To check if someone is using your identity, you compare what’s on record about you against what you actually did: pull your credit reports from all three bureaus, review bank and card statements, look at your Social Security earnings history, request IRS transcripts, scan insurance Explanation of Benefits letters, monitor your mail, search court records under your name, and check whether your information appears in known data breaches. Discrepancies in any of those places are how identity theft shows itself. The steps below walk through each check and what to do the moment something doesn’t match.
Pull All Three Credit Reports
Credit files are where identity theft usually surfaces first. Federal law entitles you to one free report per year from each of the three nationwide bureaus through a single site.1Office of the Law Revision Counsel. 15 U.S. Code 1681j – Charges for Certain Disclosures The only site authorized by statute is AnnualCreditReport.com.2Annual Credit Report.com. Home Page You’ll need your full legal name, date of birth, Social Security number, and current and previous addresses to pass verification.
Once you have the reports, look at three things. The hard inquiries list shows every lender that pulled your file because someone applied for credit; an inquiry from a company you never contacted means someone tried to open an account in your name. The accounts section shows open and closed credit lines; unfamiliar cards, store accounts, or auto loans are obvious signals. The personal information header shows names, addresses, and employers on file; addresses where you’ve never lived, employers you don’t recognize, or slight misspellings of your name often mean a thief routed applications or mail through another location. Pull all three reports, not just one, because creditors don’t always report to every bureau.
Review Bank, Card, and Utility Statements
Thieves often test a stolen card or account number with a tiny charge before draining it, so look for unfamiliar transactions of any size, especially small ones from companies you don’t recognize. Cross-reference line items against your own receipts. Report anything that doesn’t match right away, because federal liability protections depend on how fast you act.
For credit cards, your maximum liability for unauthorized charges is $50 under federal law, and most issuers waive even that.3Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card To preserve your dispute rights, report billing errors in writing within 60 days of the statement date.4Federal Trade Commission. Using Credit Cards and Disputing Charges
Debit cards carry more risk. Report a lost or stolen card within two business days and liability caps at $50. Report after two business days but within 60 days of the statement date, and liability jumps to $500. Wait longer than 60 days and you can be responsible for everything the thief takes during and after that window.5GovInfo. 15 U.S.C. 1693g – Consumer Liability Check debit activity at least weekly if you suspect any compromise.
Look at utility and phone bills too. Thieves sometimes add secondary phone lines or upgrade service tiers on existing accounts to intercept verification codes or run up charges.
Check Your Social Security Earnings Record
When someone uses your Social Security number to get a job, their employer reports wages under your number, and those wages appear on your Social Security Statement. If reported earnings for any year exceed what you actually made, that’s a strong sign of employment-related identity theft. SSA is required to maintain these records and provide them on request.6Office of the Law Revision Counsel. 42 USC 405 – Evidence, Procedure, and Certification for Payments
Create a my Social Security account at SSA.gov to view your earnings history online.7Social Security Administration. Get Your Social Security Statement Compare each year against your own W-2s. Inflated earnings also distort future retirement benefit calculations and can trigger unexpected tax obligations.
Request Your IRS Transcripts
Tax-related identity theft usually shows up one of two ways: your e-filed return is rejected because a return was already filed under your Social Security number, or you get a notice about income from an employer you never worked for. Requesting transcripts lets you catch both before they escalate.
The IRS offers several transcript types at no charge through your online account at IRS.gov. For identity theft detection, the wage and income transcript is the most useful because it lists W-2s, 1099s, and other information returns filed under your Social Security number.8Internal Revenue Service. Transcript Types for Individuals and Ways to Order Them Income documents from employers you’ve never heard of mean someone is working under your number. The tax account transcript is also worth pulling; it shows whether a return was filed and processed for any given year.
If a fraudulent return was filed in your name, file IRS Form 14039 (Identity Theft Affidavit) with a paper tax return. The IRS assigns these cases to a specialized Identity Theft Victim Assistance team, which removes the fraudulent return, processes your legitimate one, and flags your account. The IRS acknowledges that resolution currently takes many months on average.9Internal Revenue Service. IRS Identity Theft Victim Assistance – How It Works
Look Yourself Up in Data Breach Records
Before anyone uses your identity, they need your information, and most of it comes from breaches. Free services like Have I Been Pwned let you enter your email address and see whether it appeared in any known breach, which breaches specifically, and what categories of data were exposed (passwords, phone numbers, physical addresses). You can also subscribe to alerts for future breaches.
A hit doesn’t prove someone has already committed identity theft against you, but it does mean your information is circulating where criminals trade stolen data. Treat it as a trigger to run every other check in this article and to change passwords on any account that shared the exposed credentials.
Watch Your Mail
A common tactic is filing a fraudulent change-of-address with USPS. Once mail is redirected, the thief intercepts statements, credit offers, tax documents, and anything else useful. You may not notice for weeks if you’re not expecting specific pieces.
USPS Informed Delivery emails you grayscale images of letter-sized mail being processed for your address. Sign up at informeddelivery.usps.com. If pieces shown in the daily email never arrive, something is wrong. If notifications stop entirely, someone may have changed your address. Watch for physical signs too: a sudden drop in mail volume, missing bills, or pre-approved credit offers addressed to someone else at your address.
Check Medical and Insurance Records
Medical identity theft is when someone uses your insurance to get healthcare, prescriptions, or equipment. The danger is not only financial. Fraudulent visits can inject someone else’s blood type, allergies, or diagnoses into your file, which creates a real safety risk in an emergency.
Read every Explanation of Benefits your insurer sends. Each lists the provider, date of service, procedure, and cost. Charges for doctors you never visited or procedures you never had mean someone is using your coverage.10Federal Trade Commission. What To Know About Medical Identity Theft Contact your insurer to dispute the charges and ask which providers billed under your plan. You also have the right to request copies of your medical records from any provider and to request amendments where the record contains fraudulent information.11eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
Search Court and Public Records Under Your Name
Criminal identity theft is one of the nastier variants. Someone gets arrested using your name and identification, and you end up with warrants, court records, or convictions attached to your identity. It often surfaces at the worst moment: a traffic stop, a background check for a new job, or a border crossing.
Many court systems offer online portals where you can search by name for active cases, warrants, traffic citations, and civil judgments. Check the county where you live and any county where your information may have been compromised. If you find records that aren’t yours, contact the court clerk and the arresting agency to correct the record. You’ll likely need to provide fingerprints and identification to prove you’re not the person who was arrested.
Check Whether a Child’s Identity Has Been Used
Children are attractive targets because a stolen minor’s Social Security number can go undetected for years. A child under 18 shouldn’t have a credit file at all, so finding one is itself a red flag. Other warning signs include collection calls about debts you didn’t open for your child, IRS notices about unpaid taxes tied to your child’s number, or a denial of government benefits because someone else is already receiving them under that number.12FTC Consumer Advice. How To Protect Your Child From Identity Theft
As a parent or guardian, contact each of the three bureaus to search for a file in your child’s name. TransUnion and Experian have online inquiry forms. Equifax requires a request by mail.13Consumer Financial Protection Bureau. How Do I Check To See if a Child Has a Credit Report If a file exists, dispute every account on it and place a credit freeze on the child’s file so no new accounts can be opened.
What to Do the Moment You Find Something
Two tools lock down your credit fast, and both are free under federal law.14Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts A credit freeze blocks creditors from accessing your report entirely, so no new accounts can be opened until you lift it. You place it with each bureau separately; the bureau has one business day (phone or online) or three business days (mail) to activate it. The freeze stays until you remove it, and you temporarily lift it with a PIN when you apply for credit yourself.
A fraud alert is lighter. It tells lenders to verify your identity before extending credit. You only need to contact one bureau, which must notify the other two. An initial alert lasts one year. If you’ve filed an identity theft report with the FTC or a police report, you qualify for an extended alert lasting seven years.15FTC Consumer Advice. Credit Freezes and Fraud Alerts For confirmed identity theft, a freeze is the stronger move. Fraud alerts rely on lenders actually verifying, and not all of them do.
If your investigation turns up actual fraud, file a report at IdentityTheft.gov. The site walks you through questions and generates an official FTC Identity Theft Report along with a personalized recovery plan. That report qualifies you for the extended fraud alert, helps you dispute fraudulent accounts, and is entered into a law enforcement database used by agencies nationwide.16Federal Trade Commission. IdentityTheft.gov Filing a false report is a federal crime, so only file when you have a genuine basis.
To protect future tax returns, request an IRS Identity Protection PIN. This six-digit number is required on your return before the IRS will process it, so a thief with your Social Security number but not your IP PIN can’t file a fraudulent return. Anyone with a Social Security number or ITIN can enroll through their IRS.gov online account, and parents can request one for dependents. If you can’t verify online, you can apply by mail using Form 15227 or schedule an in-person appointment at a Taxpayer Assistance Center.17Internal Revenue Service. Get an Identity Protection PIN A new PIN is generated each year, so retrieve it annually.