Your Identity Is Under Attack.
Here's How to Fight Back.
Every 22 seconds, someone becomes a victim of identity theft. With 1.4 million cases reported to the FTC annually and losses totaling billions of dollars, this isn't just a statistic — it could be your reality tomorrow.
But here's the good news: Armed with the right knowledge and tools, you can dramatically reduce your risk and know exactly what to do if the worst happens.
Understanding Identity Theft
Identity theft occurs when criminals wrongfully obtain and use your personal information — Social Security numbers, credit card details, bank account information, medical records, or other sensitive data — for fraudulent purposes.
The Real Cost of Identity Theft
Beyond the financial losses, victims face:
- Damaged credit scores that can take years to repair
- Emotional distress including anxiety, anger, and feelings of violation
- Stolen tax refunds causing delays in legitimate refunds
- Compromised medical records that can lead to dangerous misdiagnoses
- False criminal records created when thieves use your identity during arrests
- Employment difficulties due to damaged credit or background check issues
- Relationship strain as families deal with the stress and financial impact
Types of Identity Theft
Understanding the different types helps you recognize threats and protect your specific vulnerabilities.
1 Financial Identity Theft 31% of all reported cases
The most common form where thieves access your financial accounts or open new ones in your name.
New Account Fraud
- Opening credit cards in your name
- Taking out loans or mortgages
- Opening bank accounts for money laundering
- Financing vehicles or property
Existing Account Fraud
- Unauthorized charges on your credit cards
- Withdrawals from your bank accounts
- Balance transfers you didn't authorize
- Changes to account information
Account Takeover
- Changing passwords and locking you out
- Updating contact information
- Requesting new cards
- Emptying checking and savings accounts
2 Government Benefits Fraud 395,948 reported cases — #1 reported type
Surged during the pandemic and remains the #1 reported type of identity theft.
- Tax Identity Theft: Filing fraudulent returns to steal your refund
- Social Security Fraud: Claiming benefits in your name
- Unemployment Fraud: Filing claims using your employment history
- Government Loan Fraud: Obtaining disaster relief, student loans, or business loans
- Passport Fraud: Obtaining travel documents in your name
3 Medical Identity Theft Increased 30% in 2024
When criminals use your information to obtain healthcare services, prescriptions, or file insurance claims.
- Incorrect medical records with another person's diagnoses, medications, or treatments
- Exhausted insurance benefits leaving you unable to get care
- Denied coverage due to pre-existing conditions you don't actually have
- Substantial medical bills for services you never received
- Dangerous misdiagnoses if doctors rely on contaminated records
4 Synthetic Identity Theft Fastest-growing, hardest to detect
Combines real and fake information to create entirely new identities. Thieves use a real Social Security number (often from children), combine it with fictitious names and addresses, build credit slowly over months or years, then max out all credit lines and disappear.
- Takes an average of 4–6 years to detect
- Victims often don't know for decades (especially child SSNs)
- Accounts for up to 20% of credit losses for some lenders
5 Child Identity Theft 915,000 cases in 2022
Children's identities are gold mines for criminals: clean credit history, theft can go undetected for 10–18 years, and parents rarely monitor children's credit.
- Family members using a child's SSN for utilities or credit
- Data breaches at schools or pediatric offices
- Stolen information from social media posts about births
- Dark web purchases of children's information
- Children in homes earning $150K+ face greater risk
6 Criminal Identity Theft Creates false criminal records in your name
When someone uses your identity during an arrest or investigation.
- Warrants issued in your name
- Failed background checks
- Denied employment opportunities
- Arrest if stopped by police
- Court appearances to prove innocence
- Years to clear your record
7 Employment Identity Theft Discovered through IRS notices
Criminals use your identity to obtain jobs, particularly if they cannot legally work, have criminal records, or want to avoid wage garnishment.
You may discover this through:
- IRS notices about unreported income
- Denial of unemployment benefits (showing you're employed)
- Unknown employers on your Social Security statement
- Unexpected tax bills for income you didn't earn
8 Account Takeover Fraud Surged 354% between 2019–2024
Criminals gain access to your existing accounts. Targets include email (gateway to everything else), social media, banking, cryptocurrency wallets, retail accounts, and airline/hotel loyalty programs.
9 Cryptocurrency Identity Theft New frontier as crypto adoption grows
- SIM swapping to bypass 2FA on crypto exchanges
- Phishing for wallet credentials
- Creating accounts on exchanges using your identity
- NFT and DeFi platform fraud
- Cryptojacking using your computing resources
Warning Signs of Identity Theft
Early detection is critical. The sooner you catch identity theft, the less damage occurs and the faster recovery will be.
Financial Red Flags
- Unexpected credit score changes — drops without explanation
- Unfamiliar accounts on credit reports
- Credit applications denied despite good credit
- Missing bills or statements
- Unexplained withdrawals or charges
- Debt collection calls about unknown accounts
- Credit limit decreases without notification
- Maxed out credit cards you didn't use
Digital & Communication Warnings
- Data breach notifications involving your info
- Password reset emails you didn't request
- 2FA codes arriving when you're not logging in
- Locked out of accounts — passwords don't work
- Emails about account changes you didn't authorize
- Unfamiliar devices in account security settings
- Social media friend requests from people you're already friends with (clone accounts)
Mail & Document Issues
- Missing expected bills or statements
- Receiving credit cards you didn't apply for
- IRS notices about returns you didn't file
- Medical bills for services you didn't receive
- Court summons for unknown matters
- Job verification requests from unknown employers
Government & Tax Alerts
- Tax return rejected — one was already filed
- IRS notice about unreported income
- Social Security benefits reduced
- Unemployment claim filed when you're employed
- Medicare benefits exhausted from unknown services
Healthcare Indicators
- Medical bills for procedures you didn't have
- Insurance EOBs for unfamiliar services
- Denied insurance — you've "reached your limit"
- Medical records showing incorrect information
- Prescription rejections — already filled
Prevention Strategies
Prevention is your strongest defense. These strategies create layers of protection that make you a harder target.
Protect Your Personal Information
Physical Security at Home
- Store important documents in a locked safe or filing cabinet
- Keep only essential cards in your wallet
- Shred documents containing personal information before disposal
- Check your mailbox promptly (or use a locking mailbox)
- Consider a P.O. Box for sensitive mail
Documents to Secure
- Social Security cards
- Birth certificates
- Passports
- Tax returns (keep 7 years)
- Bank statements
- Medical records
- Insurance cards
- Property deeds
Documents to Shred
- Credit card offers
- Bank statements older than 1 year
- Expired credit/debit cards
- Insurance forms
- Medical bills and EOBs
- Anything with account numbers
- Receipts with full card numbers
Information Sharing Rules
Never share without verification:
- Social Security number (give only when legally required)
- Full credit card numbers over phone/email
- Bank account numbers
- Mother's maiden name or security question answers
- Passwords or PINs
Opt Out of Data Sharing
- Pre-approved credit offers: Call 1-888-5-OPTOUT (1-888-567-8688)
- Direct marketing lists: Visit DMAchoice.org
- People search sites: Use a data broker removal service
- Social media advertising: Review privacy settings on all platforms
Secure Your Digital Life
Strong Password Practices
- Minimum 12 characters (16+ is better)
- Combine uppercase, lowercase, numbers, and symbols
- Use unique passwords for every account
- Never reuse passwords across sites
Coffee-Tiger-Mountain-92-Blue!Easier to remember, harder to crack.
Password management: Use a password manager (Bitwarden, 1Password, Dashlane, or LastPass). Enable the generator for new accounts. Store the master password securely — never digitally.
Two-Factor Authentication (2FA)
Even if criminals steal your password, 2FA blocks 99.9% of account takeover attempts.
Physical device required. Immune to phishing and SIM swapping.
Time-based codes. Works offline. Not vulnerable to SIM swapping.
Better than nothing but vulnerable to SIM swapping. Use only if other options unavailable.
Enable 2FA immediately on: Email accounts, banking, cryptocurrency exchanges, social media, cloud storage, password managers, healthcare portals, government accounts.
Phishing Protection
Phishing = fraudulent communications designed to steal your information.
Common Tactics
- Urgent language ("Your account will be closed!")
- Threatening consequences
- Too-good-to-be-true offers
- Suspicious sender addresses
- Generic greetings ("Dear Customer")
- Pressure to act immediately
How to Verify
- Never click links in unsolicited emails
- Go directly to the website by typing the URL
- Call the company using their official number
- Hover over links to preview the actual URL
- Check sender address carefully (paypa1.com ≠ paypal.com)
Smishing (SMS phishing) is surging: Package delivery scams, bank "fraud alerts" with malicious links, IRS/SSA texts, "your account is locked" messages.
Device Security
Computers
- Install antivirus software
- Enable automatic updates
- Use a firewall
- Encrypt your hard drive
- Lock your screen when away
Smartphones
- Use strong passcodes (6+ digits) or biometric locks
- Enable automatic updates
- Install apps only from official stores
- Review app permissions regularly
- Enable "Find My Device"
Smart Home
- Change default passwords immediately
- Update firmware regularly
- Segment IoT on a separate network
- Disable unnecessary features
Network Security
Home Wi-Fi: Change router default password, use WPA3 encryption, create 25+ character Wi-Fi password, disable WPS, enable router firewall, create guest network for IoT devices.
Monitor Your Accounts & Credit
Financial Account Monitoring
- Review transactions daily through mobile apps
- Set up alerts for transactions over $50 (or lower)
- Enable notifications for password changes, new payees, or address updates
- Review statements monthly
- Report suspicious activity immediately (within 60 days)
Credit Report Monitoring
Free options:
- AnnualCreditReport.com — Free report from each bureau annually
- Strategy: Request one report every 4 months from rotating bureaus for year-round coverage
- Credit Karma — Free credit monitoring (TransUnion & Equifax)
- Many credit card issuers offer free credit score tracking
What to Look For on Credit Reports
- Accounts you don't recognize
- Incorrect personal information
- Inquiries you didn't authorize
- Addresses where you've never lived
- Employers you've never worked for
- Public records (bankruptcies, liens) that aren't yours
Credit Freeze: Your Best Defense
A credit freeze restricts access to your credit report, preventing new credit accounts from being opened in your name. It's free, doesn't affect your credit score, and doesn't prevent you from using existing accounts.
How to Freeze Your Credit
You must freeze with all three bureaus separately. You'll receive a PIN or password to unfreeze — save this securely!
Fraud Alerts & Protection Services
Types of Fraud Alerts
Initial (1 year)
If you suspect ID theft or are at risk. Place with one bureau — they notify the others. Free.
Extended (7 years)
For confirmed victims. Requires identity theft report. Removes you from pre-screened offers for 5 years.
Active Duty Military (1 year)
For deployed military personnel. Similar to initial alert. Renewable during deployment.
Fraud Alert vs. Credit Freeze
| Feature | Fraud Alert | Credit Freeze |
|---|---|---|
| Protection Level | Moderate | High |
| Convenience | More convenient | Less convenient |
| Effect on applications | Slows process | Blocks unless unfrozen |
| Cost | Free | Free |
| Best for | At-risk individuals | Everyone |
Recommendation: Use BOTH — a credit freeze for maximum protection, plus a fraud alert for additional verification.
Paid Protection Services
Consider paid services if you've been in a data breach, have complex finances, don't have time for manual monitoring, want insurance coverage, or need family protection.
$12–$29/mo | Up to $5M insurance | 3-bureau monitoring | VPN included
$8.99–$25/mo | Up to $1M insurance | IBM Watson AI monitoring
$9.99–$29.99/mo | Up to $3M insurance | Norton 360 antivirus included
$17.95–$23.95/mo | Up to $1M insurance | Business ID protection
Social Media Privacy & Data Brokers
Social Media Privacy
Your social media profiles are goldmines for identity thieves. Criminals gather: full name, date of birth, location, family member names, pet names (security questions), employment history, phone numbers, vacation dates.
Never post: Full date of birth, current location in real-time, vacation dates before returning, photos of credit cards/tickets/boarding passes, children's full names and schools, address or phone numbers.
Data Broker Removal
Data brokers collect and sell your personal information. Major sites include Whitepages, Spokeo, BeenVerified, PeopleFinders, Intelius, TruePeopleSearch, Radaris, and Nuwber.
DIY removal takes 10–20 hours initially and must be repeated quarterly. Automated services include:
- DeleteMe — $129/year
- Incogni — $155/year
- Optery — $99–$249/year
Email Security
Your email is the master key to your digital life.
- Use a unique, strong password (20+ characters)
- Enable 2FA (preferably authenticator app or hardware key)
- Use separate emails for: personal, financial, shopping, and throwaway sign-ups
- Use encrypted email for sensitive communications (ProtonMail, Tutanota)
What to Do If You're a Victim
Time is critical. The faster you act, the less damage occurs. Follow these steps in order.
Immediate Response: First 24 Hours
- Document everything — screenshots, emails, dates, times, photos of fraudulent charges
- Place fraud alerts — contact ONE credit bureau (Equifax: 1-800-525-6285, Experian: 1-888-397-3742, or TransUnion: 1-800-680-7289). They'll notify the others.
- Freeze your credit at all three bureaus immediately
- Report to IdentityTheft.gov — create a detailed report and print your recovery plan
- Change compromised passwords — start with email, then financial accounts, then everything else
- Contact affected financial institutions — call fraud departments, report unauthorized transactions, request new account numbers
- Review recent account activity — check for unauthorized transactions, changed contact info, added authorized users
First Week: Reporting & Protection
- File a police report — bring your FTC report, ID, proof of address, and evidence. Get copies for creditor disputes.
- Contact all affected companies — call fraud departments, send written dispute letters (templates in our Response Kit), include FTC report and police report
- Report to specialized agencies:
- Tax theft: IRS Form 14039, call 1-800-908-4490
- SSN fraud: SSA at 1-800-772-1213
- Medical theft: Contact health insurance + request medical records
- Passport fraud: 1-877-487-2778
- Driver's license fraud: Contact state DMV
- Check ALL your accounts — banks, credit cards, investments, retirement, PayPal/Venmo, crypto exchanges, loyalty programs, email, social media
First Month: Monitoring & Follow-Up
- Monitor credit reports weekly initially — look for new fraudulent accounts, dispute inaccuracies
- Set up account alerts — notifications for all transactions, password changes, address changes
- Follow up on all disputes — certified mail with return receipts, follow up in writing after phone calls
- Request written confirmations — accounts closed, not responsible for charges, credit bureau corrections
- Update all security — new passwords everywhere, 2FA enabled, fake security question answers stored in password manager
Long-Term Recovery (6–12+ Months)
- Continue monitoring — credit reports monthly, financial accounts daily, Social Security statement, medical records
- Consider extended fraud alert (7 years) after initial evaluation
- Maintain detailed records — all correspondence, police reports, dispute letters, account closure confirmations, timeline, expenses
- Know your rights — free credit reports from companies that denied you, stop debt collection on fraudulent accounts, not liable for most fraudulent charges
- Recovery resources: Identity Theft Resource Center (888-400-5530), IdentityTheft.gov, Consumer Financial Protection Bureau, your state AG's office
- Consider legal assistance if facing criminal charges, significant losses, uncooperative companies, or complex cases
Special Circumstances
Criminal Charges From ID Theft
Contact the police department, provide your reports, request a clearance letter, and consider hiring a criminal defense attorney.
Child's Identity Stolen
Contact all three credit bureaus, request manual search, freeze their credit, file FTC and police reports, consider requesting a new SSN.
Family Member Stole Your Identity
Family members commit 30% of identity theft. You can file reports and disputes without pressing criminal charges, though creditors may require police reports.
Special Risk Groups
Protecting Children's Identities
Children are targeted because of clean credit histories, and theft can go undetected for 10–18 years.
- Monitor annually — check for credit reports in your child's name (children under 18 shouldn't have credit files)
- Freeze your child's credit — available in all 50 states, free, requires birth certificate and parent ID
- Safeguard their SSN — don't carry their Social Security card, question why it's needed
- Limit information sharing — be cautious on social media (don't post birth dates, full names, schools)
- Teach identity protection — age-appropriate lessons about personal information, passwords, and online safety
- Act immediately if compromised — file FTC and police reports, contact credit bureaus, consider new SSN in extreme cases
Seniors and Identity Theft
While 30–39 year-olds report more identity theft, seniors lose significantly more money per incident.
Common Scams Targeting Seniors
Government Impersonation
Fake IRS calls, Social Security suspension threats, Medicare card scams
Romance Scams
Online dating fraud, emotional manipulation, long-term financial exploitation
Grandparent Scams
"Your grandchild is in trouble" calls demanding emergency bail money
Tech Support Scams
Pop-ups claiming virus, calls from "Microsoft," remote access requests
Protection Strategies
- Learn that government agencies never call demanding immediate payment
- Hang up and call back using official numbers
- Use direct deposit for all benefits
- Establish family passwords for emergency calls
- Get help setting up 2FA and password managers
- Regular check-ins with trusted family members about finances
Resources: AARP Fraud Watch Network: 877-908-3360 | Eldercare Locator: 800-677-1116
College Students
Students face unique risks: limited monitoring experience, frequent address changes, shared living spaces, heavy public Wi-Fi usage, and financial aid applications.
- Lock up Social Security card, passport, birth certificate
- Use strong unique passwords and enable 2FA on all accounts
- Log out of shared computers, don't save passwords on shared devices
- Only apply for financial aid through FAFSA.gov
- Beware of fake job postings — never pay for a job opportunity
- Use VPN for sensitive activities on campus Wi-Fi
- Freeze credit when not applying for loans
Military Personnel & Families
Unique vulnerabilities: deployments reduce account monitoring, PCS moves create address/mail gaps, and public records may reveal deployment dates.
Pre-Deployment Checklist
- Place active duty alert on credit reports (1 year, renewable)
- Freeze credit with all three bureaus
- Grant trusted family member financial power of attorney
- Set up account alerts and establish communication protocols
- Use APO/FPO addresses, sign up for USPS Informed Delivery
- Don't share deployment details on social media
Resources: Military OneSource: 800-342-9647 | DOD Fraud Hotline: 800-424-9098
Emerging Threats in 2025–2026
Stay ahead of evolving identity theft tactics.
AI-Powered Scams
Voice cloning from social media videos, AI-generated phishing with perfect grammar, chatbots that extract personal details through friendly conversation.
Defense: Establish family passwords for emergency calls. Verify requests through other channels. Never trust email alone for sensitive requests.
SIM Swapping Attacks
Increased 400% since 2020. Criminals port your phone number to their device, receive your 2FA codes, and access your accounts.
Defense: Add PIN/password to carrier account. Use authenticator apps instead of SMS for 2FA. Don't share phone number publicly.
Account Takeover Fraud
Surged 354% since 2019. Targets email (primary gateway), social media, banking, e-commerce, and loyalty programs.
Defense: Unique passwords everywhere. Password manager. App-based 2FA. Monitor at HaveIBeenPwned.com.
Biometric Data Theft
Unlike passwords, you can't change your fingerprints or face. High-res photos create fake fingerprints, deepfakes trained on social media, voice cloning from videos.
Defense: Use multi-factor auth (biometrics + password/PIN). Limit which services get biometric data. Be cautious posting high-res photos.
Cryptocurrency Theft
Exchange account takeovers, wallet compromises, fake crypto platforms, pig butchering scams (investment fraud).
Defense: Hardware wallets for significant holdings. Authenticator apps (never SMS). Verify URLs carefully. Research platforms before depositing.
Smart Home & IoT Vulnerabilities
Cameras and microphones accessed remotely, smart locks manipulated, network infiltration through unsecured devices.
Defense: Change default passwords. Update firmware. Segment IoT on separate network. Disable unnecessary features. Cover cameras when not in use.
Resources & Tools
ScamWatchHQ Free Tools
Government Resources
Credit Bureaus
Fraud: 1-800-525-6285
Freeze: 1-800-685-1111
Disputes: 1-866-349-5191
Fraud: 1-888-397-3742
Freeze: 1-888-397-3742
Disputes: 1-866-200-6020
Fraud: 1-800-680-7289
Freeze: 1-888-909-8872
Disputes: 1-800-916-8800
Also consider: Innovis (1-800-540-2505) | ChexSystems (1-800-428-9623) | NCTUE (1-866-349-5355)
Support Organizations
Recommended Security Tools
Password Managers
- Bitwarden (open source, free option)
- 1Password
- Dashlane
- KeePass (offline, open source)
Encrypted Communications
- Signal (messaging)
- ProtonMail (email)
- Tutanota (email)
VPN Services
- NordVPN
- ExpressVPN
- ProtonVPN (free tier)
- Mullvad
Breach Monitoring
- HaveIBeenPwned.com
- Firefox Monitor
- Credit Karma
Frequently Asked Questions
Can I prevent identity theft completely?
No prevention is 100% foolproof, but you can reduce your risk by 80–90%. Think of it like locking your car — it doesn't make theft impossible, but criminals move on to easier victims.
How long does recovery typically take?
Simple cases (single fraudulent card): 1–2 months. Moderate cases (multiple accounts): 3–6 months. Severe cases (tax fraud, criminal records): 6 months to 2+ years. The average victim spends 200+ hours resolving identity theft.
Should I pay for identity theft protection?
It depends. Consider paying if you've been in a data breach, don't have time for manual monitoring, want insurance coverage, or need family-wide protection. Free alternatives work if you can commit to regular monitoring and follow prevention strategies.
Can identity theft affect my children?
Yes — 915,000 children were victims in 2022. It's particularly damaging because it often goes undetected for years. Protect children by checking for credit reports in their name annually and freezing their credit until they need it.
What if a family member stole my identity?
This is common — family members commit 30% of identity theft. You can file reports and disputes without pressing criminal charges, though creditors may require police reports. You're still responsible for the debt if you don't report it.
Can I get a new Social Security number?
It's rare and a last resort. The SSA only grants new numbers if you can prove ongoing harm after exhausting all other measures. Even with a new number, your credit history may follow you and government records will link old and new numbers.
What if I don't know who stole my identity?
Most victims never discover the thief's identity. This doesn't prevent recovery — file reports using "unknown suspect" and follow all dispute procedures. Law enforcement handles the criminal investigation.
Your Action Plan — Start Today
In the Next 30 Minutes
- Check your identity risk score
- Enable 2FA on your primary email account
- Check your most recent credit card and bank statements
This Week
- Freeze your credit with all three bureaus
- Set up account alerts on financial accounts
- Create unique passwords for your top 5 accounts
- Audit your social media privacy settings
This Month
- Check your credit reports from all three bureaus
- Install a password manager and update passwords
- Review and secure your smart home devices
- Remove your data from people-search sites
Quarterly
- Check credit reports (rotate bureaus)
- Review all account statements
- Update passwords on financial accounts
- Check Social Security earnings record