Identity Theft

What Identity Theft Is

Identity theft is the use of another person's identifying information—such as a name, Social Security number, date of birth, or financial account number—to commit fraud. The Identity Theft and Assumption Deterrence Act establishes identity theft as a federal crime when the information is used unlawfully.

The terms identity theft and identity fraud are often used together. Theft refers to the taking or misuse of personal information, while fraud refers to the deceptive acts committed with it, such as opening an account or filing a tax return. Many federal and state statutes define the conduct as a single offense.

The Fair Credit Reporting Act defines identity theft as a fraud committed using the identifying information of another person, subject to further definition by regulation. This definition matters because it triggers specific consumer rights, including the ability to request fraud alerts and security freezes.

Common Types of Identity Theft

Identity theft appears in several distinct forms, each with different reporting paths and remedies. Financial identity theft involves using another person's information to obtain credit, loans, or bank accounts. Tax-related identity theft occurs when someone files a tax return using another person's Social Security number to claim a refund.

Medical identity theft uses another person's name or insurance information to obtain medical services, prescriptions, or reimbursement. Child identity theft targets a minor's Social Security number, often remaining undetected for years because the child has no credit file to monitor.

Synthetic identity theft combines a real Social Security number with fabricated names, dates of birth, or addresses to create a new identity. Account takeover is a related crime in which someone gains access to an existing account rather than opening a new one.

• Financial identity theft: new credit accounts, loans, or bank accounts opened in another person's name
• Tax-related identity theft: a fraudulent tax return filed to claim a refund
• Medical identity theft: medical services or prescriptions obtained using another person's information
• Child identity theft: misuse of a minor's Social Security number
• Synthetic identity theft: a fabricated identity built from real and false details
• Account takeover: unauthorized access to an existing financial or utility account

How Identity Theft Occurs

Identity thieves obtain personal information through data breaches, phishing messages, skimming devices on card readers, mail theft, and lost or stolen wallets and documents. A breach at a company that holds consumer data can expose names, Social Security numbers, and account credentials for millions of people at once.

Phishing and smishing use deceptive emails or text messages that imitate a trusted organization to persuade a recipient to enter login credentials or personal details on a fake website. Once credentials are captured, an attacker can access existing accounts or open new ones.

Information shared publicly on social media, including full birth dates, pet names, and mother's maiden names, can supply answers to common security questions. Insiders with legitimate access to customer records also commit identity theft in some cases.

Warning Signs

Identity theft often produces observable signals on financial and government records. A credit report may show accounts or inquiries that the consumer does not recognize. A debt collector may contact someone about a debt that belongs to an identity thief.

A rejected tax return because a return was already filed under the same Social Security number is a common indicator of tax-related identity theft. Medical bills for services not received, or a notice that a health plan's benefits are exhausted, can point to medical identity theft.

Missing mail, unexpected data breach notifications, and calls from companies about accounts that were never opened are additional signs. Because child identity theft often leaves no immediate trace, it may surface only when the child applies for a first job, loan, or credit account.

• Accounts or inquiries on a credit report that the consumer does not recognize
• Collection calls or letters about debts that are not owed
• A tax return rejected because one was already filed with the same Social Security number
• Medical bills for services that were not received
• Mail that stops arriving or notices about address changes that were not requested
• Data breach notifications from a company that holds personal information

Reporting Identity Theft

The Federal Trade Commission operates IdentityTheft.gov, a federal resource that guides consumers through reporting identity theft and creating a personal recovery plan. The site produces an identity theft affidavit, a standardized form that can be used with creditors, credit reporting companies, and law enforcement.

Reporting the theft to the Federal Trade Commission creates a record that supports disputes with companies. Consumers can also file a report with their local police department, which may be required by some creditors or insurers before they correct fraudulent accounts.

Contacting the companies where the fraud occurred—banks, credit card issuers, utilities, and health plans—is a separate step. Each company has its own fraud department and may require a written dispute, a police report number, or the Federal Trade Commission affidavit.

For tax-related identity theft, the Internal Revenue Service has a dedicated identity protection unit and publishes instructions for filing Form 14039. The Social Security Administration provides guidance on replacing a Social Security card if it is lost or misused.

Fraud Alerts and Security Freezes

A fraud alert is a notice placed on a credit file that tells businesses to take reasonable steps to verify a consumer's identity before extending credit. An initial fraud alert lasts one year, while an extended fraud alert lasts seven years and requires an identity theft report.

A security freeze, also called a credit freeze, restricts access to a credit file entirely unless the consumer lifts it. The Fair Credit Reporting Act gives consumers the right to place, temporarily lift, or remove a security freeze at no cost. A freeze does not affect a credit score because it does not change any information in the file.

Consumers must contact each national credit reporting company separately—Equifax, Experian, and TransUnion—to place a fraud alert or security freeze. Each company maintains its own file and its own process for verifying identity before placing or lifting the freeze.

Credit Reports and Disputes

The Fair Credit Reporting Act entitles consumers to a free credit report from each national credit reporting company every twelve months. Those reports are available through AnnualCreditReport.com, the centralized site established by federal law.

When a fraudulent account appears on a credit report, the consumer can file a dispute with the credit reporting company and with the company that furnished the information. The credit reporting company generally must investigate and respond within thirty days, or forty-five days if additional information is provided during the dispute period.

The Fair and Accurate Credit Transactions Act added provisions for identity theft victims, including the right to block fraudulent information from appearing on a credit report with an identity theft report. Consumers may also request that a credit reporting company place a notice of dispute on the file while an investigation is ongoing.

Disputes are most effective when they include specific account numbers, the reason the information is inaccurate, and supporting documents such as the Federal Trade Commission identity theft affidavit or a police report.

Reducing Exposure to Identity Theft

Several practices reduce the amount of personal information that can be misused. Limiting the number of documents carried in a wallet, shredding financial statements before disposal, and using unique passwords for each account lower the risk that a single breach exposes multiple services.

Multi-factor authentication adds a second verification step beyond a password, such as a code sent to a separate device. This measure makes it harder for someone who has obtained a password to access an account.

Consumers can also review credit reports periodically for unfamiliar activity and consider a security freeze when they are not actively seeking new credit. Federal law requires companies to provide free annual reports, and identity theft victims are entitled to additional free reports.

Data minimization—sharing a Social Security number only when legally required—reduces the number of places where that number is stored. Government agencies, employers, and financial institutions may require it, but many other organizations do not.