Identity Theft

Overview of the Scam

Identity theft occurs when someone uses your personal information - your Social Security number, date of birth, financial account details, or other identifying data - to commit fraud or other crimes in your name. The spectrum of harm is wide: from a single fraudulent credit card charge to the opening of multiple new accounts, the filing of a fraudulent tax return, the taking out of loans, or the complete takeover of your existing financial life.

Identity theft is not a single scam but the consequence of many scams. Phishing emails, data breaches, mail theft, social engineering calls, fake websites, and physical document theft are all pathways through which identity information is obtained and misused. Understanding how your information is stolen is as important as understanding what to do when it is.

The FTC reports millions of identity theft cases annually in the US, making it one of the most prevalent consumer fraud categories. Recovery is possible but typically requires significant time and effort - which is why prevention and early detection are far preferable to responding after the fact.

How the Scam Works

Identity theft typically involves two phases: obtaining your information and exploiting it.

• Your personal information is obtained through one of several pathways - a data breach at a company you use, a phishing email that captures your login credentials, a social engineering call that tricks you into providing your Social Security number, stolen mail containing financial documents, malware installed on your device, or simply purchasing your information from criminal marketplaces that trade in bulk stolen data from past breaches.
• The thief uses your information to establish or access financial accounts. With your Social Security number and date of birth, a thief can apply for new credit cards, personal loans, or lines of credit in your name. With your login credentials, they can access existing accounts directly.
• New accounts are opened and maxed out. The thief makes purchases, takes cash advances, or transfers funds - then defaults on the accounts, leaving the debt associated with your name and credit history.
• Tax identity theft involves filing a fraudulent tax return using your Social Security number before you file your own, claiming the refund and diverting it. You discover the theft when you file your legitimate return and are told one has already been submitted.
• The damage compounds over time. New accounts default and go to collections. Your credit score drops. Debt collectors contact you for debts you never incurred. Recovering requires disputing each fraudulent account individually, working with credit bureaus, and potentially involving law enforcement and the FTC.

Common Variations

Identity theft takes several distinct forms depending on which aspect of your identity is exploited and for what purpose.

• Financial identity theft: The most common form. Your information is used to open new credit accounts, take out loans, or access existing financial accounts. The resulting debt and account damage affects your credit for years if not addressed.
• Tax identity theft: Your Social Security number is used to file a fraudulent tax return and claim your refund before you file your own. The IRS has processes for addressing this, but resolution can take months and delay your legitimate refund.
• Medical identity theft: Your health insurance information or Medicare ID is used to fraudulently bill for medical services or obtain prescriptions. This can affect your medical records with inaccurate information that creates real risks for your future care.
• Synthetic identity fraud: A thief combines your real Social Security number with a fabricated name and other details to create a new fictional identity. This type is harder to detect because it does not appear in your credit report under your own name.
• Child identity theft: A child's Social Security number - rarely monitored because children do not typically have credit activity - is used to open accounts that accumulate debt for years before the theft is discovered, often not until the child applies for their first loan or job.
• Account takeover: Rather than opening new accounts, a thief uses your credentials to take over an existing account - changing the password, email, and phone number associated with it to lock you out and drain the account.

Example Scam Messages or Pop-Ups

Identity theft is often discovered through unexpected notifications rather than through a direct scam message. The example below shows the types of signals that commonly indicate your identity has been compromised.

Credit monitoring alerts, unexpected bills or collection notices, and IRS correspondence about duplicate tax returns are among the most common ways identity theft first becomes visible. Setting up free credit monitoring through one of the major bureaus or through a service like Credit Karma provides early warnings before the damage compounds. The sooner identity theft is detected and reported, the more limited the recovery effort required.

Common discovery signals include: receiving a credit card you never applied for in the mail, getting a collection call for a debt you do not recognize, discovering that a tax return has already been filed under your Social Security number when you try to file your own, seeing unfamiliar hard inquiries on your credit report, or receiving a notification from a company about a data breach that included your information.

Warning Signs

These signals indicate that your identity may have been compromised and require prompt investigation.

• You receive bills, statements, or collection notices for accounts you do not recognize and never opened.
• Your credit report shows hard inquiries - credit applications - that you did not initiate, or new accounts that you did not open.
• You are rejected for credit you applied for because of a negative credit history you did not know you had.
• The IRS notifies you that a tax return has already been filed using your Social Security number, or that more than one return was filed for the same year.
• Your health insurance company sends an explanation of benefits for medical services you did not receive.
• You stop receiving expected mail - bills, statements, or correspondence - which may indicate your address has been changed on accounts without your knowledge.
• You receive notification from a company about a data breach that may have included your personal information.
• You are contacted by a debt collector about a debt you do not recognize, for an account you did not open.

Who Scammers Often Target

Identity theft affects people across all demographics because the primary source of stolen information is large-scale data breaches at companies, not individual targeting. Anyone whose information was included in a breach at a retailer, healthcare provider, financial institution, or government agency may have their information circulating on criminal marketplaces.

People who do not regularly monitor their credit reports are more vulnerable because they are less likely to detect identity theft early - allowing it to compound over months or years before discovery. People who frequently provide personal information to online services, use weak or repeated passwords, or are less familiar with phishing tactics are at elevated risk for the scam-based pathways of identity theft.

Children and elderly individuals are specifically targeted for Social Security number-based fraud because their numbers are less likely to be actively monitored through regular credit activity.

What the Scammer Is Trying to Achieve

The goal is financial gain through credit and financial account access - obtaining goods, services, or cash using credit extended to you rather than to the thief. Tax identity thieves specifically seek your tax refund. Medical identity thieves seek pharmaceutical or medical service value. Account takeover thieves seek direct access to your existing balances.

In all cases, the thief benefits financially while you bear the consequences - damaged credit, fraudulent debt, the time required for recovery, and in some cases legal complications if identity theft is used to commit crimes attributed to your name.

What To Do If You Encounter This Scam

If you discover signs of identity theft, the most important thing is to act quickly and systematically.

• Go to IdentityTheft.gov and create a recovery plan. The FTC's site generates a personalized action plan with pre-filled letters for your specific situation - new account fraud, tax identity theft, account takeover, or others.
• Place a fraud alert with one of the three major credit bureaus (Equifax, Experian, TransUnion). When you place a fraud alert with one, they are required to notify the others. A fraud alert requires lenders to verify your identity before extending new credit.
• Consider placing a credit freeze with all three bureaus. A freeze is stronger than a fraud alert - it prevents new accounts from being opened entirely until you lift it. It is free and does not affect your existing accounts or credit score.
• Contact the fraud departments of any financial institutions or companies where fraudulent accounts were opened. Ask them to close the accounts and remove the fraudulent charges from your credit history.
• File a police report with your local law enforcement. This report is often required by creditors and credit bureaus to process identity theft disputes.

If You Already Paid or Shared Information

If you have provided personal information in a situation you now believe was a scam - a phishing email, a social engineering call, a fake website - take these steps immediately.

How To Prevent Identity Theft

These habits significantly reduce your risk of identity theft across all its common pathways.

• Place a credit freeze with all three major credit bureaus - Equifax, Experian, and TransUnion. This is free and is the single most powerful protection against new-account identity theft. It can be temporarily lifted when you need to apply for credit.
• Use strong, unique passwords for every online account and a password manager to keep track of them. Reusing passwords means a single breach can expose multiple accounts.
• Enable two-factor authentication on all accounts that support it - particularly email, banking, and financial accounts. Two-factor authentication prevents account access even when a password has been compromised.
• Monitor your credit reports regularly through AnnualCreditReport.com and set up credit monitoring alerts. Early detection of new accounts or inquiries you did not initiate is key to limiting damage.
• Shred documents containing personal information before discarding them. Mail containing account numbers, Social Security numbers, or date of birth should never go directly in the trash.
• Be thoughtful about what personal information you share online and with whom. The less widely your Social Security number, date of birth, and financial account details are distributed, the smaller your exposure to breach-based identity theft.