Cybersecurity

What Is Identity Theft? Protect Yourself

Identity theft is when someone uses your personal information — your name, date of birth, address, or identity numbers — to pretend to be you: opening accounts, taking loans, claiming benefits, or committing crimes in your name. You may not discover it for months, until a bill arrives, a debt collector calls, or a loan is refused. This guide explains how it happens, the warning signs, and exactly what to do.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What identity theft is

Identity theft is the use of another person's personal information to commit fraud or other crimes. Your identity is not one thing but a bundle of details — your name, address, date of birth, identity numbers, account details — and a criminal needs only enough of them to pass a check. With the right combination, they can open bank accounts, apply for credit cards, take out loans or phone contracts, file false tax returns, claim benefits, or receive medical treatment in your name.

It differs from account takeover, though the two often overlap. Account takeover is when a criminal gets into an existing account of yours — your email, your bank, your shopping account. Identity theft is when they use your details to create something new in your name. Both need a response, and both are usually discovered by a document arriving that you did not expect.

The damage is not only financial. A victim can face damaged credit, debt collectors chasing money they never borrowed, refused mortgages or rentals, time spent proving their own identity to organisations that do not believe them, and real distress. Recovery can take months, and the experience of not being believed by a bank or a creditor is, survivors say, one of the worst parts.

How criminals get your details

The most common route is a data breach: personal details stolen from a company are traded and combined, and a criminal buys a package that contains enough to open an account. Phishing provides another route — a message that captures the details directly, or that captures a password and leads to an inbox full of personal documents. Physical theft still matters: post stolen from a mailbox, a wallet, a bag, or documents thrown away without shredding.

Social media gives away more than most people realise. A full name, a date of birth, a hometown, an employer, a pet's name and a mother's name can often be assembled from public profiles — and those are exactly the details used in security questions and identity checks. Skimming — a hidden device on a cash machine or payment terminal that copies card details — and SIM swapping, in which a criminal persuades a phone company to transfer your number to their SIM card, are less common but still in use.

The newest source is the insider and the corrupt employee: someone with legitimate access to customer records who sells them. You cannot defend against that directly, which is why monitoring — transaction alerts, credit reports, and fraud alerts — matters as much as prevention.

Warning signs to watch for

The classic sign is a document that does not belong to you: a bill, a bank statement, a loan agreement, a tax letter, or a debt collector's letter for an account you never opened. Other signs include being refused credit unexpectedly, a credit report showing accounts you do not recognise, post going missing, or calls about money you do not owe.

On your own accounts, watch for password reset emails you did not request, login alerts from unfamiliar places, a phone that suddenly has no signal — which can mean your number was transferred to another SIM — and unfamiliar transactions, even small ones. On your tax and benefits, watch for a refund you did not claim, or a notice that your return has already been filed.

Any one of these deserves action, not waiting. Identity theft is cheapest to fix early and most expensive to fix late: a fraudulent account discovered in its first week is a phone call, while one discovered after a year of missed payments is a long fight with creditors and credit agencies.

• Bills, loans or debt letters for accounts you never opened.
• Credit refused unexpectedly, or unfamiliar accounts on your report.
• Post going missing, or a phone suddenly losing signal.
• Password resets or login alerts you did not request.
• Tax or benefit notices about claims you never made.

If your identity has been stolen: the first 24 hours

First, contact the organisations involved: the bank, the lender, the service where the fraudulent account was opened. Tell them the account is fraudulent, ask them to close it and to confirm in writing that you are not responsible. Ask for reference numbers and keep them.

Second, report it. In the United States, go to IdentityTheft.gov, which is run by the Federal Trade Commission. It asks you what happened, builds a personalised recovery plan, and produces the letters and forms you need — including an Identity Theft Affidavit, which many organisations and creditors will ask for. Also file a report with the FBI Internet Crime Complaint Center at ic3.gov and with your local police, and keep the reference numbers.

In the United Kingdom, report the fraud to Action Fraud and contact the three credit reference agencies — Experian, Equifax and TransUnion — to place protective measures and check your credit reports. Contact your bank immediately if accounts or cards are involved. In other countries, the pattern is the same: the police or national fraud service, your bank, and the credit reporting agencies.

Third, protect your credit. In the United States, place a fraud alert or a credit freeze with the three credit bureaus — a freeze is stronger, because it stops new credit being opened in your name until you lift it. In the United Kingdom, register a protective notice with the credit reference agencies and consider a protective registration with CIFAS, the fraud prevention service. Keep every letter, reference number and name of the person you spoke to — identity theft recovery is won on records.

Recovery, week by week

Recovery is a process, not a single phone call. Over the first weeks, work through the recovery plan: dispute every fraudulent account in writing with the creditor and with the credit reporting agencies, keep copies of everything, and follow up on each dispute until you have a written confirmation that it is resolved. The agencies have deadlines for investigating disputes, and a written dispute starts the clock.

Check your credit report from each agency regularly — in the United States you can get free reports, and in the United Kingdom the agencies provide free statutory reports. Look for accounts you do not recognise, addresses you never lived at, and enquiries you never made, and dispute anything that does not belong to you.

Also check the less obvious places: medical records, tax records, and government benefit accounts. A criminal who has your identity may use it for medical treatment, which can corrupt your medical records; or for tax and benefit claims. If you find anything, report it to the relevant agency and keep the evidence. Recovery typically takes months, and it is normal to feel frustrated — keep a single folder, paper or digital, with everything in one place.

How to protect yourself

Prevention is three habits: share less, protect what you share, and watch for misuse. Share less by limiting what you post publicly — your full date of birth, your address, your mother's name, and your pet's name are all answers to security questions, and none of them belong on a public profile. Protect what you share with unique passwords, two-factor authentication on email and banking, and a password manager, because much identity theft starts with an email account takeover.

Watch for misuse by setting up transaction alerts with your bank, checking your credit report regularly, and reading your post promptly. Shred documents that carry personal details before throwing them away, be careful with public Wi-Fi for anything sensitive, and treat unexpected messages asking for personal details the way you would treat any phishing attempt — verify through a separate channel.

Finally, remember that identity theft is not your fault, and not a mark of carelessness. The data that enables it is stolen from companies and traded at scale, and a careful person can still be a victim. What you can control is how quickly you notice and how thoroughly you respond — and that is what this guide is for.

• Share less: keep your date of birth and family details off public profiles.
• Protect your email — it is the key to every other account.
• Bank transaction alerts on, credit report checked regularly.
• Shred personal documents; never share details because a message asked.
• Act on the first warning sign — early is cheap, late is expensive.

Sources

• IdentityTheft.gov — US identity theft recovery — last checked 14 November 2026.
• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.
• Federal Trade Commission — Identity theft — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is identity theft?

Identity theft is when someone uses your personal information — your name, date of birth, address or identity numbers — to pretend to be you, opening accounts, taking loans or committing fraud in your name.

How do I know if my identity has been stolen?

Watch for bills or debt letters for accounts you never opened, credit refused unexpectedly, unfamiliar accounts on your credit report, missing post, or login alerts you did not request. Any one of these deserves action right away.

What should I do first if my identity is stolen?

Contact the organisations where the fraud happened and ask them to close the accounts. In the US, go to IdentityTheft.gov for a personal recovery plan, and file reports with the FBI IC3 and your local police. In the UK, report to Action Fraud and contact the credit reference agencies.

What is a credit freeze?

A credit freeze stops new credit being opened in your name until you lift it. In the US, you place it with the three credit bureaus. It is stronger than a fraud alert, and it is the single most effective step after identity theft is discovered.

Can identity theft be prevented?

Not entirely — much of the data used is stolen from companies. But you can make it harder: share less publicly, protect your email with a unique password and two-factor authentication, use bank transaction alerts, and check your credit report regularly.