What is identity theft? Definition + 7 warning signs + credit freeze + 2026 prevention

Identity theft is when someone steals your personal information — Social Security number, credit card, bank account, or login credentials — and uses it to commit fraud, typically for financial gain. The FTC received 6.4 million identity theft reports in 2025, with total losses exceeding $12.7 billion — and that's just the reported cases. The 8 main types are: financial (new accounts in your name), tax (filing a return to claim your refund), medical (using your insurance to get care), employment (using your SSN to get a job), child (using a child's SSN), criminal (giving your name when arrested), synthetic (combining real + fake info to create new identities), and account takeover (hijacking your existing accounts).

The single most effective protection is a credit freeze — free, instant, and reversible. The FTC and all three bureaus (Equifax, Experian, TransUnion) recommend freezing your credit by default; it's free for life (no more $10 fee since 2018). Add 2FA on all financial accounts, use a password manager, file taxes early (before fraudsters can), and review credit reports weekly (free via AnnualCreditReport.com or Experian). If you're a victim: file at IdentityTheft.gov, place a fraud alert, freeze credit, and file an FTC report + police report.

What is identity theft definition?

Identity theft is the unauthorized use of someone else's personal information — typically to commit financial fraud, gain benefits, or evade responsibility. The thief uses stolen information to impersonate the victim.

What information is stolen:

• Highly sensitive (immediate fraud risk): Social Security number, driver's license, passport, financial account numbers
• Sensitive (medium risk): email, phone, address, date of birth, employer
• Less sensitive (low risk alone): name, photo, public records

What identity theft is NOT (often confused):

• ❌ Credit card fraud vs identity theft — if your physical card is stolen and used (not the number, not a new account opened in your name), it's credit card fraud, which has different legal protections (zero liability under FCBA)
• ❌ Data breach vs identity theft — a data breach is when your info is exposed, not necessarily used. Identity theft is actual misuse of your info
• ❌ Account takeover vs identity theft — ATO is a subset of identity theft (hijacking existing accounts); identity theft also includes opening new accounts in your name

What are the 8 types of identity theft?

The 8 main types of identity theft in 2026:

Type	What happens	Detection
Financial	Thief opens credit cards, loans, lines of credit in your name	New accounts on credit report
Tax (IRS)	Thief files a fake return, claims your refund	IRS rejects your return / 5071C letter
Medical	Thief uses your insurance to get treatment, prescriptions	Medical bills for services you didn't get
Employment	Thief uses your SSN to get a job (often undocumented workers)	W-2 / 1099 from unknown employer
Child	Thief uses a child's SSN (often undetected for years)	Child's credit report has accounts
Criminal	Thief gives your name/ID when arrested	You fail a background check / get a court summons
Synthetic	Thief combines real SSN with fake name/DOB to create new identity	Hard to detect; affects credit reports
Account takeover (ATO)	Thief logs into your existing bank/email/social accounts	Unauthorized transactions, password reset emails

Most common: financial (new accounts) — ~45% of cases. Most damaging: synthetic identity theft — used for years to build credit and then "bust out" with maxed cards, often undetected.

What are the warning signs of identity theft?

The 7 most common warning signs:

1. Unexpected bills or collection notices — for accounts you didn't open
2. Denied credit / unexpected credit score drop — someone maxed cards in your name
3. Missing mail or statements — thief changed your address
4. Unauthorized transactions on bank/credit cards — ATO
5. IRS or Social Security letters about income you didn't earn
6. Medical bills for services you didn't receive — medical identity theft
7. Login alerts from unfamiliar devices — ATO attempt

Less obvious signs (synthetic or financial):

• Background check failures when you've never been arrested
• W-2 from an employer you've never worked for
• IRS rejection of your tax return (because someone already filed)
• Social Security statement showing income you didn't earn

Check your credit report weekly at AnnualCreditReport.com (free by federal law) or sign up for a monitoring service. Pull reports from all 3 bureaus at least quarterly. Errors or accounts you don't recognize = red flag.

How do I freeze my credit?

A credit freeze (also called a security freeze) restricts access to your credit report — no one can open new credit in your name, including you. It's free, instant, and reversible at the three bureaus.

How to freeze your credit (5 minutes):

1. Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 1-800-685-1111
2. Experian: experian.com/freeze/center.html or call 1-888-397-3742
3. TransUnion: transunion.com/credit-freeze or call 1-888-909-8872

You'll need to provide:

• Full name, address history (last 2 years)
• SSN
• Date of birth
• Each bureau will give you a PIN or use account-based authentication to lift/freeze in the future

Key points:

• ✅ Credit freeze is free for life (since 2018)
• ✅ Doesn't affect your credit score
• ✅ Doesn't prevent you from using existing credit cards or loans
• ✅ Doesn't prevent background checks (employers can still run them)
• ✅ Temporary lift takes 15 minutes to 1 hour — useful when applying for a mortgage, car loan, or new credit card

Freeze vs fraud alert vs credit lock:

• Credit freeze — strongest protection, free, blocks all new credit applications. Lifting requires PIN.
• Fraud alert — softer, free, requires businesses to verify your identity before opening credit. Lasts 1 year (extendable to 7 with identity theft report). Recommended for victims.
• Credit lock — similar to freeze but mobile-app-controlled. Offered by the bureaus. May have fees. Less legal protection than freeze.

Recommendation: freeze your credit at all 3 bureaus by default. Lift temporarily when you apply for credit (mortgage, car loan, new credit card).

What is a fraud alert?

A fraud alert is a free, lighter-weight protection that requires businesses to verify your identity before opening new credit in your name. It's less restrictive than a freeze.

3 types:

• Initial fraud alert — 1 year, free. Anyone who suspects they may be a victim can place this. Creditors must take "reasonable steps" to verify your identity.
• Extended fraud alert — 7 years, free. Only available to confirmed identity theft victims who file an FTC report.
• Active duty military alert — 1 year, free. For service members deploying overseas.

How to place: contact any one bureau (Equifax, Experian, or TransUnion) — they will share with the other two.

Freeze vs fraud alert:

• Freeze is stronger (blocks ALL new credit applications)
• Fraud alert is less hassle (no PIN needed, less coordination)
• For most people: freeze is the right choice. Fraud alert is for people who plan to apply for credit soon and want a lighter-weight protection.

What is the first thing to do if my identity is stolen?

The 6 immediate steps if you discover identity theft:

1. File an FTC report at IdentityTheft.gov — generates an FTC Identity Theft Report and personalized recovery plan
2. Freeze your credit at all 3 bureaus — Equifax, Experian, TransUnion
3. Place a fraud alert — contact one bureau, they share with the others
4. File a police report — bring your FTC report, government ID, and proof of address; get a copy of the police report number
5. Contact affected companies — banks, credit card issuers, employers; close any accounts opened fraudulently
6. Change passwords + enable 2FA — on all financial, email, and password manager accounts

For specific types:

• Tax identity theft: file Form 14039 (Identity Theft Affidavit) with the IRS
• Medical identity theft: contact the medical provider's fraud department + your health insurer
• Criminal identity theft: contact the court that issued the warrant + state DMV

Timeline: the FTC report takes 10 minutes online. The credit freeze is instant. The fraud alert is same-day. Most identity theft recovery takes 3-12 months to fully resolve.

What is the FTC Identity Theft Report?

The FTC Identity Theft Report is the official federal document that confirms you are a victim of identity theft. It's generated at IdentityTheft.gov after you file an online report.

What it does:

• Provides an FTC report number (your proof of victimization)
• Includes an affidavit you can use with creditors, banks, and police
• Creates a personalized recovery plan with specific actions for your situation
• Removes fraudulent information from your credit report (when combined with credit bureau disputes)
• Required for an extended fraud alert (7 years)

How to file (10 minutes):

1. Go to IdentityTheft.gov
2. Answer questions about what type of theft occurred
3. Provide details (which accounts, dates, financial impact)
4. Download the FTC Identity Theft Report PDF
5. Get your personalized recovery plan via email

Then:

• File a police report (bring FTC report, government ID, proof of address)
• File disputes with the credit bureaus (using the FTC report + bureau dispute forms)
• Contact the IRS (if tax-related) using Form 14039

What is synthetic identity theft?

Synthetic identity theft is the fastest-growing type of identity theft — thieves combine real personal info (often a child's SSN or a deceased person's SSN) with fake information (different name, address, DOB) to create an entirely new "identity." This new identity is used to build credit, then "bust out" — max out all the credit lines and disappear.

Why synthetic identity theft is hard to detect:

• The real SSN may belong to someone who isn't monitoring their credit (child, deceased, elderly)
• The fake name/DOB doesn't match any known person
• Creditors see a "new" customer with no credit history, not a known victim
• The credit-building phase may last 12-24 months before the bust-out

Scale: the Federal Reserve estimated synthetic identity theft caused $20 billion in losses in 2025 — second only to traditional credit card fraud. Children are common targets because their SSNs are clean and credit reports are empty.

How to protect children:

• Check the child's credit report at age 16 (before they apply for college financial aid)
• Freeze credit for minors at all 3 bureaus (most states allow this with parental consent)
• Watch for mail addressed to the child from financial institutions

How can I prevent identity theft in 2026?

The 2026 identity theft prevention checklist:

Prevention	Why it works
Freeze credit at all 3 bureaus	Blocks new account fraud; free + instant
Use a password manager + unique passwords	Stops credential-based ATO
Enable 2FA on financial / email accounts	Blocks 99% of automated ATO
File taxes early (Jan-Feb)	Beats tax-fraud filers to your refund
Monitor credit reports weekly	Early detection (free at AnnualCreditReport.com)
Shred documents with personal info	Prevents physical mail theft
Use USPS Informed Delivery	Detects when someone forwards your mail
Don't carry SSN card in wallet	Limits loss if wallet is stolen
Verify requests for personal info	Phishing is the #1 vector
Review bank/credit statements weekly	Catches small unauthorized charges early
Limit social media personal info	Date of birth, pet names are password reset answers
Use chip + PIN, not chip + signature	Adds PIN layer for card transactions
Freeze child's credit if under 18	Prevents child identity theft

The single most effective step is freezing your credit at all 3 bureaus — it blocks 95% of new-account identity theft. Combine with 2FA on financial accounts to block the other 5%.

How does identity theft happen?

The 6 most common identity theft vectors in 2026:

1. Data breaches (~35% of cases) — leaked SSNs, emails, addresses from major breaches (Equifax 2017, T-Mobile 2021, Change Healthcare 2024 all exposed hundreds of millions of records)
2. Phishing / smishing / vishing (~25%) — fake emails/texts/calls trick you into giving up info
3. Physical theft (~15%) — stolen wallet, mail theft, dumpster diving for unshredded documents
4. Skimming / shimming (~10%) — card skimmers at ATMs/gas pumps, "shimmers" at chip card readers
5. Public Wi-Fi / unencrypted databases (~8%) — info intercepted on unsecured networks or stolen from unsecured databases
6. Inside jobs (~5%) — employees with access to customer data sell it on the dark web

Dark web marketplaces sell "fullz" (full identity packages: SSN + DOB + address + DL number + credit card) for $30-$150. Children's SSNs go for $1-$5 because they're less monitored. Credit cards alone go for $5-$50.

How long does identity theft recovery take?

Identity theft recovery typically takes 3-12 months, depending on the type and extent. Complex cases (synthetic ID theft, multi-account fraud) can take 1-3 years.

Recovery timeline by type:

Type	Typical recovery time
Credit card fraud	1-3 months (zero liability under FCBA)
New account fraud	3-12 months
Tax identity theft	3-9 months (IRS processing)
Medical identity theft	6-18 months
Synthetic identity theft	12-36 months
Child identity theft	6-18 months

Tips to speed recovery:

• File the FTC report immediately (IdentityTheft.gov)
• Document everything in writing (send disputes via certified mail)
• Keep a log of all calls (date, name, what was discussed)
• Escalate to the CFPB (Consumer Financial Protection Bureau) if a creditor/credit bureau doesn't respond within 30 days
• Consider an identity theft restoration service (LexisNexis, LifeLock, IdentityForce) if recovery is complex

What is the bottom line on identity theft?

Identity theft affected 6.4 million Americans in 2025 with $12.7 billion in losses — and the most effective defense is free: freeze your credit at all 3 bureaus. Combine with 2FA on financial accounts, a password manager, weekly credit monitoring, and early tax filing. If victimized: file at IdentityTheft.gov, freeze credit, place a fraud alert, and contact affected companies. The 8 main types are financial, tax, medical, employment, child, criminal, synthetic, and ATO — all require slightly different recovery paths. The future is passwordless/passkey authentication, which eliminates most credential-based identity theft.

For related security topics, see our What is 2FA? page (2FA blocks account takeover), What is phishing? page (25% of identity theft starts with phishing), What is a data breach? page (breaches are the source of stolen data), What is malware? page (info-stealer malware harvests identity data), and What is a VPN? page (VPN doesn't prevent identity theft but reduces some attack surface).