Identity theft is when someone uses your personal data — such as your name, Social Security number, birthdate and other data — and impersonates you.
They might use that information to drain your bank and investment accounts, open new credit lines in your name, get utility service, steal your tax refund, get access to medical treatments, or give police your name and address when they are arrested. It is a growing problem and can go on for years before being detected.
Here’s how identity thieves get hold of your data, how they use it and what you can do to reduce chances you’ll be a target.
How identity theft can happen
Here are some of the ways your personal information can be compromised:
When your wallet is lost or stolen, someone else may gain access to all the information in it.
What you can do: Don’t carry your Social Security card or more credit cards than you use regularly, and don’t keep a list of passwords and access codes in your wallet. Make photocopies of your credit cards, front and back, and keep them in a secure location so that you can easily call the issuer if a card or your wallet is lost. Some issuers allow you to temporarily “turn off” a lost card; with others you have to cancel and get a new card issued.
Someone simply takes your mail or forwards your mail to a different address, so that you suddenly stop getting most mail.
What you can do: Sign up for USPS Informed Delivery. You’ll get an email with images of the items that should be delivered to you so you’ll know if things are missing. Choose a secure mailbox type and retrieve mail promptly.
Using public Wi-Fi
Hackers may be able to see what you are doing when you use free public Wi-Fi.
What you can do: Don’t use public Wi-Fi for shopping, banking or other sensitive transactions. Use a virtual private network (VPN) service to create a secure connection.
Hackers invade databases holding sensitive information, such as in the Equifax credit bureau hack. Almost everyone has been affected by a data breach.
What you can do: Assume that your data is already out there, and behave accordingly. Check your credit scores often — unexpected changes can be a clue — and read financial and insurance statements carefully. Monitor your credit reports, especially for new accounts or inquiries resulting from credit applications.
SIM card swap
This is when someone takes over your phone number. You may stop getting calls and texts, or you may get a notice that your phone has been activated.
What you can do: Set up a PIN or password on your cellular account and consider using an authentication app for accounts with sensitive financial information.
Phishing or spoofing
Some fraudsters try to get you to disclose personal data, such as credit card numbers, Social Security numbers and banking information, by sending an official-looking email. Spoofing involves doing much the same thing with Caller ID so that the number appears to be that of a neighbor, trusted company or government agency.
What you can do: Do not give out personal data in response to an email or call. Instead, find contact information from a trusted source, such as your bank website, and verify whether the call or email is legitimate.
Skimming is getting credit card information, often from a small physical device, when a credit card is used at a brick-and-mortar location such as a gas pump or ATM.
What you can do: Use cards with chips, which have added protections. Pay inside at the gas station if you can, because physical skimmers are more likely to be on unmonitored payment sites. Detect fraudulent activity early by setting email or text alerts that let you know when your credit cards are used. If a card is used without your authorization, call the issuer immediately.
You may be told you have won something or even that you are in danger of being arrested. The caller claims to need personal, banking or credit information to verify your identity or to know where to send you money.
What you can do: Don’t give personal information out over the phone. Be aware of common phone scams. The IRS, for example, does not initiate contact with taxpayers by phone (or email or social media) to request personal or financial information, nor does it call with threats of arrest or lawsuits.
Looking over your shoulder — literally or figuratively
Fraudsters can learn a password just by watching your fingers as you key it in. The information on your credit card can be photographed with a smartphone while you shop online in a public place. A business might leave sensitive information where people can see it.
What you can do: Be aware of your surroundings, don’t leave cards where they can be seen and cover your hand when you key in passwords or codes.
Opening an email attachment or visiting an infected website can install malicious software on your computer, such as a keylogger. That does what it sounds like — logs every keystroke, giving criminals access to passwords, account numbers and more.
What you can do: Be cautious about clicking on attachments or links in emails and about the websites you visit. Use a password manager, which lets you avoid keying in log-in credentials.
Types of identity theft
Once a criminal has your info, here are common ways it may be exploited:
Credit identity theft
Credit identity theft happens when a criminal uses your personal information, such as birthdate and Social Security number, to apply for a new credit line.
How to tell: Your might see an unexpected change in your credit scores or an account you don’t recognize on your credit reports. You may get debt collection notices or a court judgment against you.
Can you prevent it? Yes. Freeze your credit unless you are actively seeking credit. Having a freeze is the most effective way to block opening of new credit accounts. If you are unwilling to freeze, consider a fraud alert, which requires a creditor to verify identity — typically with a phone call — when there’s a credit application in your name.
Child identity theft
Criminals steal a child’s identity and apply for credit in that child’s name. Often it is not discovered until the victim applies for college loans or other credit.
How to tell: If your child is getting offers of credit cards or phone calls about late payments or debt collections, investigate.
Can you prevent it? Yes, freeze your child’s credit.
Synthetic identity theft
Synthetic identity theft is when criminals use a patchwork of identity details to construct a consumer who never really existed, using a Social Security number that is not yet in the credit bureaus’ database. They then apply for loans and credit cards, max them out and disappear.
How to tell: If you try to freeze your child’s credit and discover their Social Security number is already in use.
Can you prevent it? Not necessarily. Sometimes criminals make up Social Security numbers, so there is a chance a child’s number may be in use even before it’s assigned. But freezing credit can keep it from happening after the number is assigned.
Taxpayer identity theft
Sometimes fraudsters use a Social Security number to file a tax return and steal your tax refund or tax credit.
How to tell: You may be unable to e-file because someone else has already filed under that Social Security number, you get an IRS notice or letter referencing some activity you knew nothing about or IRS records suggest you worked for an employer that you did not.
Can you prevent it? Maybe. Filing early can help you beat criminals to filing in your name, and some states offer six-digit Identity Protection PINs (after a rigorous verification) with additional security.
Medical identity theft
Using someone else’s identity to get health care services is medical identity theft. It’s particularly dangerous because it can result in medical histories being mixed, giving doctors and hospitals wrong information as they are making health care decisions.
How to tell: Read your explanation of benefits statements carefully. If you see claims or payments you do not recognize, investigate. If you’ve fallen victim, you’ll need to both report it to your insurance company and inform your health care team to be sure information in your health care records is actually yours.
Can you prevent it? Be wary of offers for “free” health services or products that require your health insurance data. When there’s a legitimate need to share your insurance information or Social Security information, such as with your doctor’s office, ask how they will protect it.
Criminals use personal data to access your financial accounts, then change passwords or addresses so that you no longer have access.
How to tell: If you have an email, letter or text from your financial institution, pay attention. If you did not take the action referenced, contact them right away.
Can you prevent it? To a large degree, no. You cannot completely eliminate all the risks to your personal data. But you can learn to recognize phishing scams and refrain from giving out account information in response to communications you did not initiate.
Criminal identity theft
Criminal identity theft occurs when someone gives law authorities someone else’s name and address during an arrest or investigation. This is often done with false identification, such as a fake driver’s license.
How to tell: You may be detained by a police officer for reasons that are unclear to you or be denied employment or a promotion because of something found in a background check.
Can you prevent it? No, and common identity theft protection tools do not detect it either. If you are a victim, you should report identity theft to the Federal Trade Commission and your police department; consider keeping a copy of the report with you until your name is cleared. Clearing your name will be your responsibility.
How to report identity theft
Start by reporting identity theft to the Federal Trade Commission and following its recommended steps to make a recovery plan. You may also need to contact your police department, the Postal Service and the credit bureaus.
If you have identity theft protection, you may be entitled to some help with recovering from identity theft. You may have resources you don't realize: For instance, if you were affected by the Equifax data breach, you are entitled to identity restoration services even if you did not file a claim.
Ways to protect yourself
There’s nothing you can do that will absolutely eliminate the risk of identity theft, but there are many things you can do to make yourself less of a target.
Protect your mobile device with a password. Lock your screen.
Use strong passwords and use a password manager. Consider using an authenticator service to approve log-ins.
Think carefully about what you post on social media so you don't give away key data or give identity thieves clues about how you answer security questions.
Shred paperwork you no longer need and keep needed materials secure.
Leave forms blank when a Social Security number is requested. If it is actually required, find out why and how it will be protected.
Use a banking app rather than a mobile browser for banking.
Read your bank and credit card statements carefully to make sure you recognize the activity. Also check your insurance explanation of benefits.