How to Tell If Your Identity Has Been Stolen, and What to Do Next

Last updated: November 5, 2026 · Steps checked against the FTC, IdentityTheft.gov, and AnnualCreditReport.com (sources at the bottom)

We may earn a commission if you buy through links here — it never changes our picks.

Identity theft is when someone uses your personal or financial information without your permission. That is the Federal Trade Commission's definition, and the FTC's list of what thieves do with it is worth reading once: open credit cards in your name, drain bank accounts, steal your tax refund, get medical care under your name, even pretend to be you if they are arrested. The materials are your name, address, and date of birth, and above all your Social Security number, the one identifier that cannot be changed like a password.

That is what makes identity theft different from a hacked account. A stolen password is a problem inside one account, and changing it ends the problem. Identity theft is someone becoming you on paper, at lenders and agencies that have never met you. The fix is different too, and almost all of it is free: free credit reports, a free credit freeze, and a free federal recovery plan. This guide runs them in order.

If you arrived here from a breach notification, start with our data breach guide for the password side of the cleanup, then come back. And one calming fact first: most single warning signs turn out to be bank errors or forgotten subscriptions. A sign is a reason to run the free checks below, not a verdict.

Before you start

What you need

About an hour, in one sitting or split up. The three credit reports take fifteen minutes or so, each freeze about ten.
Your own details, for the bureaus' identity questions. Freezes and reports are protected by questions about your address history and accounts. You will type sensitive information, so only ever type it on official sites you reached by typing the address yourself.
A place to save confirmations. A folder on your computer or a paper one. Every freeze confirmation, PIN, and report date goes in it. Recovery runs on paperwork.

The warning signs

Identity theft rarely announces itself with one dramatic event. It surfaces as small wrong things in your financial life. The FTC's detection advice amounts to watching four places: your bills, your bank statements, your mail, and your credit reports. The signs below are the ones the FTC names most often:

Money moves you cannot explain. Withdrawals from your bank account that you did not make, or charges for things you did not buy. Thieves often test stolen details with a tiny charge first, so a small unfamiliar charge counts too.
Accounts and bills that are not yours. A bill you did not expect, a welcome letter from a lender you never contacted, or debt collectors calling about debts you do not recognize. A collector calling is often the first visible sign: an account in your name has already gone unpaid.
Your mail goes wrong. A bill you owe and expect stops arriving. That can mean someone changed the billing address on the account, which is how thieves hide an account from its owner. Mail about accounts you never opened points the same direction.
Trouble with officials. The IRS notifies you that a tax return was already filed in your name, or that you have income from an employer you never worked for. A medical provider bills you for care you did not get, or your health plan rejects a claim because your benefits are used up. You are turned down for credit you expected to get.

Any one of these can have a boring explanation: a charge posted wrong, a subscription renewing under a name you do not recognize, a lost bill. The signs earn a check, and the check is the free one in the next section.

Step 1: check all three credit reports

Two terms, defined once. A credit bureau (also called a credit reporting company) is a firm that collects your borrowing history into a file. There are three nationwide ones: Equifax, Experian, and TransUnion. A credit report is your file at one bureau: the accounts in your name, who has asked to see the file, and your payment history. A fraudulent account has to land in one of these files to do its damage, which makes the reports your best detection tool.

Go to AnnualCreditReport.com, by typing it yourself

This is the central site the three bureaus run together for the free reports federal law entitles you to. One form requests your reports from one, two, or all three bureaus. Type the address yourself rather than following an ad or a search result: lookalike "free credit report" sites exist to sell subscriptions, and the real one never asks for a credit card. The site also states that it does not keep your personal data or use it for marketing.

Request all three reports

Ask for Equifax, Experian, and TransUnion in the same visit. The three files are similar but not identical, because lenders do not all report to all three. A fraudulent account can easily appear on one report and not the others. And to settle a common worry: checking your own reports here does not affect your credit scores, as the site itself states.

Prove you are you, and save the reports

Before showing a report, the site asks questions only you should be able to answer, drawn from your own history: past addresses, a loan amount, a lender you have used. Answer them, then download or print each report for your folder. If the online questions cannot verify you, the site offers phone and mail routes instead. Use them rather than giving up.

Read each report in this order

Personal information. Names, spellings, and addresses you do not recognize. An unfamiliar address can be where a thief receives mail for accounts in your name.
Accounts. Every card, loan, and account listed. Anything you did not open is a finding. Note the creditor's name and the date opened.
Inquiries. The list of companies that pulled your report. An inquiry from a lender you never contacted usually means someone applied for credit in your name, whether or not an account followed.
Collections and negative items. Debts sent to collections that you do not recognize are the report version of those collector calls.

You should now see: either three reports that match your real life, which answers the question, or a written list of what is wrong and which bureau shows it. That list is the raw material for steps 2 and 3, and you can pull fresh reports every week, free, which turns this check into a habit below.

Step 2: freeze your credit

A credit freeze (the bureaus also call it a security freeze) restricts access to your credit report. Because lenders check the report before approving a new account, a freeze means nobody can open new credit in your name while it is in place, including you, until you lift it. Four facts the FTC states plainly: a freeze is free to place and lift, it does not affect your credit score, it does not touch accounts you already have, and it stays until you remove it. The one catch: a freeze at one bureau does nothing to the other two, so this step is the same job done three times.

Freeze at Equifax

Use the route the FTC lists: equifax.com/personal/credit-report-services, or call 1-800-685-1111. Online, you create a free account, verify your identity, and place the freeze. Keep the confirmation and any PIN or password the bureau gives you. You will need them to lift the freeze later.

Freeze at Experian

Same shape: experian.com/help, or call 1-888-397-3742. Create the free account or use the phone route, verify it is you, place the freeze, and file the confirmation with the first one. Resist the upsell screens on the way through. The freeze itself costs nothing, whatever else the site offers.

Freeze at TransUnion

And once more: transunion.com/credit-help, or call 1-888-909-8872. Only now is the job done, because a lender can pull from any one of the three, and the ones you skip are exactly where a thief's application would still succeed.

Know how lifting works before you need it

A freeze is not a life sentence on your own credit. When you apply for a card, a loan, or an apartment, ask which bureau the lender will check and lift the freeze at that bureau temporarily. Timing is set by law: a freeze requested online or by phone must be placed within one business day, a request to lift one made the same way must be handled within one hour, and mail requests get three business days. Keep your bureau passwords and PINs in your password manager, because whoever holds them holds the freeze.

You should now see: three confirmations, one per bureau, and new-account fraud in your name is blocked at the door most lenders use.

Freeze or fraud alert: the difference

The other tool you will see mentioned is a fraud alert, and the two are easy to confuse because both are free and both live on your credit reports. They work differently:

What it does. A freeze blocks access: lenders cannot see your report at all, so the application stops. An alert leaves the report visible and instead instructs businesses to verify your identity before opening a new account, which usually means contacting you first.
Who you contact. A freeze must be placed with each bureau separately, three contacts. An alert takes one contact: the bureau you reach is required to tell the other two.
How long it lasts. A freeze lasts until you lift it. An initial fraud alert lasts one year and can be renewed. Confirmed identity theft victims can get an extended alert lasting seven years, which requires the FTC Identity Theft Report or a police report described in the next section.
What neither does. Neither tool stops someone misusing an account you already have. Both guard the door marked "new accounts" only. Existing cards and bank accounts still need their statements checked.

Which should you place? If theft is confirmed or your Social Security number was exposed, the freeze is the stronger default, and it costs nothing but the three contacts. If you only suspect something and expect to apply for credit yourself soon, an alert keeps applications moving while adding a verification step, and you can freeze later if the suspicion firms up. The two also stack: the FTC notes you may place a fraud alert even with a freeze in place. When in doubt, freeze. Lifting it for a genuine application takes an hour at worst.

Step 3: file at IdentityTheft.gov

Freezing stops tomorrow's damage. This step repairs yesterday's: getting fraudulent accounts officially recorded as not yours, with paperwork businesses and bureaus are set up to act on. The FTC runs the whole process at IdentityTheft.gov, also free.

Go to IdentityTheft.gov and describe what happened

Type the address yourself, as always. The site asks what was taken and what has gone wrong: the accounts you found in step 1, the charges, the collector calls. Be specific where you can, because the plan is built from your answers. If you would rather talk, the same report can be made by phone at 1-877-438-4338.

Download the two documents it generates

Your answers produce an FTC Identity Theft Report, your official statement that your identity was stolen, and a personal recovery plan: a step-by-step set of actions for your exact situation, with pre-filled letters and forms addressed to the credit bureaus, businesses, and debt collectors you need to contact. Save and print both. These go in the folder with your freeze confirmations.

Work the plan, and keep the paper trail

Send the letters the plan prepares, to the addresses it gives, and write down what you sent and when. The Identity Theft Report is what turns "that account is not mine" from your word into a formal dispute, and it is also the document that unlocks the seven-year extended fraud alert from the previous section. You can return to the site to update your plan and track your progress as accounts get closed and reports get corrected.

Do not skip this step because one company already fixed one account. A bank closing a fraudulent card solves that card. The report and plan are what reach the other bureaus, creditors, and collectors, and they are your proof if the same thief's work surfaces again in six months.

Keep watch afterward: monitoring

Recovery is a project with an end. Watching is a habit without one, because the details identity theft uses, your name, address, and Social Security number, do not expire. The free layer comes first, and for many people it is enough:

Rotate your free credit reports. Pulling reports at AnnualCreditReport.com is free every week. Checking one bureau's report regularly, in rotation, means a new fraudulent account shows up within weeks, not at the next annual glance.
Renew alerts on schedule. If you placed a fraud alert rather than a freeze, note its one-year expiry and renew it. A freeze needs no renewal, which is one more reason it is the stronger default.
Accept free monitoring when it is offered. After a serious breach, companies often offer free credit monitoring. The FTC's advice is to take it. It watches your reports and flags new activity at no cost to you.

Paid services add two things, and the FTC's guide to monitoring services describes both honestly. Identity monitoring watches places beyond the credit reports, including websites where stolen information is traded (dark web surveillance, in the marketing language), change-of-address requests, and court records. Recovery services and identity theft insurance help if it happens again: counselors who help with the letters and calls, and insurance toward out-of-pocket recovery costs such as lost wages and legal fees. The FTC's limits are worth repeating: insurance generally does not reimburse money that was stolen, and credit monitoring will not flag a bank withdrawal or a tax return filed in your name. Monitoring detects. The freeze is what prevents.

Our pick for the watching layer Coveron

Coveron

If you would rather pay for the watching than run the rotation, our pick is Coveron, an identity protection service from Nord Security, the company behind NordVPN. It combines credit monitoring with dark web surveillance, so your details are flagged if they surface where stolen data is traded, and identity theft recovery support, including cyber extortion and online fraud insurance, for if the worst happens anyway. It is a US service, and its insurance benefits are not available in New York. Be clear about the division of labor, though: Coveron watches, it does not block. Keep the freeze from step 2 in place whether or not you pay for monitoring.

Visit Coveron

Common mistakes

Freezing at one bureau and stopping. Three bureaus, three freezes. A lender can use any of them, so two out of three leaves the door a third open.
Paying to freeze, or buying a "credit lock" instead. A freeze is a free legal right. If a site asks for a card number to freeze your credit, you are on the wrong site or being sold a different, paid product.
Reaching AnnualCreditReport.com through an ad or an email link. Type it. The lookalike sites are built to catch exactly the people who are already worried.
Expecting a freeze to protect existing accounts. It blocks new accounts only. A stolen card number still works until the card is replaced.
Skipping the FTC report because one bank fixed one account. The report is what reaches everyone else, and what unlocks the extended fraud alert. Fifteen minutes of forms buys the strongest paperwork available to you.
Treating monitoring as prevention. An alert that a new account appeared is useful, and it is still after the fact. The freeze is the prevention. Monitoring is the smoke alarm next to its locked door.

The whole job, as a checklist

Summary

Know the signs: unexplained withdrawals or charges, bills and accounts that are not yours, mail that stops arriving, trouble from the IRS or a health plan.
Type AnnualCreditReport.com yourself and pull all three credit reports, free. Read personal information, accounts, inquiries, and collections, in that order.
Freeze your credit at Equifax, Experian, and TransUnion separately. Free, no effect on your score, stays until you lift it.
A fraud alert is the lighter tool: one contact instead of three, lasts one year, and tells businesses to verify before opening accounts. A freeze is the stronger default.
File at IdentityTheft.gov and download your Identity Theft Report and recovery plan. Work the plan's letters and keep every confirmation.
Keep watching: rotate the free weekly reports, renew alerts before they lapse, and accept free monitoring when a breach offers it.
If you pay for monitoring, it is the watching layer only. The freeze stays in place regardless.

Where these steps come from

The warning signs, freeze and fraud alert rules, and recovery process were checked against the FTC's consumer guidance and the sites it points to. The monitoring pick's features were checked against the provider's official site. All checked in November 2026.