How to Tell If Someone Stole Your Identity: Warning Signs

Identity theft rarely arrives with a message saying, “Someone stole your identity.”

More often, the first clue is indirect: a $12 charge you do not recognize, a card account you never opened, a collection call for a debt you never borrowed, an IRS notice that makes no sense, or a password-reset email you did not request.

Those clues deserve attention, but they also require interpretation. Credit reports contain legitimate creditor names consumers may not recognize. A bureau can mix another person’s information into a file. A merchant can post under a legal business name that looks unfamiliar. A suspicious event is therefore a reason to investigate — not a reason to assume the worst before checking the facts.

Identity Theft Warning Signs at a Glance

Several warning signs at the same time — for example, a new inquiry, an unfamiliar card account, and a billing-address change — deserve especially fast attention.

Unrecognized Charges and Withdrawals Can Be the First Clue

The FTC tells consumers to review bills and bank statements for purchases, charges, and withdrawals they did not make. The CFPB adds an important detail: even a small unauthorized transaction can matter.

A thief who gains access to an existing card or bank account may use it without opening any new credit. That activity may never appear as a new account on your credit report.

Do not call a phone number contained in a suspicious text or email about the transaction. Open the bank’s official app, type its known website yourself, or use the number printed on the back of your card.

Also remember that an unfamiliar merchant descriptor can be legitimate. Compare the date and amount with your receipts and subscriptions before treating every strange name as fraud.

New Accounts and Inquiries on Your Credit Reports Deserve Attention

The CFPB identifies three particularly useful credit-report warning signs:

• inquiries from companies you have never contacted;
• accounts you did not open; and
• incorrect amounts on your accounts.

A fraudulent credit application can create an inquiry before the new account appears, so the inquiry section can provide an early clue.

But unfamiliar does not always mean fraudulent.

A store credit card can be reported under the issuing bank rather than the retailer. A debt can be sold or assigned to a collector with a different company name. An unfamiliar inquiry can also be connected with a permissible prescreened offer rather than an application you submitted.

You can obtain the nationwide bureau files using the process in our free credit reports guide.

If the only mystery is an inquiry, our guide to hard and soft inquiries explains account reviews, prescreening, application pulls, and how they appear.

Bills, Collections, and Missing Mail Can Reveal Accounts You Never Opened

The FTC lists unexpected bills as a warning sign and also notes that suddenly no longer receiving a bill can matter. A thief who gains access to an account may change the mailing address or contact details to delay detection.

Debt collection can surface the problem months later.

The CFPB warns consumers not to ignore collection calls about debts they do not recognize. A debt you never borrowed can indicate that another person opened an account in your name.

Still, collection activity has other possible explanations:

• the collector may be using an unfamiliar company name;
• the debt may belong to someone with a similar name;
• the creditor may have incorrect contact information;
• the account may contain a reporting error; or
• your credit file may be mixed with another consumer’s information.

Ask for enough information to identify the original creditor, account, amount, and dates. Do not provide sensitive information simply because a caller already knows part of your name or Social Security number.

Tax and Employment Identity Theft Can Show Up Outside Your Credit Report

Identity thieves do not use stolen information only to borrow money.

The IRS currently lists warning signs involving tax and employment records, including:

• a tax return being rejected because a return was already filed using your taxpayer information;
• a Form W-2 or Form 1099 from an employer you did not work for;
• a Form 1099-G for unemployment benefits you did not receive or apply for;
• an IRS notice concerning income you do not recognize;
• an IRS Online Account created or accessed without your involvement; and
• Social Security records showing wages you did not earn.

These signals may never create a new tradeline at Equifax, Experian, or TransUnion. Checking only credit reports therefore cannot detect every form of identity theft.

If the IRS contacts you about suspicious activity, verify that the letter or notice is genuine and follow the instructions provided by the IRS. The IRS specifically cautions that warning signs do not always prove identity theft, but they should not be ignored.

Medical Identity Theft Has Its Own Warning Signs

Medical identity theft occurs when someone uses another person’s identifying or insurance information to obtain medical care, prescriptions, devices, or insurance reimbursement.

The FTC identifies warning signs such as:

• a medical bill or Explanation of Benefits for services you did not receive;
• prescriptions you do not take;
• a debt collector contacting you about medical debt you do not owe;
• an unfamiliar medical collection on a credit report; or
• a notice that health-insurance benefits were used or exhausted unexpectedly.

This form of identity theft can create a problem beyond money: incorrect medical information can become associated with your records.

If a medical statement looks wrong, compare the provider, date of service, procedure, patient information, and insurer records. Contact the provider and insurer using contact details you independently verify.

Unexpected Security Alerts Can Point to Account Takeover

Password-reset messages, multi-factor authentication prompts, new-device alerts, or notices that an account was accessed from somewhere unfamiliar can indicate that someone is trying to get into an existing account.

The IRS specifically lists unrecognized account access and password-reset or login-verification alerts among identity-theft warning signs for tax accounts.

The same logic applies more broadly to financial and email accounts: treat an alert you did not trigger as something to verify through the real account, not through a link inside the alert.

Check:

• recent logins or device history;
• recovery email addresses and phone numbers;
• mail-forwarding or inbox rules;
• saved payment methods;
• recent password or contact-detail changes; and
• multi-factor authentication settings.

Email deserves particular attention because access to an email account can help a thief reset passwords for banking, shopping, tax, and credit accounts.

Identity Theft, a Mixed File, and a Reporting Error Can Look Similar

An account that is not yours creates a serious question, but there are several possible answers.

The CFPB specifically recognizes mixed files as a common credit-report error, including accounts belonging to another person with the same or a similar name.

This distinction matters because the remedies differ. A standard reporting error uses the ordinary dispute process. Genuine identity theft can qualify for special FCRA blocking procedures and a recovery plan through IdentityTheft.gov.

If another person’s legitimate information appears to have been attached to your file, see What Is a Mixed Credit File?.

What to Do When a Warning Sign Looks Real

Once you confirm that activity was not yours and someone appears to have used your information, move from investigation to containment.

1. Contact the affected company. Use its official fraud or security channel. Close, lock, or secure compromised accounts as appropriate.
2. Report identity theft at IdentityTheft.gov. The federal site creates an Identity Theft Report and a recovery plan based on what happened.
3. Review all three credit reports. Look for additional accounts, inquiries, collections, or identity information you do not recognize.
4. Protect new-credit access. A security freeze can prevent prospective creditors from accessing your file for most new-credit decisions; an initial fraud alert tells creditors to take identity-verification steps.
5. Secure your online accounts. Change compromised passwords, use unique credentials, and enable multi-factor authentication where available.
6. Keep records. Save reports, screenshots, account numbers, letters, dispute results, confirmation numbers, and a timeline of contacts.

The FTC says credit freezes are free to place and lift, and an initial fraud alert is also free. A freeze must be placed separately with Equifax, Experian, and TransUnion, while contacting one nationwide bureau for an initial fraud alert causes that bureau to notify the other two.

Our Credit Freeze vs. Fraud Alert guide compares those protections.

If identity theft has already occurred, use our Identity Theft Recovery Checklist for the full recovery sequence.

The Strongest Signal Is Activity You Can Confirm Was Not Yours

Identity theft detection is partly about patterns, but the decisive question is simpler: did someone use your personal or financial information without your permission?

An unfamiliar company name can be explained. A balance can be temporarily outdated. A bureau can mix files. A prescreening inquiry can appear even though you never applied.

But once a creditor confirms that an account was opened with your information and you did not open it — or a bank confirms an unauthorized transaction, or the IRS confirms tax activity you did not initiate — the issue has moved beyond a suspicious clue.

At that point, document what happened and begin the appropriate recovery process promptly.