Examples of Identity Theft: 6 Common Types and Warning Signs

There are six common examples of identity theft: financial, tax, medical, criminal, synthetic, and employment. Each one exploits a different piece of your personal information — a credit card number, a Social Security number, an insurance ID, even just your name at a traffic stop — and each leaves a different kind of mess to clean up. Federal law under 18 U.S.C. § 1028 makes it a crime to use another person’s identifying information to commit fraud or any other unlawful activity.¹ Knowing which type you’re dealing with tells you where to report it and what to do next.

Financial Identity Theft

Financial identity theft is the version most people picture. Someone uses your personal data to steal money directly or to open accounts in your name. To get past a bank’s verification checks, thieves typically need your Social Security number, date of birth, and full name. With that combination, they can make unauthorized purchases on your existing credit cards, initiate wire transfers, or drain checking and savings accounts.

The bigger payoff comes from opening entirely new accounts: personal loans, high-limit credit cards, auto loans — all under your name and Social Security number. You won’t know until a collector calls, a credit alert fires, or you pull your own credit report and find accounts you never opened. Some thieves also file a fraudulent change-of-address request with the postal service so you never see the bills or statements in the first place.

Federal penalties scale with the amount stolen. Where the thief obtains $1,000 or more in value during a single year, the offense carries up to 15 years in prison and a fine of up to $250,000.¹² When the identity theft is committed during another felony such as wire fraud, bank fraud, or a passport offense, a mandatory additional two-year consecutive prison sentence applies under the aggravated identity theft statute.³

Tax Identity Theft

Tax identity theft has one goal: file a fraudulent return before you do and pocket your refund. The thief only needs your Social Security number and enough personal details to fill out a plausible Form 1040. They submit early in the filing season, often January or February, and the IRS processes the refund electronically within weeks.⁴

When you file your legitimate return, the IRS rejects it because a return using your Social Security number is already on file.⁵ You then enter a resolution process that starts with filing Form 14039 (Identity Theft Affidavit) and waiting for the IRS to investigate. That wait is substantial. In fiscal year 2024, the average processing time for identity theft victim assistance cases hit 676 days — nearly two years before the taxpayer received their rightful refund.⁶

The scheme sometimes involves claiming false dependents or inflating income credits. Filing a fraudulent tax return is a felony carrying up to three years in prison per return plus fines of up to $100,000.⁷ If the fraud also qualifies as aggravated identity theft, an additional two-year mandatory sentence runs on top of that.³

Medical Identity Theft

Medical identity theft happens when someone uses your name, insurance information, or Medicare number to get medical care, fill prescriptions, or submit insurance claims.⁸ A thief might visit an emergency room under your name, schedule elective surgeries, or fill prescriptions for controlled substances, all billed to your insurer.⁹

The financial damage is bad enough, but the real danger sits in your medical file. When someone else receives care under your identity, their blood type, allergies, drug history, and diagnoses get mixed into your records. A doctor treating you in an emergency might see the wrong blood type on file. A pharmacist might flag a dangerous drug interaction based on prescriptions that were never yours. This is the kind of identity theft that can endanger your life, not just your wallet.

If you discover fraudulent entries, you have a right under HIPAA to request an amendment to your medical records.¹⁰ The provider must act on your request within 60 days.¹¹ If the provider denies the amendment because they believe the record is accurate, you can submit a written statement of disagreement that must be attached to your file going forward.

Criminal Identity Theft

Criminal identity theft occurs when someone gives your name and personal information to police during a traffic stop, arrest, or field interview. The officer writes the citation or files the arrest report under your identity, and you have no idea it happened. If the impersonator skips the court date, a bench warrant gets issued in your name. You could be pulled over for a broken taillight and find yourself handcuffed on an outstanding warrant for a crime you know nothing about.

Clearing your name is one of the most frustrating processes in all of identity fraud. You generally need to file a police report in the jurisdiction where the crime occurred, gather documentation proving your identity, and then petition the court for a judicial finding of factual innocence to get the arrest record expunged. Some states run identity theft passport programs through the Attorney General’s office that can help streamline the process, but even in the best case, it means multiple court appearances and months of effort.

Ask law enforcement to search local, state, and federal databases for any other warrants or convictions filed under your name. Criminal identity theft can happen more than once if the same thief keeps your information, and it’s better to discover all the records at once than to get blindsided by another warrant six months later.

Synthetic Identity Theft

Synthetic identity theft is the slow-burn version. Instead of stealing a whole identity, the thief combines a real Social Security number, often belonging to a child, a recently deceased person, or an elderly individual, with a fabricated name and address to create an entirely new persona. Because the Social Security number is technically valid, it passes automated checks that would catch a completely fake number.

The thief then patiently builds credit under this hybrid identity, sometimes over two or three years. They apply for a small secured credit card, make payments on time, and gradually request limit increases. Once the credit lines are high enough, they max out every account at once and vanish. Lenders write off the balances as losses, and the real owner of the Social Security number — often a teenager who has never applied for credit — discovers the wreckage years later when applying for a first student loan or apartment.

Industry estimates put annual U.S. losses from synthetic identity fraud in the range of $20 billion to $35 billion, and it represents as much as 80% of new-account fraud in some segments of the credit market. The long buildup period and the absence of a traditional victim complaint make it one of the hardest types for financial institutions to detect.

Protecting Children From Synthetic Identity Theft

Because children are prime targets, parents should periodically check whether a credit file exists in their child’s name. Contact each of the three major credit bureaus, Equifax, Experian, and TransUnion, to request a search of their database for a credit report tied to your child’s Social Security number.¹² If no credit file exists, that’s good news; it means no one has used the number to open accounts. If one does exist, contact the bureau immediately to dispute the fraudulent accounts and freeze the file.

Employment Identity Theft

Employment identity theft happens when someone uses your Social Security number to get hired, typically because they lack work authorization or have a criminal record that would fail a background check. The employer runs everything through your Social Security number, including payroll, tax withholding, and W-2 filings, and neither the employer nor the thief has any incentive to tell you.¹³

The first sign is usually a notice from the IRS saying you underreported income, because the wages the thief earned show up on your tax transcript. Your Social Security earnings record also gets inflated with income you never made, which can affect benefit calculations down the road. The IRS may send a CP01E notice alerting you that your Social Security number was used for employment purposes and placing an identity theft indicator on your tax account.¹⁴

If this happens to you, do not report the thief’s income on your own return. Contact the Social Security Administration to review and correct your earnings record, and respond to any IRS notices promptly. The SSA will work with you to remove wages that don’t belong to you, though the process can take several weeks.¹³

Warning Signs Your Identity Has Been Stolen

Most victims don’t realize what’s happened until the damage is well underway. A few patterns cut across all six types:

Withdrawals or charges you didn’t authorize on bank or credit card statements.
Bills or statements that suddenly stop arriving, which could mean someone filed a change-of-address redirect.
Debt collectors contacting you about accounts you never opened.
Explanation-of-benefit notices from your insurer for treatments or prescriptions you never had.
An IRS rejection when you file your tax return, a notice that more than one return was filed under your Social Security number, or reported income from an employer you’ve never worked for.
New credit cards, loans, or collection accounts you don’t recognize on your credit report.

Any one of these warrants an immediate credit report review. You’re entitled to free weekly credit reports from all three major bureaus through AnnualCreditReport.com.

What to Do If You’re a Victim

Speed matters. The sooner you act, the less damage accumulates, and for debit card fraud, reporting timelines directly determine how much money you can recover.¹⁵ The sequence that works best in most cases:

Place a fraud alert or credit freeze. A fraud alert is faster; one phone call to any bureau covers all three. An initial fraud alert lasts at least one year, and an identity theft report qualifies you for an extended alert lasting seven years. A credit freeze is stronger because it blocks all new account openings until you lift it. Both are free.¹⁶¹⁷
Pull reports from all three bureaus and flag every account or inquiry you don’t recognize. You have the right to dispute inaccurate information, and the bureau must investigate and correct or remove unverifiable entries, usually within 30 days.¹⁸
Report to the FTC at IdentityTheft.gov to create a personalized recovery plan. The site walks you through closing fraudulent accounts, disputing charges, and correcting your credit report.¹⁹
File a police report. It isn’t always legally required, but it strengthens your case with creditors and is sometimes needed to obtain an extended fraud alert or dispute fraudulent debts. Bring a copy of your FTC report, a government-issued photo ID, and proof of address.²⁰
Get an IRS Identity Protection PIN. Anyone with a Social Security number or ITIN can enroll. The six-digit PIN goes on your return each year and blocks anyone who doesn’t have it from filing under your Social Security number.²¹

For tax-related theft specifically, file Form 14039 with the IRS and continue filing your legitimate returns on time while the investigation is pending. For employment-related theft, contact the Social Security Administration to correct your earnings record. For criminal identity theft, consult an attorney; getting warrants quashed and records expunged typically requires court filings in the jurisdiction where the crime was committed.

One preventive step is worth taking before any theft happens: freeze your credit. It costs nothing, lasts until you lift it, and stops most new-account fraud cold. You can lift it in minutes online when you actually need to apply for credit. If you have children, freezing their credit files is worth the effort too. Since children rarely need credit, a freeze can sit in place for years and shut down synthetic identity theft before it starts.

1
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
2
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
3
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
4
IRS.gov. Taxpayer Guide to Identity Theft
5
Internal Revenue Service. Identity Theft Guide for Individuals
6
Taxpayer Advocate Service. Identity Theft Awareness and Update on IRS Processing of Identity Theft Victim Assistance Cases
7
Office of the Law Revision Counsel. 26 USC 7206 – Fraud and False Statements
8
Federal Trade Commission. What To Know About Medical Identity Theft
9
Federal Bureau of Investigation. Health Care Fraud
10
HHS.gov. Summary of the HIPAA Security Rule
11
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
12
Consumer Financial Protection Bureau. How Do I Check to See if a Child Has a Credit Report?
13
Internal Revenue Service. Guide to Employment-Related Identity Theft
14
Internal Revenue Service. Understanding Your CP01E Notice
15
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
16
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts
17
Federal Trade Commission. Fraud Alerts and Credit Freezes: Whats the Difference?
18
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
19
Consumer Advice – FTC. Stolen Identity? Get Help at IdentityTheft.gov
20
Justice.gov. Identity Theft and Identity Fraud
21
Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)