — don't automatically apply to a lock.

Credit Freeze vs. Fraud Alert vs. Credit Lock

Monitoring Your Credit and Accounts

Every consumer is entitled to a free credit report from each of the three nationwide credit bureaus every week through AnnualCreditReport.com — a program that started as a pandemic measure and became permanent in September 2023.

A few practical points:

• Check all three reports, not just one. Equifax, Experian, and TransUnion don't always have identical information, so a problem might show on one report and not another.

• A credit report is different from a credit score. The free reports from AnnualCreditReport.com show your account history and inquiries, not necessarily a score.

• Because access frequency has changed over time (from annual to weekly), confirm current availability at AnnualCreditReport.com if you're reading this well after publication.

• Reviewing bank and credit card statements regularly complements credit report checks — credit reports won't show everyday charges on an existing account, only new accounts and inquiries.

Dark Web Monitoring: What It Is and Its Limits

Dark web monitoring services scan known marketplaces and forums where stolen data is bought and sold, and alert you if your information turns up — but they can't scan the entire dark web, and not finding your data doesn't mean you're safe.

These services search a defined set of sources — leaked-data dumps, known criminal forums, and similar sites — for your email address, Social Security number, or account credentials. That's genuinely useful information when it surfaces. But it comes with real limits:

• No service can monitor the entire dark web; coverage is limited to the sources each provider tracks.

• It can't detect information that hasn't yet appeared in a monitored source, even if it has already been stolen.

• A "clean" result doesn't guarantee your information hasn't been compromised elsewhere — it means nothing was found in the sources checked, at the time checked.

• Finding your data is a signal to take protective action (like a credit freeze), not proof that identity theft has already occurred or will occur.

Protecting Children's Identities

Child identity theft is especially hard to detect because children typically have no credit history, so there's no existing account for fraud to show up on — a credit file existing for a minor at all is itself a red flag.

Because kids don't apply for credit, the first sign of child identity theft is often years away — sometimes not until the child applies for their first credit card, car loan, or apartment as a young adult, only to discover years of fraudulent activity already on file.

Protective steps:

• Be selective about sharing your child's Social Security number. Schools, sports leagues, and other organizations sometimes request it when it isn't strictly necessary — ask why it's needed and whether an alternative will work.

• Check whether a credit file exists in your child's name through the credit bureaus' minor credit-file request process. Since children generally shouldn't have a credit file at all, finding one is a warning sign worth acting on immediately.

• If a fraudulent file is found, each nationwide bureau has a specific process for minors that can freeze or remove it — start with IdentityTheft.gov for current guidance on the process.

Medical Identity Theft: Specific Protective Steps

Medical identity theft — the unauthorized use of your identity to obtain medical care or insurance benefits — is often caught by reviewing your insurance statements and medical records for entries you don't recognize.

Specific steps:

• Review every Explanation of Benefits (EOB) statement your insurer sends, checking for services, providers, or dates you don't recognize.

• Periodically request a copy of your medical records from your providers and check for unfamiliar diagnoses, treatments, or visits.

• Report suspected medical identity theft promptly to both your insurer and the healthcare provider involved — incorrect medical records can affect your future care, not just your finances, so correcting them matters beyond the billing dispute itself.

Tax Identity Theft and the IRS Identity Protection PIN

Tax-related identity theft happens when someone files a fraudulent tax return using your Social Security number, typically to claim a refund before you file your real one — the IRS's Identity Protection PIN (IP PIN) program helps prevent this.

An IP PIN is a six-digit number known only to you and the IRS. When it's on file, a return filed under your Social Security number without the correct current IP PIN will generally be rejected or flagged, which helps stop a fraudulent return from processing.

A few general facts about the program, current as of this writing:

• Any individual with a Social Security number or Individual Taxpayer Identification Number who can verify their identity can voluntarily opt in — not just confirmed identity theft victims.

• Parents and legal guardians can request an IP PIN for dependents, including children, through applicable enrollment options.

• An IP PIN is valid for one calendar year; you'll need a new one each filing season if you stay enrolled.

• The program covers federal tax return fraud specifically — it doesn't protect credit cards, bank accounts, or your credit report.

Enrollment details and options change periodically, so confirm current steps directly at IRS.gov before enrolling.

Protecting Devices and Networks

Good device and network hygiene — updated software, strong Wi-Fi passwords, and caution on public networks — closes off some of the easiest paths identity thieves use to access personal information.

• Keep operating systems, browsers, and apps updated so known vulnerabilities get patched.

• Use reputable security software on computers and mobile devices.

• Set a strong, unique password on your home Wi-Fi router, and change any default administrator password.

• Avoid entering passwords or financial information over public Wi-Fi; use a trusted VPN or your phone's cellular data for anything sensitive.

• Be cautious about plugging devices into unfamiliar public charging ports (sometimes called "juice jacking"); a portable battery pack avoids the issue entirely.

Is Paid Identity Theft Protection Worth It?

Paid identity theft protection services can add convenience and recovery support, but no paid service prevents identity theft outright — the free federal alternatives already cover much of what these services offer, so the value depends on how much you weigh convenience against cost.

What paid services typically offer:

• Monitoring across a broader range of data sources than free tools, sometimes including dark web scans, public records, and additional bureaus

• Identity-restoration case management — a dedicated point of contact to help with paperwork and disputes if something goes wrong

• Insurance that may reimburse certain out-of-pocket recovery costs, subject to policy terms and limits

What's already free:

• Credit freezes at all three nationwide bureaus

• Weekly credit reports from all three bureaus through AnnualCreditReport.com

• The IRS Identity Protection PIN program

• Federal recovery guidance and a personalized recovery plan through IdentityTheft.gov

No paid service — regardless of what its marketing implies — can guarantee that identity theft won't happen to you. The realistic value of a paid service is in monitoring convenience and hands-on recovery assistance, not prevention. Whether that convenience is worth the subscription cost is a personal decision based on your own time, risk tolerance, and budget — not something with a universal right answer.

What to Do If Your Identity Is Stolen

Start at IdentityTheft.gov, the FTC's free federal recovery site, then contact affected institutions directly and place a credit freeze if you haven't already.

1. Go to IdentityTheft.gov. The FTC's site generates a personalized recovery plan and, where applicable, an official Identity Theft Report you can use with creditors, bureaus, and law enforcement.

2. Place a fraud alert or credit freeze with the credit bureaus if you haven't already.

3. Contact the fraud department of any financial institution where you've spotted unauthorized activity.

4. Pull all three credit reports and review them for any other unfamiliar activity beyond what you already found.

5. Dispute fraudulent accounts or charges directly with both the institution involved and the credit bureaus.

6. File a police report if needed — some institutions or forms of extended fraud protection require one.

7. For tax-related identity theft, follow the IRS's identity theft procedures, which may include filing Form 14039.

8. For medical identity theft, contact your insurer and the healthcare provider directly.

9. Keep monitoring your accounts and credit reports for a period after things seem resolved — related fraudulent activity can keep surfacing for months.

Recovery timelines vary widely depending on the type of identity theft, how quickly it was caught, and how many institutions are involved — there's no universal timeframe, and no institution can guarantee full reimbursement of every loss.

Where to Report and Get Help

Common Mistakes

1. Assuming a paid monitoring service prevents identity theft, rather than helping detect and respond to it after the fact.

2. Checking only one of the three credit reports instead of all three.

3. Freezing credit at only one or two bureaus instead of all three.

4. Confusing a credit lock with a credit freeze and assuming they carry the same legal guarantees.

5. Assuming children can't be identity theft victims and never checking for a minor credit file.

6. Ignoring medical Explanation of Benefits statements because they look routine.

7. Reusing the same password across multiple financial accounts.

8. Not enabling two-factor authentication when it's available for free.

9. Discarding sensitive documents in the trash without shredding them.

10. Assuming a declined credit application always reflects a personal credit problem, rather than checking for fraud first.

11. Delaying action after noticing a warning sign, hoping it resolves on its own.

12. Not checking whether an extended fraud alert applies after a confirmed identity theft.

13. Assuming dark web monitoring covers all possible exposure.

14. Not reviewing mail regularly, especially in the weeks after a move.

15. Oversharing personal details on social media — birthdates, mother's maiden name, pet names — that are commonly used as security-verification answers.

Common Misconceptions

Myth: Identity theft only happens to careless people. Reality: Many cases start with a company data breach or another event entirely outside the victim's control. Takeaway: Being targeted isn't a reflection of anything you did wrong.

Myth: A strong password alone is enough to prevent identity theft. Reality: Passwords protect one login; identity theft can start with a data breach, mail theft, or a source that has nothing to do with your passwords. Takeaway: Combine strong passwords with other habits — freezes, monitoring, careful information-sharing.

Myth: Children can't be identity theft victims. Reality: A child's Social Security number can be used to open fraudulent accounts, often undiscovered for years since kids have no credit history to check. Takeaway: Check for a minor credit file even if nothing seems wrong.

Myth: A credit freeze costs money. Reality: Credit freezes are free at all three bureaus by federal law — placing, lifting, and removing them all cost nothing. Takeaway: There's no financial reason to avoid freezing your credit.

Myth: A credit freeze and a credit lock are the same thing. Reality: A freeze is a federal legal right with enforceable deadlines; a lock is a bureau's own commercial product governed by its terms of service. Takeaway: Ask specifically for a "security freeze," not a "lock," if you want the federal protections.

Myth: Paid monitoring services prevent identity theft from happening. Reality: These services primarily detect and help you respond to identity theft — no service can stop someone from misusing already-exposed information. Takeaway: Judge paid services on detection speed and recovery support, not prevention claims.

Myth: Checking your credit score is the same as checking your full credit report. Reality: A score is a single number; a report shows the underlying accounts and inquiries where fraud actually shows up. Takeaway: Review the full report, not just the score.

Myth: Dark web monitoring finds all stolen information. Reality: These services scan a limited set of known sources and can't access the entire dark web. Takeaway: Treat a "clean" scan as a limited data point, not a guarantee.

Myth: You'll always know right away if your identity has been stolen. Reality: Synthetic and child identity theft, especially, can go undetected for years with no visible warning sign. Takeaway: Proactive checks matter precisely because some forms are silent.

Myth: Only online activity puts you at risk. Reality: Mail theft, card skimming, and discarded physical documents are common, well-documented vectors too. Takeaway: Physical-world habits — shredding, mailbox security — matter as much as digital ones.

Myth: Once you freeze your credit, you're fully protected from all forms of identity theft. Reality: A freeze blocks new-account fraud specifically; it doesn't stop misuse of existing accounts, tax fraud, or medical identity theft. Takeaway: A freeze is one layer, not a complete solution.

Myth: Identity theft only affects your finances. Reality: It can also corrupt medical records and, in criminal identity theft cases, create a fraudulent record under your name with law enforcement. Takeaway: Recovery sometimes means correcting records well beyond your bank accounts.

Myth: A company data breach notification means you're definitely a victim of identity theft. Reality: A breach notice means your information was exposed and could be misused — it doesn't mean misuse has actually happened. Takeaway: Treat a breach notice as a prompt to monitor closely, not a confirmed loss.

Myth: Older adults are the only common target. Reality: FTC data shows identity theft and fraud reports span every age group, and certain types — like synthetic and child identity theft — specifically target people with little or no credit history, including minors. Takeaway: Protective habits apply across every age group, not just older adults.

Myth: Reporting identity theft guarantees your losses will be reimbursed. Reality: Reporting starts the recovery and dispute process, but reimbursement depends on the institution, the type of loss, and the specific circumstances — there's no universal guarantee. Takeaway: Report promptly regardless, since delay tends to make recovery harder, not easier.

Am I Protected? A Quick Checklist

Use these four questions as a practical starting point. If any answer is "no" or "not sure," that's exactly where to focus next.

• Freeze Question — Have I placed a credit freeze at all three nationwide credit bureaus, not just one?

• Monitoring Question — Do I review my full credit reports (not just a score) and my account statements on a regular schedule?

• Information Question — Do I limit who has my Social Security number and other sensitive details, and think before sharing them?

• Response-Readiness Question — Do I know where to go (IdentityTheft.gov) and what to do first if I notice a warning sign?

Illustrative Examples

These scenarios are hypothetical and simplified for teaching purposes. They describe the victim-side experience only and leave out procedural or technical detail.

Unfamiliar hard inquiries. A consumer checking a free weekly credit report notices two hard inquiries from lenders they've never contacted. They place a credit freeze at all three bureaus immediately, then contact each lender's fraud department to dispute the inquiries and request they be removed. Because the freeze is now in place, no further new accounts can be opened while the dispute is investigated.

A child's Social Security number, discovered years later. A parent helping their 18-year-old apply for a first credit card finds an existing credit file already showing several delinquent accounts, none of which the teenager opened. The parent requests the credit bureaus' minor identity theft process, submits documentation showing the child's age at the time the accounts were opened, and works through each bureau's dispute process to have the fraudulent accounts removed from the file.

A rejected tax return. A taxpayer e-files their return in early spring and receives a rejection notice stating a return has already been filed under their Social Security number. They file Form 14039 (Identity Theft Affidavit) with the IRS, follow the agency's identity theft procedures, and enroll in the IP PIN program for future filing seasons to help prevent a repeat.

Free freeze vs. paid monitoring. A consumer compares options after a retailer breach notice arrives in the mail. A free credit freeze, placed at all three bureaus, blocks new lenders from viewing their file — addressing the most common risk from this type of breach. A paid monitoring service they're considering would add broader dark web scanning and a dedicated case manager if something does go wrong, at a monthly cost. They decide the free freeze covers their main concern for now, and can add paid monitoring later if their risk changes.

Glossary

Identity theft — The unauthorized use of another person's personal identifying information, typically to obtain money, credit, medical services, tax refunds, employment, or other benefits fraudulently in that person's name.

Identity fraud — Often used interchangeably with identity theft; generally refers to the fraudulent use of stolen identity information once it has been obtained.

Synthetic identity theft — A form of identity theft that combines real information, such as a Social Security number, with fabricated information to create a new, fictitious identity used to open fraudulent accounts.

Medical identity theft — The unauthorized use of someone's identity to obtain medical care, prescriptions, or insurance benefits, which can also corrupt the victim's medical records.

Tax-related identity theft — The unauthorized use of someone's Social Security number to file a fraudulent tax return, typically to claim a refund.

Criminal identity theft — The use of another person's identity during an interaction with law enforcement, which can create a fraudulent criminal record under the victim's name.

Child identity theft — The unauthorized use of a minor's Social Security number to open fraudulent accounts or obtain benefits.

Credit freeze (security freeze) — A free tool under federal law that restricts third-party access to a person's credit report, generally preventing new credit accounts from being opened without the freeze being lifted.

Fraud alert — A notice placed on a credit file that requires creditors to take extra steps to verify identity before extending new credit.

Extended fraud alert — A seven-year fraud alert available to confirmed identity theft victims who provide an official identity theft or police report.

Active duty alert — A one-year fraud alert available to deployed military servicemembers, renewable for the length of deployment.

Credit lock — A commercial product offered by a credit bureau that blocks new access to a credit report, governed by the bureau's own terms of service rather than federal freeze law.

Credit report — A detailed record of an individual's credit accounts, payment history, and credit inquiries, maintained by a credit bureau.

Credit score — A numerical summary derived from a credit report, used by lenders to assess creditworthiness; distinct from the report itself.

Data breach — An incident in which personal or financial information held by an organization is accessed or exposed without authorization.

Dark web monitoring — A service that scans known breached-data marketplaces and forums for a person's personal information and alerts them if it's found.

Two-factor authentication (2FA) — A login security method requiring two separate forms of verification, such as a password plus a one-time code.

Password manager — A tool that generates and securely stores unique passwords for each of a person's accounts.

Phishing — A deceptive email, text, or message designed to trick a recipient into revealing personal information or credentials.

Skimming — The unauthorized capture of card information during a transaction, typically through a device placed on a payment terminal or ATM.

IP PIN (Identity Protection PIN) — A six-digit number issued by the IRS that helps prevent someone else from filing a tax return using a person's Social Security number.

IdentityTheft.gov — The Federal Trade Commission's free website for reporting identity theft and generating a personalized recovery plan.

Frequently Asked Questions

What is identity theft? Identity theft is the unauthorized use of someone's personal identifying information — like a Social Security number or financial account details — typically to obtain money, credit, medical services, or other benefits in that person's name. It differs from a one-off scam because it specifically involves misusing your identity, and effects can surface long after the original exposure.

How does identity theft happen? It typically starts with company data breaches, phishing or similar scams, mail theft, card skimming, lost devices, or discarded documents containing personal information. Many cases involve no direct interaction with the victim at all — for example, a retailer's database being breached. No single cause explains most cases.

What are the different types of identity theft? The main types are financial/account, tax-related, medical, criminal, synthetic, and child identity theft. Each misuses a different piece of your identity and surfaces through different warning signs, so protection and recovery steps vary by type.

What is synthetic identity theft? Synthetic identity theft combines real information — often a Social Security number, sometimes a child's — with fabricated details to create a new, fictitious identity used to open fraudulent accounts. Because it doesn't map to one existing person's credit file, it can go undetected for a long time.

What is medical identity theft? Medical identity theft is the unauthorized use of someone's identity to get medical care, prescriptions, or insurance benefits. It can also corrupt the victim's medical records, which is why reviewing insurance statements and requesting medical records periodically both matter.

What is tax identity theft? Tax-related identity theft is the unauthorized use of someone's Social Security number to file a fraudulent tax return, usually to claim a refund. It's often discovered when a legitimate e-filed return is rejected as a duplicate.

What is child identity theft, and how do I check if my child has been affected? Child identity theft is the use of a minor's Social Security number to open fraudulent accounts. Since children shouldn't have a credit file, you can check for one through the credit bureaus' minor credit-file request process — finding a file at all is itself a warning sign.

What are the warning signs of identity theft? Common signs include unfamiliar accounts or hard inquiries, bills for accounts you never opened, a rejected tax return, unexpected credit denial, unfamiliar charges, and a sudden credit score drop. Synthetic and child identity theft, though, can occur with none of these visible signs for years.

How can I protect myself from identity theft? Combine ongoing habits — unique passwords, two-factor authentication, regular statement reviews, careful sharing of your Social Security number — with structural protections like a credit freeze at all three bureaus and regular credit report checks. No single step covers every risk.

What is a credit freeze and how do I set one up? A credit freeze restricts new lenders from accessing your credit report, generally preventing new accounts from being opened in your name. Set one up by contacting Equifax, Experian, and TransUnion separately — it's free, and you'll need to do it at all three to be fully covered.

What is a fraud alert, and how is it different from a credit freeze? A fraud alert doesn't block access to your report — it requires lenders to verify your identity before extending credit. A freeze blocks access outright. Placing an alert at one bureau triggers notice to the other two; a freeze must be placed at each bureau separately.

What is the difference between a credit freeze and a credit lock? A freeze is a federal legal right under the FCRA with enforceable deadlines for bureaus. A lock is a similar-feeling product, but it's run by each bureau under its own commercial terms, without the same federal legal guarantees.

Is a credit freeze free? Yes. Placing, lifting, and removing a credit freeze is free at all three nationwide credit bureaus under federal law, with no exceptions.

How often should I check my credit report? You're entitled to a free credit report from each of the three bureaus every week through AnnualCreditReport.com, a program made permanent in 2023. Checking monthly or quarterly, at minimum, is a reasonable habit for most people.

What is the IRS Identity Protection PIN (IP PIN)? The IP PIN is a six-digit number known only to you and the IRS that helps prevent someone else from filing a tax return using your Social Security number. Any taxpayer who can verify their identity can voluntarily enroll, and it's valid for one calendar year at a time.

How do I protect my Social Security number? Share it only when genuinely required, avoid carrying your card day to day, and monitor for unauthorized use through the Social Security Administration's online account tools. Once exposed, an SSN generally can't be treated as fully secret again — the focus shifts to monitoring.

What is dark web monitoring, and is it worth it? Dark web monitoring scans known breached-data marketplaces for your information and alerts you if it appears. It can be a useful early-warning layer, but it can't scan the entire dark web, and a clean result doesn't guarantee you haven't been affected elsewhere.

Is paid identity theft protection worth the cost? It depends on how much you value convenience and hands-on recovery help versus doing it yourself for free. Paid services add broader monitoring and case-management support, but they don't prevent identity theft, and much of what they offer — freezes, free reports, federal recovery guidance — is already free.

What should I do if my identity is stolen? Start at IdentityTheft.gov to get a personalized recovery plan, then place a credit freeze if you haven't, contact affected institutions' fraud departments, and dispute fraudulent activity with both the institution and the credit bureaus.

How do I report identity theft? Report it at IdentityTheft.gov, which generates an official Identity Theft Report you can use with creditors and bureaus. For tax-related identity theft, also contact the IRS; for medical identity theft, contact your insurer and provider directly.

How long does it take to recover from identity theft? There's no fixed timeline — it depends on the type of identity theft, how many institutions are involved, and how quickly it was caught. Some cases resolve in weeks; others, especially synthetic or child identity theft, can take much longer.

What is two-factor authentication and why does it matter for identity protection? Two-factor authentication requires a second form of verification beyond a password, like a one-time code sent to your phone. It significantly reduces the chance that a stolen password alone is enough to access your account.

How can I protect my mail from identity theft? Use a locking mailbox, retrieve mail promptly, and sign up for USPS Informed Delivery to preview what's arriving each day so you'd notice if expected mail goes missing.

What is card skimming, and how can I protect against it? Skimming is the unauthorized capture of your card information during a transaction, often via a device placed on an ATM or payment terminal. Check for loose or unusual card readers before inserting your card, and monitor statements closely for unfamiliar charges.

How do I protect an elderly parent from identity theft? Help them set up account transaction alerts, review statements together periodically, and consider a credit freeze at all three bureaus. Encourage open conversations about unexpected calls or mail requesting personal information, without assuming they've done anything wrong if something slips through.

What is the difference between identity theft and a financial scam? A scam is a deceptive interaction that tricks someone into acting, like sending money. Identity theft is the unauthorized use of someone's identity, which can result from a scam or happen independently, such as through a data breach with no direct interaction at all.

Sources

• Federal Trade Commission, Consumer Sentinel Network Data Book 2024 — ftc.gov/reports/consumer-sentinel-network-data-book-2024

• Federal Trade Commission, IdentityTheft.gov — identitytheft.gov

• Federal Trade Commission, Consumer Advice, "Free Credit Reports" — consumer.ftc.gov/articles/free-credit-reports

• Federal Trade Commission, Consumer Advice, "You now have permanent access to free weekly credit reports" — consumer.ftc.gov/consumer-alerts/2023/10/you-now-have-permanent-access-free-weekly-credit-reports

• Consumer Financial Protection Bureau — consumerfinance.gov

• 15 U.S.C. § 1681c-1, Fair Credit Reporting Act, Identity Theft Prevention: Fraud Alerts and Active Duty Alerts

• Social Security Administration, protecting your Social Security number — ssa.gov

• Internal Revenue Service, "Get an identity protection PIN" — irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin

• Internal Revenue Service, IP PIN frequently asked questions — irs.gov/identity-theft-fraud-scams/frequently-asked-questions-about-the-identity-protection-personal-identification-number-ip-pin

• AnnualCreditReport.com — annualcreditreport.com

• U.S. Department of Health and Human Services, Office for Civil Rights, HIPAA breach notification guidance — hhs.gov/ocr

• USPS Postal Inspection Service — uspis.gov

• Identity Theft Resource Center — idtheftcenter.org

• AARP Fraud Watch Network — aarp.org/fraudwatchnetwork

Conclusion

Identity theft takes several distinct forms — financial, medical, tax-related, criminal, synthetic, and child identity theft — and each one surfaces and gets resolved differently. Effective protection doesn't come from any single tool. It comes from combining ongoing habits, like strong unique passwords, two-factor authentication, and care about who gets your Social Security number, with structural protections like credit freezes at all three nationwide bureaus and regular credit report reviews.

No product or habit makes anyone completely immune. Being targeted isn't a reflection of carelessness — many cases begin with a data breach or another event entirely outside an individual's control. What actually helps is knowing where to go before anything happens: IdentityTheft.gov is free, federal, and built for exactly this purpose. Having that starting point in mind ahead of time makes the response faster and considerably less stressful if the moment ever comes.