How to Detect Identity Theft: Signs and What to Check

To check if someone is using your identity, look for activity that isn't yours in the places identity theft leaves a trail: your bank accounts, credit reports, bills, online accounts, and tax and employment records. No single check settles it. You're hunting for charges, accounts, notices or logins you don't recognize.

Identity theft means someone uses your personal or financial information without your permission. They might open an account in your name, use one of your existing accounts, apply for credit, file a tax return or use your details in some other transaction. Here's what to look for, and what to do if you find something that isn't yours.

Signs that your identity has been stolen

There isn't always an obvious alarm. Sometimes you catch a fraudulent charge the same day. Sometimes the first clue is a bill you don't recognize, a strange line on your credit report or a letter about an account you never opened.

The FTC lists warning signs including charges you didn't make, bills for things you didn't order, unauthorized withdrawals, bills or statements that suddenly stop arriving, and accounts or loans on your credit report that you don't recognize. Here's the fuller list, with where each sign tends to turn up:

Table: Warning signs of identity theft and where they show up.

None of these proves anything by itself. A shop might bill under a different company name, or your credit report might simply contain an error. Each one is still a reason to look closer.

How do I know if my identity has been stolen?

Start with the accounts and records you can already see. You want anything that ties your personal information to something you didn't do.

1. Check your bank accounts

Go through recent transactions on your checking and savings accounts. Look for:

• Withdrawals you don't recognize
• Transfers you didn't make
• New payees
• Changes to account details
• Unfamiliar direct debits or recurring payments
• Small transactions you don't remember making

Don't wave off a small unfamiliar charge. Fraudsters sometimes run a tiny transaction to test that a card works before trying a big one.

If you find a transaction you didn't authorize, contact your bank through its official phone number or website, not a number from an email.

2. Check your credit reports

Your credit report can show activity that never touches your bank statements. Look for:

• Credit cards you didn't open
• Loans you didn't apply for
• Hard inquiries you don't recognize
• Accounts with unfamiliar balances
• Personal information that isn't yours
• Addresses linked to you that you never lived at

In the US, you can get your reports at AnnualCreditReport.com, which the FTC names as the authorized site for free credit reports. Federal law gives you free reports from each of the three nationwide credit reporting companies in certain circumstances, and the site currently offers free weekly access.

An unfamiliar item isn't automatically fraud. Check the details before assuming the worst.

3. Look at your bills and statements

Identity theft can hit services you wouldn't think of as financial. Check these for charges you didn't make:

• Credit card statements
• Utility bills
• Phone bills
• Insurance statements
• Medical bills
• Subscription accounts
• Other recurring services

Notice bills that stop arriving, too. A missing bill can mean someone changed the billing address on the account. If something isn't yours, call the company directly and ask what information is attached to the account.

How to check if someone is using your identity online

Online misuse is harder to spot because it often happens inside an account you already have. Nobody needs to open a new account in your name if they can take over an existing one: your email, social media, shopping or bank login.

Look for:

• Password reset emails you didn't request
• Login alerts from unfamiliar locations or devices
• New devices added to an account
• Changes to your recovery email or phone number
• Multi-factor authentication codes you didn't request
• Messages sent from your account that you didn't write
• Purchases you don't recognize
• Changes to your profile or account settings
• New forwarding rules in your email
• Security notifications about changes you didn't make

One unexpected security email doesn't mean someone got in. It may have been a login attempt that was blocked. Repeated alerts, successful logins you don't recognize or settings you didn't change need attention right away.

Check your most important accounts first

Start with the accounts that unlock other accounts. Your main email matters most, because password reset links for everything else go there. Work through them in this order:

1. Your primary email
2. Banking and financial accounts
3. Your mobile carrier account
4. Cloud storage
5. Your password manager
6. Social media
7. Shopping and other accounts that hold payment details

Where the option exists, review active sessions, logged-in devices, recovery methods and recent security activity. If an account is compromised, secure it from a device you trust, change the password and turn on multi-factor authentication if it's offered.

Search for your own information

Search your full name, email addresses, phone numbers, current and past addresses, and the usernames you use most. Look for profiles, accounts, listings or pages with your details that you didn't expect.

Exposure isn't the same as identity theft, though. Your name and address on a people-search site doesn't mean someone is using your identity. Data brokers collect and publish personal information without asking you. What counts is evidence of activity you didn't authorize, not just the fact that information about you exists online.

Also read: How to Delete Yourself from the Internet

How to check for tax or employment identity theft

Identity theft goes beyond shopping and credit. With your Social Security number, someone can file a fraudulent tax return or get a job.

Tax identity theft often comes with a clear warning. The IRS may reject your real return because one was already filed with your Social Security number, or tell you about income from an employer you've never worked for. Don't write a notice like that off as paperwork. Check the details and follow the IRS's instructions.

You can also review your Social Security earnings history for jobs you don't recognize. The FTC recommends this as one way to spot someone using your Social Security number for work.

Identity theft that doesn't show up on your credit report

Some misuse never creates a credit record at all. Depending on the case, that can include utility or phone services, insurance or medical services, tax filings, employment, government benefits, check-cashing services and online accounts.

Identity monitoring services may catch some of what a credit report misses, such as changes of address, certain court or arrest records, and new utility or wireless services. So check your credit report, but don't treat it as a complete identity check.

What if my information was exposed in a data breach?

A breach doesn't automatically mean your identity has been stolen. It means data an organization held may have reached the wrong people. What happens next depends on what was exposed and whether anyone uses it.

If you got a breach notice, read it properly. Find out which information was involved and whether the organization is offering credit monitoring or identity theft protection. The FTC recommends checking your credit reports after certain types of breach, and considering a credit freeze or fraud alert when it fits.

Also read: How to Prevent Data Breaches in 8 Ways

What to do if someone stole your identity

Once you've found real evidence, stop investigating and start containing.

Secure the affected accounts

Contact the bank, card issuer, lender, service provider or other organization through an official channel. Change compromised passwords, especially any you reused elsewhere, and turn on multi-factor authentication where you can.

Choose a fraud alert or credit freeze

They do different jobs:

Table: Fraud alert vs. credit freeze.

Pick the one that matches what you've found.

Report the identity theft

In the US, report it at IdentityTheft.gov. The FTC gives you a personalized recovery plan based on what happened, along with guidance and documents for each step. Depending on the type of theft, you may also need to contact the businesses involved, the credit reporting companies, government agencies or the police.

Keep records

Write down what happened. Save:

• Dates and times
• Account numbers, where appropriate
• Confirmation numbers
• Emails and letters
• Names of the organizations you contacted
• What each organization told you
• Copies of reports and dispute documents

Recovery can mean dealing with several organizations at once. Good notes show what's done and what's still open.

How to stop identity theft from getting worse

Once you know your information is out there, give it fewer chances to be misused:

• Use unique passwords for important accounts.
• Turn on multi-factor authentication.
• Review your account recovery options.
• Keep your devices and software updated.
• Be careful when someone asks for sensitive information by phone, email or text.
• Pay attention to how much of your personal information is public.

People skip that last one. You can guard your Social Security number and bank details carefully and still have your full name, address, phone number and relatives listed on data broker and people-search sites. That isn't identity theft. It does make it much easier for someone to build a detailed profile of you.

Monitor your exposure with Serus

Checking for identity theft is half the job. The other half is knowing what's already out there about you.

Your name might be tied to an old address. That address might be tied to your relatives, and your phone number to an old account. Each piece looks harmless on its own. Put together, they describe you in a lot of detail.

Serus finds and removes personal information exposed through data brokers and other public sources, so less of it piles up in places you don't control. Run a free scan with Serus to see what's exposed.