If you suspect your identity has been stolen, act quickly: check for unauthorized activity, protect your accounts and credit, and report the theft through the FTC’s official recovery process. Start by reviewing your bank, credit card, and online account activity, then place a fraud alert or credit freeze if needed, and use IdentityTheft.gov to create an identity theft report and recovery plan.
If you are feeling panicked, take a minute to steady yourself first. A short pause can help you think clearly before you lock down accounts and start documenting what happened. If you need help calming down before taking action, our guide on how to calm anxiety in the moment may help you get oriented.
What to Do First If You Suspect Identity Theft
The best first response is simple: stay calm, act fast, and start checking for anything you do not recognize. The goal is to limit damage before the thief can do more. Official guidance from IdentityTheft.gov and USAGov emphasizes quickly reviewing activity, securing accounts, and reporting misuse.
- Review your financial accounts right away. Look for purchases, transfers, withdrawals, new payees, or changes you did not authorize.
- Check your online accounts. Look for password changes, recovery email changes, unfamiliar logins, or new device access.
- Pull your credit reports. Free reports can help you look for new accounts, debts, or inquiries you do not recognize.
- Protect accounts and credit. Change passwords, place a fraud alert, and consider a credit freeze.
- Report the problem. File an identity theft report at IdentityTheft.gov and contact companies where fraud occurred.
If you only suspect theft and have not confirmed it yet, that is still enough reason to start these steps. You do not need perfect proof before protecting yourself.
How to Check Whether Someone Is Using Your Identity
If you want to know how to check if someone is using your identity free, begin with the tools that cost nothing: your account statements and your credit reports. The FTC’s guidance explains that you can get free credit reports through AnnualCreditReport.com and review them for unfamiliar activity.
Look for these warning signs
- Accounts you never opened
- Charges or withdrawals you do not recognize
- Loan or credit inquiries you did not request
- Debt collections for accounts you do not know about
- Changes to your mailing address or contact details
- Emails or notices about password resets you did not start
- Tax or employment notices that do not match your records
Do not focus only on credit cards. Identity theft can show up in bank accounts, benefits records, tax filings, employment records, or new loans. The FTC notes that a thief may use stolen information to open accounts, take out loans, file taxes, get a job, or access government benefits.
If you think your identity has been hacked rather than stolen in the traditional sense, the same checks still apply. A breach or hacked account can be the starting point for identity misuse, but you still need to confirm what happened by reviewing activity and reports.
How to Protect Your Credit and Financial Accounts
Once you have checked for suspicious activity, protect your credit and accounts immediately. This is especially important if someone has your Social Security number, date of birth, or other key personal information.
Place a fraud alert or credit freeze
A fraud alert tells lenders they should take extra steps to verify your identity before opening new credit in your name. A credit freeze makes it harder for new credit accounts to be opened because most lenders cannot access your credit file while the freeze is active. IdentityTheft.gov explains that a freeze is free and can be temporarily lifted when you need to apply for credit.
Use a fraud alert if you want extra warning and verification. Use a freeze if your main goal is to block new credit from being opened while you sort things out. Many people choose the freeze because it is stronger protection for new-account fraud.
You can also keep a freeze or alert in place while you continue monitoring. That does not stop all forms of identity misuse, but it can reduce the chance of new credit fraud.
Change passwords and secure logins
Change passwords on important accounts, especially email, banking, shopping, cloud storage, and social media. If an attacker gets into your email, they can often reset other accounts from there. Use unique passwords and turn on multi-factor authentication wherever possible. The IRS advises people to secure online accounts with complex, unique passwords and to act quickly if they suspect identity theft.
If a data breach exposed your information, this step becomes even more important. The FBI’s public guidance on data breach response and other institutional advice consistently recommends monitoring accounts closely and changing passwords quickly when compromised information may have been exposed.
For a broader look at how everyday connected devices and services increase exposure, you may also find our article on common technology trends in everyday life useful for understanding why account security matters so much.
How to Report Identity Theft
One of the most important steps is to create an official identity theft report through IdentityTheft.gov. The FTC says the site gives you step-by-step recovery guidance, helps you report identity theft, and supports your efforts to fix the damage.
Reporting matters because it gives you a documented recovery path and helps you organize what to do next. The FTC’s process is designed to help you explain the problem to creditors, bureaus, and other organizations that may need proof of the theft.
Use the FTC reporting process when you believe someone has opened accounts, made purchases, filed taxes, or otherwise used your information without permission. If you are not completely sure yet, the site still helps you identify next steps and narrow down where misuse may have happened.
When to Contact Creditors and File a Police Report
After you identify a suspicious account or charge, contact the company or creditor where the fraud happened. Tell them the account activity is unauthorized, ask what their dispute process is, and keep notes on every call or message. Several official and institutional resources recommend contacting the company involved as part of the recovery process.
A police report can also be helpful, especially when you need extra documentation to support disputes or show that a crime occurred. Guidance from the Texas Attorney General and Indiana University’s security office both note that filing a report can help you work with creditors and document the theft. That said, a police report is not necessarily required in every situation, and requirements can vary by context and jurisdiction.
In practical terms, think of the police report as supporting evidence, not as your first and only move. The immediate priorities are still account review, credit protection, and FTC reporting.
What to Do If Your Social Security Number Was Exposed
If someone has your Social Security number, the risk can be broader than credit-card fraud. The FTC warns that a thief may use it to open accounts, apply for loans, file taxes, or get a job.
Start by checking for signs of misuse in the areas that are easiest to miss:
- Review your credit reports for accounts or inquiries you do not recognize.
- Check your Social Security work history by creating or reviewing your account through the SSA system if available to you, so you can spot employment-related misuse.
- Contact the Social Security Administration if you find errors or suspicious activity tied to your number.
- Consider an E-Verify-related lock if your situation fits that option and the system is available to you.
The FTC also notes that a new Social Security number is usually not available and is not a complete fix. Even when a new number is possible in limited circumstances, records can still connect you to the old number, so it should not be treated as an automatic solution.
If someone has both your Social Security number and date of birth, the risk is higher because those details can help a thief pass identity checks. In that case, move quickly to credit protection and reporting even if you have not yet seen confirmed fraud.
If the Problem Started With a Data Breach or Hacking Incident
A breach does not automatically mean identity theft has already happened, but it can be the entry point. If your information was exposed in a data breach or your account was hacked, the safest approach is to assume the information may be misused and respond as though it could become identity theft.
That means three things right away:
- Secure the affected accounts. Change passwords and enable multi-factor authentication.
- Check for misuse. Review statements, credit reports, and account activity for anything unusual.
- Watch for new fraud. Monitor for suspicious email, login, or billing notices in the days and weeks that follow.
The important distinction is this: a breach creates risk, but it is the unauthorized use of your information that confirms identity theft. You should not wait for perfect certainty before protecting yourself.
How to Reduce the Risk of Repeat Identity Theft
After you handle the immediate crisis, keep monitoring for new problems. Identity theft often becomes clearer over time, especially when new accounts, billing notices, or tax-related issues appear later.
- Keep checking your credit reports periodically.
- Review bank and card statements every month.
- Use unique passwords for every important account.
- Turn on multi-factor authentication whenever it is offered.
- Watch for mail that arrives late, goes missing, or includes unfamiliar accounts.
If you have already had one compromise, stronger account habits matter more than ever. Simple steps like password managers, MFA, and regular account reviews can make repeat misuse harder.
Identity theft recovery can be stressful, but you do not need to solve everything at once. The smartest response is to check for misuse, protect your credit and accounts, report the theft through the FTC, and keep monitoring until the situation is stable.