Protecting Yourself from Identity Theft

Identity theft is when someone uses your personal information — name, Social Security number, date of birth, account numbers — to pretend to be you. They might open credit cards, take out loans, file fake tax returns, or drain a bank account.

If this has happened to you, please hear this clearly first: you are not to blame. Identity theft is a crime committed against you. The Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), and federal law all treat victims as victims. There is a clear, free recovery process — and you have rights.

This is a plain-English guide to lowering your risk and to recovering if it has already happened. For a feel for how a clean credit profile supports your score, our credit score calculator can help. For more vocabulary, see APR and interest rate, and the Learn hub for related topics.

What identity thieves usually do

The FTC at ftc.gov and the CFPB at consumerfinance.gov describe a few common patterns:

• Open new credit cards or take out loans in your name.
• File a fake tax return to claim your refund.
• Use your insurance card to get medical care.
• Open utility, phone, or rental accounts.
• Empty bank or investment accounts using stolen passwords.

It is common, and there is a system in place to handle it.

What thieves are after

A short list of the most-targeted information:

• Social Security number. The single most damaging thing to lose.
• Date of birth and full name.
• Driver's license or state ID number.
• Credit card and bank account numbers.
• Online passwords, especially for email.
• Medical insurance ID.
• IRS Identity Protection PIN, if you have one.

Step 1 — Lower the risk before something happens

The FTC and CFPB publish the same plain-English checklist for prevention:

• Use strong, unique passwords for every important account, especially email and bank. A password manager is the easiest way to actually do this.
• Turn on two-factor authentication (2FA) wherever it is offered, especially for email, bank, brokerage, IRS, and Social Security accounts.
• Freeze your credit at all three bureaus. It is free, and it stops new accounts from being opened in your name. You temporarily lift the freeze when you actually want a new loan or card.
• Place an IRS Identity Protection PIN on your tax filing at irs.gov. It blocks fake returns from being filed in your name.
• Shred anything with personal information before throwing it away.
• Be careful on public Wi-Fi. Avoid logging into financial accounts on networks you do not control.
• Check your credit reports at annualcreditreport.com regularly — free, weekly, from all three bureaus per recent updates.

How to freeze your credit (in plain English)

A credit freeze locks new lenders out of your credit file. It is the single most effective free protection.

You place the freeze separately at each bureau:

• Equifax — equifax.com/personal/credit-report-services/
• Experian — experian.com/freeze/center.html
• TransUnion — transunion.com/credit-freeze

Each takes a few minutes. You will get a PIN or login. When you actually want to apply for a new loan or card, you "thaw" the freeze for a window of time, then it locks again. The CFPB has a step-by-step guide at consumerfinance.gov.

A fraud alert is a lighter version that tells creditors to verify your identity before opening credit. It is also free. A freeze is stronger.

Step 2 — If you suspect identity theft, act fast

If you spot an account you did not open, a charge you did not make, or a tax notice you did not expect:

1. Go to identitytheft.gov. This is the FTC's official one-stop site. It walks you through a personalized recovery plan and creates an FTC Identity Theft Report you can use as legal proof.
2. Place a free fraud alert at one of the three bureaus. The bureau has to share it with the others.
3. Place a free credit freeze at all three bureaus.
4. Pull your free credit reports at annualcreditreport.com and look for accounts you do not recognize.

These four steps are free and can be done in under an hour.

Step 3 — Report the crime where it matters

The recovery plan from identitytheft.gov walks you through these in order:

• File a report with your local police, especially if you know the thief or have lost a physical wallet.
• Contact each company where a fraudulent account was opened. They are required to close the account and remove the charges from your bill.
• Contact the credit bureaus to block the fraudulent accounts using your FTC Identity Theft Report.
• Contact the IRS if a tax return was filed in your name. Use the IRS identity theft tools at irs.gov.
• Contact the SSA at ssa.gov if your Social Security number was misused.
• Contact the FCC and your phone carrier if your number was ported away (a SIM-swap attack).

What you are not responsible for

Federal consumer law gives you strong protections:

• Credit cards — under the Fair Credit Billing Act, your liability for unauthorized charges is capped at $50 (and most issuers waive even that).
• Debit cards — under the Electronic Fund Transfer Act, liability depends on how fast you report it. Reporting within two business days caps your liability at $50.
• New accounts opened by a thief — you are not legally responsible for an account you did not authorize. Your FTC Identity Theft Report and a written dispute are the keys to clearing them.
• Fake tax returns — the IRS process is set up to make sure you still receive any refund you are owed.

The CFPB and FTC both repeat this clearly: victims are not at fault, and the cleanup process is on the companies, not you.

Common scams that lead to identity theft

A few patterns the FTC sees over and over:

• Phishing emails that look like they come from your bank, the IRS, or a delivery service.
• Phone calls claiming to be the IRS or SSA demanding immediate payment. The real IRS does not call demanding payment.
• Fake tech support pop-ups asking for remote access.
• Romance scams that escalate into requests for money.
• Job offer scams that ask for your Social Security number before you are hired.
• Data breaches at companies that had your information on file.

Special note for parents and minors

Children's identities are sometimes stolen because the thief can use a clean Social Security number for years. The CFPB and FTC recommend:

• Placing a free credit freeze on a child's credit file with all three bureaus.
• Checking once a year for a credit file in the child's name (there should not be one).
• Teaching kids not to share their Social Security number unnecessarily.

A note on services

You do not need to pay a "credit monitoring" or "ID protection" service. Everything described above — credit freezes, fraud alerts, free credit reports, the IRS PIN, the FTC recovery plan — is free. Paid services may offer extra convenience, but the free tools are the legal foundation.

Free help

• identitytheft.gov — the FTC's one-stop recovery site.
• The CFPB consumer complaint tool at consumerfinance.gov/complaint.
• USA.gov at usa.gov — direct links to every relevant federal agency.
• Your state Attorney General's consumer protection office.
• A non-profit credit counselor approved by the U.S. Trustee Program.

A note on advice

This is general information, not legal advice. If identity theft has caused you measurable financial harm — denied loans, lost wages chasing the mess, or worse — a consumer rights attorney can walk through your options under the Fair Credit Reporting Act and the Fair Credit Billing Act.

Numbers and rules in this article change every year — always check the latest from the IRS, CFPB, and your state's consumer protection department.