Tips To Identify and Protect Yourself From Identity Theft

Finding out that a criminal is using your identity can be a traumatizing, costly and scary situation. However, some people are reluctant to share that they've been the victim of identity theft due to fear or embarrassment, and others may be unaware that their personal information has even been stolen.

For these reasons, finding precise statistics about identity theft is a challenge. According to the Federal Trade Commission's Consumer Sentinel Network Data Book 2024, there were 1.1 million identity theft reports in 2024, a 9.5% increase from the previous year. However, the Identity Theft Resource Center (ITRC) reported a 31% decrease in identity crimes in its 2025 Trends in Identity Report.

You can't always keep your personal information safe, but you can limit your risk, learn about warning signs and follow a recovery plan if needed.

What Is Identity Theft?

Identity theft is when someone steals or uses your personal or private information, such as your name, date of birth, Social Security number (SSN), credit card information or health insurance account number.

Identity theft can have serious consequences, including:

• Financial losses if someone takes over your financial account and transfers money.
• Damaged credit if someone opens and misuses a credit account in your name.
• Legal trouble or a criminal record if someone uses fake identification with your information while committing another crime.
• Difficulty filing your tax return if someone files a fraudulent tax return with your SSN.
• Mistakes in your medical records if someone gets medical procedures or prescription medications using your insurance information.

People who steal personal information may use it themselves. But some identity thieves purchase previously stolen information to scam people and commit fraud.

Identity thieves can benefit or profit when they use your stolen information to:

1. Gather more details by impersonating you and tricking your friends, family or companies.
2. Run scams by blackmailing you or pretending to be you online.
3. Sell your information to other criminals.
4. Take over your accounts using leaked login credentials or by imitating you and tricking a company representative into changing your account's credentials.
5. Open new accounts in your name, such as loans or credit cards.
6. File fraudulent tax returns with extra deductions and credits to claim a large refund.
7. Apply for government benefits, such as unemployment, under your identity.
8. Use your SSN with an employer, leaving you to deal with tax complications or mismatched earnings records.
9. Avoid criminal charges by providing your identity when dealing with law enforcement.
10. Get medical care or prescriptions using your insurance.

How Identity Thieves Get Your Information

Identity thieves can steal or purchase your information in various ways. Here are some of the most common sources and tactics.

Data breaches

Most people's personal information has already been leaked in one or more data breaches. One notable example is the Equifax data breach, which in 2017 exposed the personal information of about 147 million people, including their names, addresses, SSNs and dates of birth.

Criminals also often combine information from multiple data breaches into a new, single asset that they can distribute or sell. One of these, dubbed the Mother of all Breaches, contains more than 26 billion records from over 3,800 data breaches.

In addition to personal information, these types of data breaches may contain other sensitive information, such as usernames and passwords for online accounts.

Criminals can purchase stolen data from online marketplaces on the dark web and group chats on popular messaging apps and platforms. If they want to commit identity fraud, they might be able to get an identity theft kit with “fullz" (a full profile of a person's information, sometimes including their selfie and pictures of their driver's license) for less than $15.

Social engineering

Social engineering is a broad term for the manipulation that criminals often use to trick victims into sharing personal information or sending them money.

For example, an identity thief might pretend to be a representative from an online retailer or shipping company. They ask for your address and a small fee to “complete a delivery." In reality, they're stealing your name, address and credit card information.

Or you might receive an email warning that your account has been hacked and you need to reset your password. In reality, you're sent to a look-alike website that the identity thief created to collect login information.

Attacks involving social engineering sometimes have different names depending on the technique:

• Phishing (emails)
• Vishing (calls or voicemails)
• Smishing (text messages)
• Pharming (fake websites)

The names can also depend on the type of scheme or fraud, such as imposter scams, when the fraudster pretends to be someone else.

Malware

Malware, or malicious software, can infect your devices and allow other people to snoop on what you type, including your usernames and passwords. The person can then log in to your accounts and pretend to be you to scam your friends, family and connections. Or they might try to access your financial accounts and transfer money to themselves.

Mail theft

Mail theft has surged as criminals break into mailboxes or steal keys from USPS employees. They look for documents with personal information, like tax returns or medical records.

They also often look for checks to “wash" or “cook." This is when someone changes the check's amount and recipient before depositing it.

You won't necessarily be held responsible if someone steals and alters your check. But you could miss important bills, and getting the stolen funds back into your account quickly may be a challenge.

Card skimmers

A card skimmer is a small device that's installed on top of or inside a card reader at a gas station, point-of-sale terminal or ATM. The device steals information from your credit or debit card, and a small camera nearby might record your PIN. Criminals can sell the stolen information or put it onto new cards that they then use to make purchases or withdraw cash. How To Recognize the Warning Signs of Identity Theft

There are several common warning signs that someone is using your personal information to commit identity theft.

Look for unexpected information or errors in your:

• Credit reports
• Health records
• Financial accounts
• My Social Security account
• Mail from an employer, the IRS or a healthcare provider

You can also check to see if your information was part of a data breach using free search tools on Have I Been Pwned and DataBreach.com.

Identity thieves may target children because they're unlikely to notice these warning signs on their own. You can look for similar signs that your child's identity was stolen and take some steps to keep their information secure.

Tips To Protect Yourself From Identity Theft

Unfortunately, there's a good chance that some of your personal information has been leaked in a data breach. Even so, you can still take steps to help protect your other information and to keep an identity thief from using your information to commit fraud:

• Destroy documents with identifying information. Shred or tear up documents that contain personal information before you toss or recycle them.
• Use unique and strong passwords for every account. Consider using a password manager to create and manage your passwords.
• Enable multifactor authentication. When available, opt in for multifactor authentication (MFA) to improve the security of your online accounts. Once MFA is on, someone will need your username, password and an additional form of authentication, such as a code sent to your phone, to log in to your account.
• Don't share personal information online. Be especially cautious when posting on social media and sharing information with someone you didn't initiate a conversation with, don't know or don't trust offline.
• Be cautious if someone makes you feel scared, defensive or like you need to act quickly. Scammers and fraudsters often exploit these heightened emotions to trick people into sharing sensitive information, sending money or installing malware.
• Keep your devices and software updated. Turn on automatic updates for your devices, apps and other programs so you always have the latest security patches installed right away.
• Freeze your credit reports. Adding a security freeze to all three of your credit reports is a free way to help keep someone from opening credit accounts in your name.
• Monitor your credit. You can also use credit monitoring services to get alerted if someone opens a new credit account in your name.
• Request an identity protection (IP) PIN from the IRS. A free IP PIN can keep someone else from filing a tax return in your name.
• Set up account alerts. See if you can turn on alerts for your credit cards and bank accounts to keep an eye out for specific activity, such as changing balances and new transactions.

What To Do If You're a Victim of Identity Theft

If you suspect or know that you're a victim of identity theft, your next steps may depend on the specific circumstances.

For example, if you know the person who is using your identity and exactly what's happened, you might want to start by calling your local police department to report the crime. However, if you suspect identity theft because you receive a welcome letter for a new credit card in the mail, you could start by calling the card issuer.

In general, some of the steps you may want to take include:

• File a report on IdentityTheft.gov. The FTC will create a custom recovery plan and give you an Identity Theft Report, which can be helpful when contacting other organizations to report the crime.
• File a police report. In some situations, you might need a police report instead of the FTC's Identity Theft Report.
• Contact other relevant organizations. You may have to contact financial institutions, lenders, law enforcement, online platforms, credit bureaus, healthcare providers and your health insurance company, the USPS, the IRS or the DMV.
• Change your login information. Update the password for the affected account and the login credentials for other accounts with the same password.
• Add fraud alerts to your credit reports. Adding fraud alerts to your credit reports can help keep someone from opening credit accounts in your name. However, freezing your credit reports is an even safer option.
• Dispute fraudulent accounts and information. Monitor your credit reports and dispute fraudulent accounts that aren't removed by sending disputes directly to the credit bureaus.

How Is AI Impacting Identity Theft?

In late 2024, the FBI issued a warning about criminals using generative AI to commit financial fraud. The ITRC's 2025 trends report also highlights the use of AI by identity thieves as the top trend.

Identity thieves can use AI to:

• Automate their schemes. AI shortens the time to create convincing ads, websites, email accounts and other resources criminals can use to convince you to share your information or download malware.
• Write convincing messages. Bad grammar and spelling used to be a telltale sign of a scam. But AI makes it easy to generate well-written messages in multiple alanguages.
• Create deepfaked voices and videos. Some AI apps can change your accent, generate convincing audio from text, imitate real people, create deepfake videos and change someone's face during a video chat.

Criminals can even create AI agents to run common scams nonstop or target people based on information from data breaches and public records.

If you're having trouble figuring out what to do, the ITRC offers free help from identity recovery experts via chat, phone call or text.

READ MORE: Keep Your Money Safe and Secure While Banking Online

Stop Theft Before It Starts

Identity theft isn't going away; it's evolving. With criminals now leveraging AI to create more convincing scams and exploit data leaks at scale, the risks are higher than ever. While you can't eliminate the risk, you can lower your exposure by staying alert, protecting your personal data and acting quickly if something feels off.

READ MORE: How Identity Thieves Work: Protect Your Money