What identity theft is and why it matters to you

Identity theft occurs when someone uses your personal information — your name, Social Security number, financial account details, or other identifying data — without your permission to commit fraud. They might open credit accounts in your name, file false tax returns, make purchases, or drain existing accounts. The damage ranges from a few hundred dollars in fraudulent charges to years of credit damage and thousands in recovery costs.

Identity theft is not always caught when ready. You might not notice until you check your credit report, receive a bill for an account you did not open, or a lender tells you that you have already borrowed money you never took out. By then, the thief may have been active for weeks or months.

The good news is that federal law limits your liability for fraudulent charges in most cases, and there are concrete steps you can take both to reduce your risk and to recover if theft does occur. Understanding what those steps are — and in what order — saves time and money if you ever need them.

Key Takeaways

  • You are not liable for most fraudulent charges if you report them within 60 days of receiving your statement, but reporting faster protects you more completely.
  • The three major credit bureaus — Equifax, Experian, and TransUnion — maintain the credit reports that thieves use to open accounts, and you can place a free freeze on your file at each one.
  • A credit freeze stops new accounts from being opened in your name without a PIN you control, but it does not prevent fraud on existing accounts.
  • If you discover identity theft, you will need to file a report with the Federal Trade Commission and contact your banks and creditors directly — the FTC report alone does not stop the fraud.
  • Recovery typically takes weeks to months and involves disputing fraudulent accounts with creditors and credit bureaus, not just closing accounts.

How identity thieves get your information

Thieves obtain personal information through several common routes. Data breaches at retailers, healthcare providers, employers, and financial institutions expose millions of records at once. Phishing emails and text messages trick you into entering passwords or account numbers on fake websites. Weak passwords or reused passwords across multiple sites mean that a breach at one company gives access to many accounts.

Physical theft — stealing mail, wallets, or purses — remains a direct source. Social engineering, where someone calls pretending to be from your bank or the IRS, can extract information over the phone. Public Wi-Fi networks without encryption make it straightforward for someone nearby to intercept your data. Dumpster diving for discarded documents with personal information still happens.

You cannot prevent every breach or phishing attempt, but you can make yourself a harder target and catch problems faster. The steps that follow address both.

Freezing your credit to prevent new accounts in your name

A credit freeze is a free tool that stops lenders from pulling your credit report without your permission. Since most identity thieves need to open new accounts — credit cards, loans, phone plans — a freeze blocks the most common form of theft. When you freeze your credit, the three major bureaus (Equifax, Experian, and TransUnion) will not release your report to anyone trying to extend credit to someone claiming to be you.

To place a freeze, you contact each bureau directly. Equifax, Experian, and TransUnion each have their own freeze process, though all are free. You can freeze online, by phone, or by mail. Each bureau will give you a PIN or password to unfreeze your credit later — store this somewhere safe, separate from your other passwords. The freeze takes effect within one business day for online requests.

A freeze does not affect your existing accounts or your credit score. It does not prevent fraud on accounts you already have — a thief with your information can still make purchases on your current credit card or drain your bank account. For that reason, a freeze is one layer of protection, not the only one.

If you need to explore for credit, you will temporarily unfreeze your file at the relevant bureau. This takes a few minutes online if you have your PIN. Some people freeze their credit permanently and unfreeze only when they are actively shopping for a loan or credit card.

Monitoring your accounts and credit reports

Regular monitoring catches theft early, when damage is smallest. Check your bank and credit card statements at least monthly — many people check weekly or set up alerts for any transaction over a certain amount. Look for charges you do not recognize, even small ones. Thieves sometimes test stolen card numbers with small purchases before making larger ones.

You are may have access to to one free credit report per year from each of the three major bureaus through AnnualCreditReport.com, a site run by the bureaus themselves. You can request all three at once or stagger them throughout the year. Review each report for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours.

Some people pay for credit monitoring services that alert them to new accounts or inquiries in real time. These services are optional — the free annual reports and your own account monitoring work, but they require you to take action. Paid services send alerts automatically. Weigh the cost against how much time you want to spend checking manually.

If you spot something suspicious, do not wait. Contact your bank or creditor when ready and ask them to investigate. Do not assume it will resolve on its own.

What to do when ready if you discover identity theft

If you discover that someone has used your information, your first step is to contact the financial institutions involved — your bank, credit card companies, or any lender where you see fraudulent activity. Tell them what happened and ask them to freeze or close the account. They will likely issue you a new card or account number and dispute the fraudulent charges. Federal law limits your liability to $50 per card if you report within 60 days, and most banks waive even that.

Next, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and generates an Identity Theft Report, which you can use when disputing fraudulent accounts with creditors and credit bureaus. The FTC report itself does not stop the fraud — you still have to contact each creditor — but it documents that you reported the theft and can help you dispute charges.

Place a fraud alert with the three credit bureaus. Unlike a freeze, a fraud alert tells lenders to verify your identity before opening new accounts, but they can still pull your report. A fraud alert is free and lasts one year. If you have already filed an FTC Identity Theft Report, you can place an extended fraud alert that lasts seven years. You only need to contact one bureau; they will notify the other two.

Document everything: the dates you discovered the fraud, the accounts involved, the amounts, the names of people you spoke with, and what they told you. Keep copies of all correspondence with banks, creditors, and credit bureaus. This record becomes your proof if disputes drag on.

Disputing fraudulent accounts and recovering your credit

After you have reported the theft and placed a fraud alert, you will need to dispute the fraudulent accounts with each creditor and credit bureau. Send a written dispute letter to each creditor stating that the account was opened without your permission and include a copy of your FTC Identity Theft Report. Creditors are required to investigate within 30 days and remove the fraudulent account from your credit report if they find it was not authorized.

You will also dispute the fraudulent accounts directly with the credit bureaus. Send a dispute letter to each bureau (Equifax, Experian, and TransUnion) listing the accounts that do not belong to you. Include a copy of your FTC report. The bureaus must investigate within 30 days and remove the account if the creditor confirms it was fraudulent.

Recovery is not when ready. Even after disputes are filed, it can take weeks or months for accounts to be removed from your credit report. If a creditor or bureau does not respond or disagrees with your dispute, you can escalate by filing a complaint with the Consumer Financial Protection Bureau or your state's attorney general. Keep all documentation of your disputes and responses.

During recovery, your credit score may drop because of the fraudulent accounts. Once they are removed, your score typically rebounds over time. Some people also place a security freeze after recovery to prevent future theft.

Steps to reduce your risk going forward

Use unique, strong passwords for each online account — a password manager like Bitwarden, 1Password, or KeePass stores them securely so you only have to remember one master password. Enable two-factor authentication on any account that offers it, especially email and financial accounts. Two-factor authentication requires a second verification step (usually a code sent to your phone) even if someone has your password.

Be cautious with email and text messages that ask you to verify information or click links. Legitimate companies rarely ask for passwords or full account numbers via email. If you are unsure, contact the company directly using a phone number or website you know is real, not one from the message.

Shred documents with personal information before throwing them away. Use find Wi-Fi networks or a VPN when accessing financial accounts on public networks. Monitor your credit reports regularly, even after recovery. Consider keeping your credit frozen permanently if you do not plan to explore for credit soon — you can unfreeze it temporarily when you need to.

Frequently Asked Questions

Will I have to pay for fraudulent charges on my credit card?

No. Federal law limits your liability to $50 per card for unauthorized charges, and most credit card companies waive even that if you report the fraud within 60 days of receiving your statement. Report suspected fraud as soon as you notice it to maximize your protection.

What is the difference between a credit freeze and a fraud alert?

A freeze stops lenders from pulling your credit report without a PIN you control, blocking most new account fraud. A fraud alert tells lenders to verify your identity before opening accounts but does not stop them from pulling your report. A freeze is stronger but requires you to unfreeze temporarily when you explore for credit. A fraud alert is easier but offers less protection.

How long does it take to recover from identity theft?

straightforward cases with one or two fraudulent accounts may resolve in weeks. Complex cases with multiple accounts, loans, or tax fraud can take months or longer. You will need to dispute each fraudulent account separately with creditors and credit bureaus, and each investigation takes up to 30 days. Keep records and follow up if disputes are not resolved.

Can I place a credit freeze if I have not been a victim of identity theft?

Yes. A credit freeze is free and available to anyone, whether or not you have experienced theft. Many people freeze their credit as a preventive measure, especially if they do not plan to explore for credit soon. You can unfreeze it temporarily whenever you need to.

What should I do if I receive a bill for an account I did not open?

Contact the creditor when ready and tell them the account was opened without your permission. Ask them to close it and investigate. Also file a report with the Federal Trade Commission at IdentityTheft.gov and place a fraud alert with the credit bureaus. Do not ignore the bill — the fraudulent account will damage your credit score if left unaddressed.