Identity Theft Warning Signs and What to Do Next
Identity theft can involve new credit, an account takeover, a tax return, medical care, a phone line, or a scam impersonation. The first clue may be an unfamiliar account, password-reset message, medical bill, or lender call.
This guide helps you recognize the signals, separate an urgent account takeover from a suspicious message, and take practical next steps. US credit-reporting and legal instructions are labeled as US-only. If you are elsewhere, use your country’s official consumer-protection and credit-reporting channels.
TL;DR: Treat an unfamiliar account, charge, password change, collection notice, medical bill, or government-related notice as something to verify promptly. Contact the affected organization through a trusted channel, preserve evidence, and report suspected identity theft at IdentityTheft.gov, the FTC’s US recovery resource. A US credit freeze is free and should be considered before paying for monitoring; it does not stop takeover of an existing account. Do not trust an unsolicited caller who asks you to transfer money or disclose a one-time code.
Need a broader prevention plan? Browse the identity theft protection category or take the security habits quiz to identify which safeguards to review first.
Table of contents
- The warning signs that deserve attention
- How to judge urgency
- What to do in the first hour
- Secure credit and repair fraudulent records
- Recover account, tax, medical, and phone misuse
- Prevent the next attempt
- Mistakes to avoid
- Frequently asked questions
- Sources
The warning signs that deserve attention
One sign can be a mistake, but several signs or any clue involving money or account access deserves prompt investigation.
Credit and financial clues
Look for a new credit card, loan, inquiry, collection account, or address that you do not recognize. Check statements for small test charges as well as large purchases. A thief may make a low-dollar transaction to see whether an account is active, or may change a billing address so future notices reach them.
A credit report can reveal an account you never opened. The FTC explains that a freeze or fraud alert can make new-account fraud harder (FTC: Credit Freezes and Fraud Alerts). An unfamiliar account is a reason to investigate.
Account-access clues
An unexpected password-reset email, a changed recovery address, a new authentication method, or a login notification from a place you do not recognize can mean someone is trying to take over an account. Treat a successful password change you did not make as more urgent than a generic marketing email.
An email or text that claims your account has suspicious activity is not automatically evidence of a breach. It may be phishing. The FTC notes that phishing messages commonly create urgency, ask you to confirm personal or financial information, or push you to click a link or open an attachment (FTC: How To Recognize and Avoid Phishing Scams). Verify through an app or a web address you type yourself.
Government, tax, employment, and benefits clues
A notice saying that a tax return was already filed using your information, an unfamiliar unemployment claim, or a government account you did not create can signal misuse. Keep the notice and use the agency’s official contact information.
A background-check result, employment document, or benefits communication that contains an unfamiliar employer or claim is also worth checking. These cases may involve different agencies and deadlines, so include them in your IdentityTheft.gov report and follow its recovery plan.
Medical and phone clues
An explanation of benefits, medical bill, prescription record, or provider statement for care you did not receive may indicate medical identity theft. Contact the provider’s billing or privacy office using a trusted number and request records related to the item.
A mobile account that suddenly loses service, a SIM-change notice, or a new line you did not request can indicate phone-account takeover. Use another phone if necessary to contact the carrier, ask it to secure the account, and change passwords for email and financial accounts.
Friends may tell you that they received strange messages from your social account. That suggests account compromise even if no money has moved. Warn contacts not to click links from the account and use a clean device or trusted channel to recover it.
How to judge urgency
Ask two questions: Can the person still access something important? and Could waiting cause money, access, or evidence to be lost? If the answer to either is yes, act now rather than waiting to collect perfect proof.
| Signal | Priority | First move |
|---|---|---|
| You clicked a suspicious link but entered nothing | Prompt | Close it, update security software, and run a scan if a file downloaded. Watch the account through an official app. |
| You entered a password or code on a suspicious page | Urgent | Change that password from a trusted device, sign out other sessions, and contact the account provider’s fraud team. |
| Bank, card, email, or phone account was changed or taken over | Immediate | Use the provider’s official emergency channel; ask it to lock access, reverse unauthorized activity where possible, and document the case. |
| New credit, collection debt, or inquiry is not yours | Urgent | Place US credit protections, save the report, and start an IdentityTheft.gov recovery plan. |
| You received a generic suspicious message and took no action | Routine but worthwhile | Report and delete it; do not reply. Review your account security when convenient. |
Example: You receive a text saying your bank account will close in ten minutes. You tap the link but stop before entering information. That is a phishing attempt, not proof that your bank was breached. Report it, delete it, and access your bank through its known app. If you entered your password or a one-time code, escalate immediately because the risk is different.
What to do in the first hour
1. Stop interacting with the suspicious message
Do not click again, reply, call the number in the message, or send a verification code. Take a screenshot that includes the sender, time, link, and message text. Forward phishing email to [email protected], forward a phishing text to SPAM (7726), and report it to the FTC at ReportFraud.ftc.gov, as recommended by the FTC.
If you downloaded an attachment or software, disconnect the affected device from the network if appropriate, update its security software, and run a scan. Do not assume that deleting the message removes malware.
2. Use a trusted route to secure the account
Type the organization’s known web address, use its official app, or call the number on a statement or card. Ask for the fraud or security department. Explain what happened, when it happened, and which information may have been exposed.
For a bank or card, ask whether the account or card should be locked, replaced, or closed. Review pending transactions, not just posted transactions. Ask what documentation is needed to dispute unauthorized activity and note the case number.
For email, change the password from a trusted device, sign out other sessions, remove unfamiliar recovery methods, and check forwarding rules. Then change passwords on accounts that reused the same password. Use unique passwords and enable multi-factor authentication where available. The FTC explains that multi-factor authentication adds a credential beyond a password and makes access harder when a password is exposed.
3. Preserve a simple evidence file
Create a dated note with the message, account, contact, case number, disputed transaction, and action taken. Keep copies of statements, letters, screenshots, and identity-theft reports. Do not send your full Social Security number or identity documents to an unverified address just because a caller demands them.
4. Report US identity theft at the official recovery site
For US consumers, go to IdentityTheft.gov. The FTC says the site creates an Identity Theft Report and a personalized recovery plan, including steps that may involve closing accounts, correcting credit reports, and considering a freeze or extended fraud alert (FTC: Stolen identity? Get help at IdentityTheft.gov). This is the right starting point for identity-theft recovery, not a sales pitch.
The CFPB also recommends closing affected accounts, contacting financial institutions, reporting at IdentityTheft.gov, and using official agency contact details because scammers impersonate the FTC, CFPB, banks, and law enforcement (CFPB: What do I do if I am a victim of identity theft?).
5. Consider a police report when it helps
A police report may be useful when a creditor, provider, insurer, or agency requests it, when a crime involved local circumstances, or when you need additional documentation. Ask the organization what it accepts. Do not delay the immediate account lock or IdentityTheft.gov report while trying to obtain a report first.
Secure credit and repair fraudulent records
Freeze first when new-account fraud is a concern
A US credit freeze is free and does not affect your credit score. It blocks prospective creditors from accessing your credit file until you lift the freeze. You must place it separately with Equifax, Experian, and TransUnion; one bureau does not automatically freeze the other two. The FTC’s current consumer guidance explains that a freeze remains until you lift it and that anyone can request one, even without confirmed identity theft.
Use the bureaus’ official websites or contact methods. Save the confirmation and the credentials or PINs needed to manage each freeze. When you legitimately need a credit check, ask which bureau will be used and temporarily lift only what is needed, then restore the freeze.
A freeze helps with new credit. It does not stop a thief who already has access to your bank, email, phone, payment, or existing credit account. Secure those accounts separately.
Add a fraud alert when verification is useful
An initial fraud alert is free and lasts one year. You place it with one nationwide credit bureau, and that bureau must notify the other two. It tells businesses to verify your identity before opening new credit, but it does not block access to your report in the way a freeze does.
If you have an FTC Identity Theft Report or police report, an extended fraud alert may be available for seven years. Check the FTC and CFPB instructions for current eligibility and documentation. Servicemembers may have an active-duty alert option. These are US-specific protections.
| US protection | What it does | Practical limitation |
|---|---|---|
| Credit freeze | Blocks prospective creditors from accessing your file until you lift it | You must place it at all three bureaus; it does not stop existing-account takeover |
| Initial fraud alert | Tells businesses to verify you before opening new credit | It does not block report access; it lasts one year unless renewed |
| Extended fraud alert | Adds stronger identity-verification instructions after identity theft documentation | Eligibility and documentation apply; it does not replace account security |
Review reports and dispute what is fraudulent
Obtain your reports through an official source such as AnnualCreditReport.com. Check names, addresses, employers, inquiries, accounts, balances, and collection entries. Download or print the relevant pages and mark each unfamiliar item.
Under the CFPB’s explanation, you can ask the credit-reporting companies to block identity-theft information by sending an Identity Theft Report, proof of identity, and a letter identifying the fraudulent information. The CFPB says the companies must block fraudulent information within four business days after receiving the request when the requirements are met. Follow the bureau’s current instructions and keep proof of delivery.
Dispute with the company that supplied the information as well as with the bureau when appropriate. Ask creditors to close fraudulent accounts and stop collection activity tied to the theft. Keep every response. If a credit-reporting problem is not resolved, the CFPB says you can submit a complaint.
Example: A report shows a retail card opened at an address where you have never lived. You freeze all three reports, save the report page, file at IdentityTheft.gov, contact the card issuer’s fraud department, and send the requested identity-theft documentation to the bureau and issuer. You do not pay the balance or admit the account is yours just to close the matter.
Midway checkpoint: If you are unsure which safeguard fits, review the identity theft protection category and take the quiz. If a data breach is part of your story, read what to do after a data breach next.
Recover account, tax, medical, and phone misuse
Existing bank and card accounts
Call the institution through a trusted number. Request a lock or replacement, ask which transactions are unauthorized, and confirm whether digital-wallet tokens, automatic payments, beneficiaries, or linked external accounts changed. Change credentials and security questions. Review statements again after the account is secured because delayed transactions can appear later.
Email and social accounts
Email often controls password resets elsewhere. Change the email password first, review active sessions and forwarding rules, remove unknown devices, and update recovery information. Then secure social accounts and tell contacts that earlier messages may not be trustworthy. Do not announce sensitive recovery details publicly.
Tax and government-related misuse
Use the agency’s official site or notice, not a caller-provided link. Preserve the letter and report the incident through IdentityTheft.gov. Tax and benefits systems have their own procedures, so follow the agency’s instructions and keep confirmation numbers.
Medical identity theft
Contact the provider’s billing, records, or privacy office. Ask for the records and claim details that concern you, explain which care was not yours, and request correction. Keep copies of correspondence. Be careful with medical documents: send them only through a verified channel.
Phone-number takeover
Contact the carrier’s fraud team, restore control of the number, and ask about adding an account PIN or stronger transfer protections. Because text messages may no longer reach you, secure email and financial accounts through trusted channels. Change passwords and review account recovery methods.
A child’s identity
A child may not check a credit report regularly, so unfamiliar mail or a notice about an account can be the first clue. Discuss privacy in an age-appropriate way without treating the child as responsible for the theft. Do not demand access to every private conversation when a narrower check will answer the safety question.
For a US child under 16, the FTC says a parent or guardian can request a free credit freeze, with a different process from an adult freeze. Follow each bureau’s minor-freeze instructions and protect the documents used for the request. Also account for device limits: a child may share a family device, use school-managed accounts, or lack permission to change settings.
Prevent the next attempt
Use a unique password for email, banking, shopping, and your mobile account. A password manager can help create and store credentials, but it is not a substitute for multi-factor authentication or cautious message handling. Secure the password manager itself with a strong, unique password and an available second factor.
Turn on multi-factor authentication for high-value accounts. An authenticator app or security key can be useful where available, but any second factor is generally stronger than relying on a password alone. Keep recovery codes somewhere safe and offline if the service provides them.
Update phones, computers, browsers, and security software automatically when possible. Back up important files. Review account alerts, statements, and credit reports on a routine schedule that you can actually maintain. A warning is useful only if you notice it and know where to go.
Reduce unnecessary exposure. Before providing a Social Security number, ask why it is required, how it will be protected, and whether another identifier is acceptable. Shred documents containing sensitive information. Treat unexpected requests for gift cards, cryptocurrency, wire transfers, cash, gold, passwords, or one-time codes as high-risk.
A VPN is not an identity-theft cure. It does not stop phishing, repair a stolen password, or make you anonymous. If you use one, treat it as one privacy measure among many, not as permission to click unknown links or reuse passwords.
Mistakes to avoid
Waiting for certainty. You can investigate while taking reversible steps such as locking a card, changing a password, and placing a freeze. Waiting can give an attacker more time.
Using contact details from the suspicious message. A convincing logo and caller ID do not authenticate a message. Start from a known app, statement, or manually entered official address.
Paying a fraudulent debt immediately. Payment may complicate the dispute. Ask the creditor or collector how it handles identity-theft documentation and keep a written record.
Assuming a freeze secures every account. It targets new credit. Existing bank, email, phone, medical, and payment accounts still need direct attention.
Buying monitoring before using free protections. Monitoring can alert you to some events, but it does not replace a free US credit freeze, fraud alert, direct account security, or the IdentityTheft.gov recovery plan. Compare any service carefully and do not treat a paid product as necessary for the first response.
Sending sensitive documents to an unverified helper. Confirm the site, domain, phone number, and upload destination before sharing identity documents. Government agencies do not require you to transfer money to “protect” it. The CFPB specifically warns that impersonators use this story.
Overreacting to every unfamiliar login. Investigate it, but do not publicly accuse someone or share private evidence. A travel session, VPN endpoint, family device, or delayed notification can look unfamiliar. Verify through the account’s security page.
Frequently asked questions
What is the first thing I should do if I suspect identity theft?
Secure the affected account through its official app or website, contact the fraud department, and preserve evidence. For US identity theft, report it at IdentityTheft.gov to receive an Identity Theft Report and recovery plan.
Should I freeze my credit after identity theft?
Usually, yes, when new-account fraud is possible. A US credit freeze is free, lasts until you lift it, and must be placed separately with Equifax, Experian, and TransUnion. It does not protect existing accounts from takeover.
Is a credit freeze the same as a fraud alert?
No. A freeze blocks prospective creditors from accessing your file until you lift it. A fraud alert tells businesses to verify your identity before opening new credit and does not block report access.
Can identity theft happen without a new credit card appearing?
Yes. Account takeover, tax, medical, phone, benefits, and employment-related misuse may not appear as a new credit account. Review statements, messages, bills, notices, and account-security activity as well as credit reports.
What if a scammer calls claiming to be the FTC or my bank?
Do not transfer money, share passwords or one-time codes, or use the caller’s number. Hang up and contact the organization through an official app, website, statement, or card. The CFPB warns that impostors may claim money must be moved to protect it; that is a scam pattern.
Do I need a police report for identity theft?
Not always. IdentityTheft.gov can create an FTC Identity Theft Report. A police report may still help with a particular dispute, investigation, or extended fraud alert, so ask the organization what documentation it requires.
Can a VPN prevent identity theft?
No. A VPN may change how your traffic is routed, but it does not stop phishing, secure a compromised account, or make you anonymous. Use account protections, unique passwords, multi-factor authentication, updates, and cautious verification.
How do I help protect a child’s identity?
Watch for unfamiliar mail, bills, and account notices. Explain safe sharing in an age-appropriate way while respecting privacy. In the US, a parent or guardian can ask the bureaus about a free minor’s credit freeze for a child under 16; device and account-management limits may affect what changes are possible.
One last step: If you have identified a gap, use the identity theft protection category for related guidance or take the security quiz. You can also learn more about SecureThreats.com’s purpose on the About page.