Identity theft has two phases: someone collects pieces of your personal information, then uses them to pretend to be you. Collection usually happens through ordinary routes: data breaches at companies that hold your records, phishing messages and phone scams that trick you into handing details over, stolen mail or wallets, SIM swaps that hijack your phone number, and sometimes people you know. The information is then used to open new credit accounts, take over existing ones, file a fake tax return, or claim benefits or medical care in your name. The FTC received more than 1.1 million identity theft reports through IdentityTheft.gov in 2024, with credit card fraud the most commonly reported type. The defenses that address the most common routes are a free credit freeze at all three bureaus, multi-factor authentication, an IRS Identity Protection PIN, and regular checks of your credit reports. If it happens, IdentityTheft.gov provides a federal report and a personalized recovery plan.
Reading time
— 5 min
Updated
— Sep 30, 2026
Fact-reviewed
— Sep 30, 2026
This entry explains how identity theft typically happens and the standard protections, not legal or financial advice for your situation. If you think your identity has been stolen, report it at IdentityTheft.gov and contact the affected businesses, your bank and, where relevant, local police.
Key Takeaways
Key Takeaways
1Identity theft has two phases: someone collects pieces of your information, then uses them to pose as you.
2Collection is usually ordinary: data breaches, phishing and phone scams, stolen mail or wallets, SIM swaps, and sometimes people you know.
3A free credit freeze, multi-factor authentication and an IRS Identity Protection PIN block the most common ways stolen details get turned into money.
The concept
Think of your identity as a set of keys: your name, birth date, Social Security number, address, phone number, and account logins. No single key opens much. A thief collects keys from different places: one from a company's leaked database, one from a text message you answered, one from a letter taken out of your mailbox. Once they have enough keys for a particular door, they open it: a new credit card in your name, your email account, or a tax refund. That's why identity theft often shows up months after the information was taken. The fix works the same way. You can't take back keys that are already out, but you can change the locks, so the keys stop working.
Quick check
A thief has your name and email address from a shopping-site breach, but nothing else. What are they most likely to try next?
Worked examples
Example 1: From breach to credit card (baseline case)
A healthcare billing company is breached, exposing names, birth dates, addresses and Social Security numbers. Months later, a criminal buys a batch of these records and applies online for a store credit card using one of them. Every field matches the victim's credit file, so the application is approved. The victim finds out when a collection letter arrives. If the victim had placed a credit freeze at Equifax, Experian and TransUnion, the lender's credit check would have failed and the account would most likely never have opened.
Example 2: The SIM swap (edge case: your phone becomes the weak point)
A criminal calls a mobile carrier pretending to be the victim, using details found on social media and in old breaches, and asks to move the number to a new SIM card. The victim's phone suddenly shows "No service." Within an hour the criminal requests password resets for the victim's email and banking, receives the text-message codes, and locks the victim out. Nothing on the victim's own devices was hacked. The defenses are a carrier account PIN or number-lock feature, and using an authenticator app or passkey instead of text codes for the most important accounts. Much of what a criminal needs for that call is already public; what your digital footprint actually reveals shows how little it takes.
Example 3: Your tax refund is already claimed (real-world use)
You try to e-file your federal return and it's rejected because a return was already filed under your Social Security number. Someone filed a fake return early to collect a refund. The IRS's identity theft process applies: you respond to any IRS notice as instructed and, per IRS guidance, file an identity theft affidavit (Form 14039) if directed. For future years, an Identity Protection PIN means a return filed without your six-digit PIN is rejected. You'd also report at IdentityTheft.gov, which generates a recovery plan covering the tax problem and any other accounts affected.
Quick check
Your phone suddenly loses service for no clear reason, and then you get an email saying your bank password was changed. What's the most likely explanation?
How it works (visual)
How identity theft starts, and where each defense cuts it off
Common mistakes
Common Mistakes
✕
Assuming you're safe because you've never been told your data was in a breach.
→ Many breaches have exposed hundreds of millions of records. Assume some of your details are already out and put freezes and multi-factor authentication in place anyway.
✕
Relying on text-message codes for your email and bank.
→ Text codes are vulnerable to SIM swaps. Use an authenticator app or a passkey where offered, and set a carrier account PIN.
✕
Paying for monitoring and skipping the free credit freeze.
→ Monitoring tells you after an account is opened. A freeze, which is free by federal law, stops most new accounts from being opened at all.
Common misconception
“Identity theft mostly happens when hackers break into your personal computer.”
Most of the information used in identity theft is collected elsewhere: from breaches at companies that hold your records, from phishing messages and calls that trick people into sharing details, from stolen mail and wallets, and from phone-number hijacking. That's why protections that work at the account level, like credit freezes, strong multi-factor authentication and an IRS Identity Protection PIN, matter more than any single device setting.
What to do next
What to do next
Place a free credit freeze at Equifax, Experian and TransUnion, and lift it temporarily only when you apply for credit.
Turn on multi-factor authentication for email and banking, using an authenticator app or passkey where possible.
Ask your mobile carrier to add an account PIN or number-lock to help prevent SIM swaps.
Request an IRS Identity Protection PIN through the IRS website.
Check your credit reports for free at AnnualCreditReport.com and look for accounts you don't recognize.
If something looks wrong, report it at IdentityTheft.gov and follow the recovery plan it creates.
FAQ
FAQ
Related terms
Related terms
Identity theft
Using someone else's personal information, such as their name, Social Security number or account details, without permission to commit fraud or obtain money, credit or services.
New-account fraud
Opening a new credit card, loan, phone line or other account in a victim's name.
Account takeover
Gaining control of an account the victim already has, often by resetting the password or changing the contact details.
SIM swap
Tricking or bribing a phone carrier into moving a victim's number to a SIM card the criminal controls, so texts and calls, including login codes, go to the criminal.
Identity Protection PIN (IP PIN)
A six-digit number from the IRS that must be on a federal tax return filed under your Social Security number, which blocks fraudulent returns filed without it.
This entry was researched from public sources and drafted with AI-assisted tools, then edited — errors are still possible. Spot one, or want a topic covered? Read our disclaimer.
KnowThis