How to Tell if Someone Is Using Your Identity, and How to Report It

Finding your email in a data breach tells you some of your information was exposed. It does not tell you that anyone has used it. Identity theft is when someone actually uses your personal or financial information without permission, for example to open a credit card, take over an account or claim a tax refund.

This guide covers the warning signs to look for, the free ways to check, and what to do if you find something. Most of it comes from the Federal Trade Commission's consumer guidance.

Common warning signs

The FTC lists several practical signs that identity theft may already have happened. Any one of them is worth a closer look, though each can also have an innocent explanation.

• A bill stops arriving. Someone may have changed the billing address on an account.
• Charges you did not make, or a new bill you did not expect.
• Bank withdrawals you did not make.
• Accounts on your credit report that you do not recognize.

Other signs people often notice:

• Password reset emails or login alerts you did not request.
• Calls from debt collectors about debts that are not yours.
• A letter from the IRS about a tax return you did not file, or a notice that more than one return was filed with your Social Security number.
• Being denied credit unexpectedly, or getting approval letters for credit you never applied for.
• Medical bills or insurance statements for care you did not receive.
• Your phone suddenly losing service, which can mean someone moved your number to another SIM.

How to check, for free

1. Pull your credit reports. You can check your report from Equifax, Experian and TransUnion for free every week at AnnualCreditReport.com. Look at the accounts, the recent inquiries and the list of addresses. An address you never lived at is a red flag.
2. Read your statements line by line for every bank account and card, including small charges. Thieves sometimes test a card with a tiny purchase first.
3. Check account security pages. Your email provider and major accounts usually show recent logins and connected devices. Sign out of anything you do not recognize and change the password.
4. Turn on alerts in your banking and card apps, so you see transactions as they happen.

If you find something: report it at IdentityTheft.gov

The FTC's site, IdentityTheft.gov, is where you report identity theft. You answer questions about what happened, and it creates a free personal recovery plan with the specific next steps for your situation, plus pre-filled letters you can send to businesses and credit bureaus. The FTC also offers reporting in Spanish at RobodeIdentidad.gov.

The usual first steps are:

1. Call the companies where the fraud happened. Ask for their fraud department, explain that someone stole your identity, and ask them to close or freeze the accounts. Change passwords and PINs.
2. Place a fraud alert with one of the three credit bureaus, which must notify the other two, and get your credit reports. See our credit freeze and fraud alert guide.
3. Report it at IdentityTheft.gov. The FTC identity theft report also lets you request an extended fraud alert, which lasts seven years.
4. Consider a credit freeze at all three bureaus to stop new accounts.
5. Fix your credit reports by disputing fraudulent accounts with each bureau, using the letters from your recovery plan.

Some situations need an extra call. For tax identity theft, follow the IRS instructions in any letter you received, and consider an IRS Identity Protection PIN for future years. For a stolen phone number, contact your carrier right away from another phone.

If you only found a breach, with no signs of misuse

That is the most common situation, and it does not need an identity theft report. Follow our step by step breach checklist instead: change reused passwords, turn on two-factor authentication, consider a credit freeze and keep an eye on your accounts. IdentityTheft.gov also has a data breach page with steps for each type of exposed information.

Do you need a paid service to catch identity theft?

No. Everything above is free. The FTC notes that paid credit monitoring and identity monitoring services can alert you to things like new accounts, credit inquiries, address changes or your information appearing on sites where stolen data is traded, and that some include recovery help and insurance. It also notes their limits: credit monitoring will not alert you when money is withdrawn from your bank account or when someone files a tax return with your Social Security number, and you can monitor your credit yourself with free reports.

Some people still prefer to pay so that the watching, and much of the paperwork if something happens, is handled for them. If that is you, compare options carefully. Our free vs paid comparison explains what paying adds.