Help people recognize possible identity theft and start a documented recovery process.
Identity theft can appear as a transaction, new account, debt notice, benefit problem, tax filing, medical record, address change, missing mail, or account recovery event you did not initiate. Verify the signal independently before disclosing more information, then contain the highest-impact harm.
Look across identity systems
Review financial statements, credit information available through official channels, tax and benefit correspondence, health explanations of benefits, utility or phone accounts, government notices, mail changes, and email security events. One sign may be an error; multiple related signs raise urgency.
Recognize meaningful indicators
- Charges, withdrawals, transfers, or payment accounts you do not recognize
- New credit, hard inquiries, debts, or collection contacts unrelated to you
- Tax return, refund, employment, or benefit activity you did not initiate
- Medical service or insurance record that is not yours
- Missing mail, changed address, phone port, or new utility account
- Password reset, recovery-detail change, or identity-verification request you did not start
Respond through verified channels
| Signal | Verify with | Immediate containment |
|---|---|---|
| Financial transaction | Number on card or official app | Block or dispute as provider directs |
| Credit account | Official bureau and creditor channel | Fraud alert or freeze as appropriate |
| Government or benefit issue | Agency’s independently found contact | Follow agency reporting and recovery route |
Start the recovery process
- Preserve the notice and verify independently.
- Contact the affected institution promptly.
- Secure email, phone, and financial accounts.
- Use the official reporting resource for your country.
- Correct records and track each case.
- Monitor for related misuse and follow up in writing.
Avoid secondary fraud
- Paying a caller who promises to erase identity theft
- Giving a verification code to someone who contacted you
- Clicking the suspicious alert to reach support
- Discarding case numbers and proof of correction
Build a recovery file
Keep the original signal, dates, institutions, account fragments only as needed, contacts, report and case numbers, letters, disputes, freezes or alerts, replacement records, delivery proof, expenses, and next follow-up. Protect the file as sensitive identity information.
Continue with the next decision
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- IdentityTheft.gov Official U.S. identity-theft reporting and personal recovery-plan resource.