Someone is using your identity

What this means

Identity theft is not one bad charge on your own card. That has its own playbook: Scammed or fraudulent bank charge. This is someone using your name and identifying details to open something new, or to file, work, or get treatment as you.

A letter from a company you never joined, a debt you do not recognise, a tax transcript that is not yours, or a benefits claim you did not make are all this incident. A data breach notice is the earlier stage, when your details leaked and nobody has misused them yet. If misuse has started, you are here.

The steps below split by country on purpose. The credit-bureau tools are a United States system. Other countries have different agencies, and inventing a local equivalent would send you to the wrong office.

Warning signs

• A lender, insurer, or shop you do not use writes to you about an account.
• Debt collectors call about a bill that is not yours.
• Your credit report, where you have one, lists an account or an address you do not recognise.
• A tax authority says a return was already filed, or an employer you never worked for shows up on your record.
• You are refused credit or a phone contract for reasons that do not match your own history.
• Medical bills arrive for care you did not receive.

Recover now

First 15 minutes

1. Call the company where the fraud is already happening. IdentityTheft.gov, the US Federal Trade Commission’s site, says to call the fraud department, say your identity was stolen, and ask them to close or freeze those accounts so new charges need your agreement. Change the logins and PINs on accounts that are actually yours.
2. Use a phone number you look up yourself. A number printed on the strange letter can belong to the person who opened the account. Use the number on a statement you already trust, or the company’s own site typed by you.
3. If money left an account you do own, call that bank as well, on the number on your card. Closing a fake account does not reverse a transfer from your real one.
4. Write down names, times, and what each person said. You will repeat this story to every company and, if you choose, to the police.

Today, in the United States

IdentityTheft.gov lays out a set order. The credit-report parts apply in the US.

1. Place a fraud alert with one of the three nationwide credit bureaus. That bureau must tell the other two. The alert is free and lasts one year, and you can renew it. With an alert on the file, a business has to verify it is you before it issues new credit in your name. IdentityTheft.gov lists Experian at 1-888-397-3742, TransUnion at 1-888-909-8872, and Equifax at 1-800-685-1111.
2. Get your credit reports and read them. AnnualCreditReport.com is the official place, or call 1-877-322-8228. The FTC says you can check those reports every week for free. Note every account or enquiry you do not recognise. That list is what you report next.
3. Report it at IdentityTheft.gov (or call 1-877-438-4338). The site builds an Identity Theft Report and a recovery plan from what you enter. The FTC says that report is what you show businesses, and that it comes with specific rights. If you do not create an account on the site, print or save the report before you leave the page. They say you cannot get back to it afterwards.
4. Decide on a credit freeze as well as the alert. A freeze is also free. It lasts until you lift it. While it is on, new credit in your name stops, including credit you want, until you lift the freeze at the bureau the lender will ask. You place it separately at Equifax, Experian, and TransUnion. The US Consumer Financial Protection Bureau says a phone or online request must be placed within one business day, and a mailed request within three business days. A freeze does not change your credit score. A paid “credit lock” is not the same product. The CFPB says locks are no more effective than a freeze you have a right to for free.

5. Close the new accounts with the Identity Theft Report in hand. Ask each business for a letter that says the account is not yours, you are not liable, and it will be removed from your credit report. Keep the letter. The business may want the FTC report or its own form before it does this.
6. A police report is optional in the US, and sometimes useful. IdentityTheft.gov says you may file locally. Bring the FTC report, a government photo ID, proof of address, and whatever bills or letters you have. Ask for a copy of the police report.
7. If the misuse is a tax return, a job, or medical care, say so on IdentityTheft.gov. They point those cases at separate steps. Do not assume the credit freeze covers a fraudulent tax filing. The IRS is a different office from Equifax.

Today, outside the United States

The three US bureaus and IdentityTheft.gov do not run your credit file. Call the companies where the fake accounts were opened, then report it to the police where you live and to the authority your country uses for this kind of fraud. Banks in many places still have a fraud desk, and the reporting rules differ. Use Scammed or fraudulent bank charge when the money moved from your own account, including the country block on that page.

Verify recovery

• Each company that opened a fake account has confirmed in writing that the account is closed and is not yours.
• In the US, your latest reports from all three bureaus show no new accounts you do not recognise, and the freeze or the fraud alert is visible.
• Your own bank logins, email, and phone number still belong to you. Identity theft often starts by taking your email or your phone number.

After recovery

Keep the letters. A closed account can reappear on a report months later, and the letter is how you dispute it again. In the US, keep checking AnnualCreditReport.com. If a new account shows up, you already know the path: the company, then an update to the FTC report.

Prepare now

Before anything leaks

• In the US, a credit freeze is already on at Equifax, Experian, and TransUnion, and you know how to lift one bureau without lifting all three.
• Your email uses its own password and a second factor, because password resets are how a leaked identity becomes a live account. See Personal email account hacked.
• You do not reuse the password from your bank anywhere else.

Paper and tax

• You know where last year’s tax return is, so a surprise letter from the tax office is easy to compare.
• Mail that includes account numbers is not left in an open box. Shredding is dull. It is also the whole control.

Practice

• You have opened your credit report once, or the equivalent statement from your bank, and you know what your real accounts look like.
• The fraud number for your main bank is stored somewhere other than the banking app.

Common mistakes

• Only disputing the charge on your real card. New accounts in your name keep billing until each company closes them.
• Buying a credit lock and skipping the free freeze. The CFPB says the paid lock is not stronger.
• Freezing one US bureau. Lenders pull different files. One freeze leaves two doors open.
• Calling the number on the scammer’s letter. You can end up “confirming” your identity to the person who stole it.
• Waiting for a perfect police report before you call the lender. IdentityTheft.gov puts the company call first.

Sources

• IdentityTheft.gov: Recovery steps
• IdentityTheft.gov: When information is lost or exposed
• CFPB: What is a credit freeze?
• USAGov: Place or lift a security freeze
• CFPB: What to do if you are a victim of identity theft