What to do if your identity is stolen

How to recognize identity theft

Identity theft happens when someone uses your personal information, such as your name, Social Security number, account numbers or date of birth, without your permission. The thief may open new accounts, take over existing ones, file a tax return, collect benefits or give your name to police. Identity theft is rarely announced. It is discovered through its side effects.

Common warning signs include:

• charges, withdrawals or transfers you did not make;
• bills, collection calls or letters for accounts you never opened;
• a credit report showing unfamiliar accounts, hard inquiries or addresses;
• a rejected tax return because one was already filed under your Social Security number;
• a notice that you received benefits or unemployment pay you never applied for;
• password reset emails or login alerts you did not request;
• expected mail, statements or cards that stop arriving.

Many people learn about it from someone else. According to the Bureau of Justice Statistics, Victims of Identity Theft, 2021, 24.6% of victims learned of the theft when their financial institution contacted them. If your bank calls about suspicious activity, hang up and call back using the number on your card. Scammers also pose as fraud departments.

How common identity theft is

Identity theft is one of the most frequently reported consumer problems in the United States. The FTC Consumer Sentinel Network Data Book 2024 reports that the FTC received 1,135,291 identity theft reports in 2024, 17.5% of 6,471,708 total reports; credit card fraud led with 449,032 reports and government documents or benefits fraud accounted for 70,332. The FTC had not published a 2025 data book as of November 2026, so 2024 remains the latest full national count.

Reports capture only part of the problem. Survey data from the Bureau of Justice Statistics, Victims of Identity Theft, 2021 estimates that 23.9 million people, about 9% of U.S. residents age 16 or older, experienced identity theft in 2021, with losses totaling $16.4 billion. Because that survey reaches victims who never filed anything, it shows how much identity theft goes unreported. The same survey found that only about 7% of identity theft victims reported the incident to police and about 7% contacted a credit bureau.

Rates also vary by state. In the same FTC data book, Florida had the highest identity theft report rate in 2024 at 528 per 100,000 people (115,840 reports), followed by Georgia (517), Nevada (466), Texas (393) and Delaware (392); South Dakota was lowest at 94. More national figures are collected on our statistics page.

Why the checklist order matters

The order above is designed to stop new damage before repairing old damage. Reporting at IdentityTheft.gov comes first because the resulting FTC Identity Theft Report is the document that supports nearly every later step: disputes with credit bureaus, letters to creditors and conversations with debt collectors. The recovery plan it generates also tailors the next steps to what actually happened to you.

Fraud alert or credit freeze

A fraud alert and a credit freeze both protect your credit file, but they work differently.

• A fraud alert asks lenders to take extra steps to verify your identity before extending credit. You place it with one bureau, and that bureau notifies the other two.
• A credit freeze restricts access to your credit report, so most new lenders cannot approve an application in your name. You must place it separately with Equifax, Experian and TransUnion.

Both are free. A freeze offers stronger protection against new-account fraud; an alert is faster because one request covers all three bureaus. Many victims place an alert immediately and then add freezes. Each bureau explains how long an alert lasts and how to lift a freeze, so check their current instructions rather than relying on older guidance.

Credit reports, then companies

Once your file is protected, pull your reports at AnnualCreditReport.com and list every account or inquiry you do not recognize. That list tells you which companies to contact. When you call a fraud department, ask for the account to be closed, ask that it not be reported as yours, and ask for written confirmation. Keep notes of names, dates and reference numbers.

Securing your accounts

Many identity theft cases begin with, or lead to, account takeover (a criminal gaining control of an existing account rather than opening a new one). Changing passwords and turning on multi-factor authentication (MFA, a second proof of identity beyond the password) closes that door.

• Secure email first. Your email account receives password resets for everything else.
• Use unique passwords. A password reused on a breached site exposes every other account that shares it.
• Prefer app or hardware MFA. Authenticator apps and security keys are harder to intercept than text-message codes.
• Protect your phone number. Ask your carrier about a port-out PIN or account lock to resist SIM swapping.

For platform-specific steps, see our guides to hacked accounts and SIM swap fraud.

Police reports, the IRS, the SSA and your DMV

A police report is not always required, but it is worth considering. Some creditors, insurers and collection agencies ask for one, and it matters when the person responsible is known, when a large loss is involved, or when someone has used your name during an arrest. Bring your FTC Identity Theft Report, a government-issued ID and proof of address.

Tax-related identity theft

Tax-related identity theft occurs when someone uses your Social Security number to file a return and claim a refund, or to work under your name. Signs include a rejected electronic return or an IRS notice about income you did not earn. The IRS offers an Identity Protection PIN, a number known only to you and the IRS that must accompany any return filed under your Social Security number. Program details and eligibility change, so start at IRS.gov and follow its current instructions.

Social Security card and driver's license

If your Social Security card was stolen, the Social Security Administration handles replacements; check its site for current options. A stolen driver's license is handled by your state motor vehicle agency, which sets its own replacement process. Ask whether the agency can note that the old license was stolen.

If your wallet was stolen

A stolen wallet is a physical theft that can quickly become identity theft. Work through it in this order:

• call the issuer of every credit and debit card to cancel and reissue it;
• report the theft to police, especially if cash, a license or a Social Security card was taken;
• place a fraud alert or credit freeze;
• replace your driver's license through your state DMV and, if applicable, your Social Security card through the SSA;
• replace insurance, membership and benefit cards, and tell each issuer the card was stolen;
• change passwords if any were written down, and secure any phone that was taken with the wallet.

Stolen items are often misused. The Identity Theft Resource Center, 2026 Trends in Identity Report found that among people whose physical items were stolen and later misused, 71% experienced account takeover and 44% new account fraud; stolen phones and tablets led to account takeover in every case reported (14 individuals). That is a small, self-selected sample of victims who contacted ITRC, but the pattern supports acting on both cards and online accounts. For the broader theft report, see stolen property.

If a passport was among the documents taken, report it as well: the stolen passport checklist covers reporting it to the State Department and replacing it at home or abroad.

If you received a data breach notice

A data breach notice means a company believes your information was exposed. It does not mean your identity has been stolen, but it raises the risk. Breaches are now routine. The Identity Theft Resource Center, 2025 Data Breach Report counted a record 3,322 U.S. data compromises in 2025 with 278,827,933 victim notices, and compromises involving Social Security numbers nearly doubled from 1,146 in 2021 to 2,236 in 2025. Victim notices count notifications, not unique people, since one person can receive several.

Match your response to what was exposed:

• Passwords or usernames: change the password there and anywhere you reused it, and turn on MFA.
• Card numbers: watch statements and ask the issuer for a new card if you prefer.
• Social Security number or date of birth: place a credit freeze with all three bureaus and watch for tax-related identity theft.
• Bank account details: alert your bank and watch for unauthorized transfers.

Be cautious with the notice itself. Criminals send fake breach emails to harvest credentials. Visit the company's website directly instead of clicking links, and treat any offered monitoring service as optional rather than a substitute for a freeze.

What recovery looks like and how long it takes

For most victims, recovery is faster and cheaper than they fear. The Bureau of Justice Statistics, Victims of Identity Theft, 2021 found that about 12% of identity theft victims had out-of-pocket losses (mean $790, median $100); 56% resolved the problems in one day or less, and 10% were severely distressed. A single misused card is usually settled with one call to the issuer.

Cases involving new accounts, tax returns, benefits or criminal records take longer, and there is no reliable standard timeline. Recovery generally moves through the same stages: stopping new fraud, documenting the theft, disputing what was opened in your name, and confirming in writing that each item is resolved. Keep your file of reports and letters even after the problem appears settled, because a collector or lender may raise an old account later.

Recovery also has an emotional side. Feeling violated or anxious is a common reaction, and the numbers above show that a meaningful share of victims experience severe distress. Working through a checklist, one step at a time, restores a sense of control. Confirmed Stolen provides general information only, not legal or financial advice; for complex cases, the agencies linked on this page and your own legal counsel are the right sources.