How Can Someone Steal Your Identity and What to Do

Someone can steal your identity through five main channels: corporate data breaches that leak millions of records at once, phishing emails and malware that capture your logins and keystrokes, phone scams and voice-cloning calls that trick you into handing over information, physical theft of mail, trash, or your wallet, and card skimmers hidden on gas pumps and ATMs. Understanding how identity theft happens is the first half of protecting yourself; knowing exactly what to do in the first 48 hours after you discover it is the other half.

Data Breaches and Stolen Records

Companies hold huge stores of names, birth dates, Social Security numbers, and payment details, and attackers break into those databases by exploiting software flaws or weak encryption. The stolen records get bundled and sold on dark web marketplaces, where other criminals buy them to open fraudulent accounts, apply for loans, or file tax returns in your name.

A subtler use of breached data is synthetic identity theft. A criminal pairs a real Social Security number, often a child’s or an elderly person’s, with a fabricated name and date of birth, then slowly builds a credit profile under the invented persona. Because the identity doesn’t match any single real person, the fraud can go undetected for years.

Every state requires companies to notify affected individuals after a breach. About 20 states set specific deadlines between 30 and 60 days; the rest require notification “without unreasonable delay.” When you get one of those letters, place a credit freeze with all three major credit bureaus: Equifax, Experian, and TransUnion. A freeze is free, stops new creditors from pulling your report, and blocks most fraudulent account openings. You contact each bureau separately, and you can lift the freeze temporarily when you want to apply for legitimate credit.¹

A fraud alert is a lighter option. You contact just one bureau and it notifies the other two. An initial fraud alert lasts one year and requires creditors to take extra verification steps before opening new accounts in your name.²

Phishing Emails and Malware

Phishing starts with a message dressed up as one from your bank, a shipping company, or another trusted source. Click the link and you land on a fake login page that mirrors the real site. When you enter your username and password, the attacker captures both in real time and walks straight into your account.

Malware takes a different route. It installs itself on your computer or phone through a malicious attachment or a compromised website, often without your knowledge. Keylogger malware records every keystroke, capturing credit card numbers, passwords, and security codes as you type them, then sends the data to remote servers for use or resale.

Accessing a protected computer without authorization is a federal crime, with first-time offenders facing up to 10 years in prison.³ To defend yourself, keep your operating system and apps updated and turn on multi-factor authentication everywhere you can. The strongest form is a physical security key, a small USB or NFC device that uses cryptographic verification tied to the specific website you’re logging into. Unlike a text-message code, a security key cannot be fooled by a fake login page because it verifies the site’s identity before responding.

Phone Scams, Voice Cloning, and SIM Swaps

Social engineering targets you directly rather than your devices. In a vishing call, a scammer poses as someone from the IRS, the Social Security Administration, or your bank, spoofs the caller ID so the number looks legitimate, and manufactures urgency: your benefits are being suspended, there’s a warrant for your arrest, your account has been compromised. The pressure is designed to get you to hand over your Social Security number, bank details, or a one-time passcode.

AI voice cloning has made these scams far more convincing. A few seconds of audio pulled from social media or voicemail is enough to generate a realistic copy of someone’s voice, which the attacker then uses to impersonate a boss, family member, or business partner requesting an urgent wire transfer. If you get an unexpected call asking for money or personal information, even from a voice you recognize, hang up and call the person back at a number you find independently.

SIM swapping bypasses your phone entirely. A criminal contacts your wireless carrier and convinces a representative to transfer your phone number to a new SIM card. Once the swap is done, the attacker receives all your calls and texts, including the two-factor authentication codes that guard your bank, email, and social media accounts. The FCC has adopted rules requiring carriers to verify your identity before processing SIM swaps, and full implementation is still ongoing.⁴ Set a PIN or passphrase on your carrier account, and use app-based or hardware-key authentication instead of text codes wherever possible.

The rule of thumb: no legitimate government agency will call you out of the blue demanding immediate payment or threatening arrest.

Mail Theft, Trash, and Stolen Wallets

Low-tech identity theft still works. Thieves watch unsecured mailboxes for pre-approved credit card offers, tax forms, bank statements, and new checks, all of which contain enough personal data to open fraudulent credit lines. Stealing mail is a federal crime that carries up to five years in prison.⁵ Use a locked mailbox or a P.O. box, and switch to paperless statements when possible.

Dumpster diving gives criminals account numbers and Social Security numbers from bank statements, medical bills, and utility invoices you tossed. Shred anything sensitive before it hits the trash.

A stolen wallet is an immediate jackpot. A driver’s license paired with a Social Security card is everything a thief needs for full-scale identity fraud. Don’t carry your Social Security card, and keep copies of your important documents stored securely at home so you can move fast if a wallet goes missing.

Card Skimmers and Shimmers

Skimming uses hardware to steal your payment information during a normal transaction. Criminals attach thin electronic devices over the card readers at gas pumps and ATMs. The skimmer reads the magnetic stripe on your card while a small hidden camera or keypad overlay captures your PIN. The stolen data becomes a cloned card used for unauthorized withdrawals and purchases.

Shimming is the newer variant, aimed at the EMV chip in modern cards. A paper-thin device slides into the card slot and intercepts the data exchanged between the chip and the reader. Some criminals also use portable radio-frequency readers to capture data from contactless tap-to-pay cards in crowded places, all without you ever losing physical possession of the card.

Before you insert a card at a gas pump or ATM, look for loose parts or anything that appears added on top of the original hardware. A digital wallet like Apple Pay or Google Pay is safer still: these services replace your actual card number with a one-time token for each transaction, so even a compromised terminal never gets your real card information.⁶

Targets Worth Watching: Children, Tax Returns, and Medical Records

Your Child’s Social Security Number

Children are appealing targets because they have clean credit histories and their Social Security numbers are rarely monitored. A criminal can use a child’s number to open credit accounts, claim government benefits, or get a job, and the fraud may not surface until the child applies for their first student loan. If someone uses your child’s number for employment, the employer reports the income to the IRS under your child’s number, which can create tax problems later.⁷

Parents and legal guardians can place a free credit freeze on a child under 16 with each of the three bureaus. The process is done by mail, and you’ll typically need proof of your identity, proof of your relationship to the child (a birth certificate works), and the child’s Social Security number. If a credit file already exists for a child who has never applied for credit, that alone is a red flag worth investigating.

Fraudulent Tax Returns

Tax identity theft happens when someone files a return under your Social Security number to claim your refund. You usually find out when you file your legitimate return and the IRS rejects it because a return has already been submitted. Submit IRS Form 14039 (Identity Theft Affidavit) to alert the IRS and start the resolution process.⁸ The IRS target is 120 days to resolve a case, but a backlog has pushed actual average processing to roughly 22 months, and your legitimate refund is held up the whole time.⁹

To prevent it in the first place, request an Identity Protection PIN from the IRS. An IP PIN is a six-digit number you include on your federal return each year; without it, the IRS rejects any return filed under your Social Security number. Anyone with a Social Security number or Individual Taxpayer Identification Number can enroll, and the fastest route is through your IRS online account. The PIN changes each year and has to be retrieved annually.¹⁰

Medical Identity Theft

Sometimes stolen information is used to obtain medical care, prescriptions, or insurance benefits in your name. That can corrupt your health records with someone else’s diagnoses and treatments, which introduces potentially dangerous errors into your medical history. Warning signs are bills or Explanation of Benefits statements for services you never received, prescriptions you don’t take, or notices that you’ve hit your insurance benefit limit.¹¹

If you suspect medical identity theft, contact every doctor, clinic, hospital, pharmacy, and insurance company where the thief may have used your information and request copies of your records. Review them for visits, procedures, or charges you don’t recognize, and report errors to your provider in writing. Your provider must respond within 30 days and notify other providers who may hold the same incorrect information.¹¹

What to Do If Your Identity Is Stolen

Acting fast limits the damage. Start at IdentityTheft.gov, the FTC’s recovery portal. The report you generate there serves as proof to businesses and creditors that your identity was stolen, and the site walks you through a personalized recovery plan with pre-filled letters and forms.¹²

That report unlocks a legal protection worth using. Once you send a credit bureau your identity theft report along with proof of identity and a description of the fraudulent accounts, the bureau must block the fraudulent information from your credit file within four business days.¹³ The bureau also has to notify the companies that reported the fraudulent data so they can update their own records.

Beyond the FTC report, take these steps as soon as possible:

Contact Equifax, Experian, and TransUnion individually to freeze your credit reports. This is free and prevents new accounts from being opened in your name.¹
File a report with your local police. Some creditors and insurers require a police report in addition to the FTC identity theft report.
Call your bank, credit card companies, and any other financial institutions where you have accounts. Ask them to flag your accounts and issue new cards or account numbers.
If you suspect your Social Security number was used to file a fraudulent tax return, submit Form 14039 to the IRS and request an Identity Protection PIN for future filings.¹⁰
Check your credit reports regularly at AnnualCreditReport.com, where you can get free reports from all three bureaus.⁷

Resolving identity theft takes time. Simple cases wrap up in a few weeks; cases involving tax fraud or medical identity theft can stretch well past a year. Keep detailed records of every call, letter, and dispute you file so you can track your progress and prove your case if any creditor or agency pushes back.

1
FTC: Consumer Advice. Credit Freezes and Fraud Alerts
2
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
3
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
4
Federal Communications Commission. SIM Swap and Port-Out Fraud Order Compliance
5
Office of the Law Revision Counsel. 18 USC 1708 – Theft or Receipt of Stolen Mail Matter Generally
6
Mastercard. Tokenization Explained: Protecting Sensitive Data and Strengthening Every Transaction
7
Social Security Administration. Identity Theft and Your Social Security Number
8
Internal Revenue Service. How IRS ID Theft Victim Assistance Works
9
Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds
10
Internal Revenue Service. Get an Identity Protection PIN
11
FTC: Consumer Advice. What To Know About Medical Identity Theft
12
Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover From Identity Theft
13
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft