Identity Theft Protection Guide: Prevention and Recovery

Security Education: This article describes cyber threats for defensive awareness and education purposes only. Understanding how attacks work helps organizations and individuals protect themselves. Never use this information for unauthorized access or malicious purposes.

Identity theft is common, and most of it is the misuse of accounts people already have. In the Bureau of Justice Statistics’ most recent national survey, about 23.9 million people, or 9% of U.S. residents aged 16 and older, had been victims of identity theft in the previous 12 months. For 76% of them, the latest incident involved misuse of a single existing account, such as a credit card or bank account, and about 59% had financial losses of $1 or more, totalling $16.4 billion (BJS, Victims of Identity Theft, 2021, published October 2023).

Complaints to law enforcement show the same pattern. The FBI’s Internet Crime Complaint Center (IC3) logged 31,675 identity theft complaints with $185.8 million in reported losses in 2025, plus 67,456 personal data breach complaints with $1.31 billion in losses (IC3 2025 Internet Crime Report). Reported figures understate the problem because many victims never file a report.

Prevention is far easier than recovery. This guide covers both, starting with the steps that give the most protection for the least effort.

How Identity Theft Happens

Understanding the routes in helps you close them.

Data breaches. Large breaches, such as those at Equifax and T-Mobile or the many organizations hit through the MOVEit file-transfer software, expose names, addresses, Social Security numbers and account details for millions of people at once. You cannot prevent a company’s breach, but a credit freeze limits what a thief can do with your data.

Phishing. Fake emails, texts, calls and websites trick people into handing over passwords, account numbers or personal details, or into installing malware that collects them. Our Phishing Protection Guide 2026 covers layered defenses.

Mail theft. Statements, tax documents and pre-approved credit offers in physical mail contain much of what a thief needs. USPS Informed Delivery lets you preview incoming letter mail and notice when something expected never arrives.

Data brokers. People-search and marketing companies compile and sell personal information, which attackers can use to make phishing and social engineering more convincing.

Underground markets. Stolen personal and account data is traded on criminal forums and marketplaces, which is why a breach can lead to fraud months or years later.

Social media oversharing. Birthdays, pet names, schools and hometowns posted publicly can answer common security questions and help impersonators.

Prevention: The Defense Stack

Tier 1: Essential (Do These Now)

1. Freeze your credit at all three bureaus. A credit freeze restricts access to your credit report, so most lenders will not open new credit in your name while it is in place. The FTC confirms there is no cost to place or lift a freeze, and a freeze does not affect your credit score (FTC, credit freezes and fraud alerts). A freeze does not protect accounts you already have, which, according to BJS, is where most identity theft happens.

Equifax: equifax.com/personal/credit-report-services/credit-freeze
Experian: experian.com/freeze
TransUnion: transunion.com/credit-freeze

Lift the freeze temporarily when you apply for credit, then put it back.

2. Use a password manager with unique passwords. Credential stuffing, where attackers try passwords leaked in one breach on other sites, only works when passwords are reused. A password manager makes a unique password for every account practical. It does not make you immune to phishing, although its autofill will not offer your saved login on a lookalike domain, which is a useful warning sign.

3. Turn on multi-factor authentication for critical accounts. Start with email, because it is the recovery route for everything else, then banking, other financial accounts and cloud storage. Passkeys and FIDO2 security keys are the strongest option; CISA calls this phishing-resistant MFA “the gold standard” and warns that SMS codes and some app-based methods can be phished or intercepted (CISA fact sheet). An authenticator app is the next choice, and SMS codes are still better than no second factor.

4. Check your credit reports. AnnualCreditReport.com provides free credit reports from all three nationwide bureaus. Look for accounts, addresses or inquiries you do not recognize, and set a calendar reminder so you check regularly.

Tier 2: Important (Do These This Week)

5. Set up USPS Informed Delivery. Daily previews of incoming letter mail make it easier to spot statements or cards that should have arrived but did not.

6. Opt out of data brokers. Most data brokers offer an opt-out, but each has its own process and listings can reappear. Paid removal services automate the requests; check which brokers a service covers before paying.

7. Turn on login and transaction alerts. Email or push alerts for new logins and transactions on your email, bank and card accounts tell you quickly when someone else is using them.

8. Work through our online security checklist. A full review of your accounts, passwords and security settings catches gaps you may have missed.

Tier 3: Enhanced (For Higher-Risk Individuals)

9. Place a fraud alert. A fraud alert tells businesses that check your credit to verify your identity before opening a new account. It is weaker than a freeze but can be used alongside one. Under FTC guidance, an initial fraud alert lasts one year and can be renewed, an extended alert for identity theft victims lasts seven years, and an active-duty alert for service members lasts one year. You only need to contact one bureau, which must tell the other two.

10. Consider an identity theft protection service. Paid services bundle credit monitoring, dark web scanning, SSN monitoring and recovery help, and many include identity theft insurance. Most of the monitoring can be done free, so the main value is convenience and case-management help. Read the insurance terms to see what is covered and excluded before relying on it.

11. Get an IRS Identity Protection PIN. An IP PIN is a six-digit number that prevents someone else from filing a tax return using your Social Security number or ITIN. It is known only to you and the IRS, a new one is generated each year, and anyone with an SSN or ITIN who can verify their identity can enroll.

12. Use a VPN on untrusted networks. A VPN encrypts traffic between your device and the VPN provider, which helps on public Wi-Fi. It does not block phishing sites or protect data you type into a fake page.

Warning Signs of Identity Theft

Watch for:

Unfamiliar charges on credit card or bank statements
Bills or collection notices for accounts you did not open
Medical bills or insurance statements for care you did not receive
An IRS notice about a tax return you did not file
Being turned down for credit unexpectedly
Regular statements that stop arriving
Unfamiliar accounts or inquiries on your credit report
Debt collector calls about debts you do not owe
Login alerts for sessions you did not start

Recovery: What to Do If It Happens

If you discover identity theft, act quickly. Speed limits the damage.

Step 1: Document Everything

Record every fraudulent account, charge and contact. Keep copies of correspondence, with dates and the names of people you spoke with. This supports disputes and investigations.

Step 2: Report to the FTC

Go to IdentityTheft.gov and file a report. The FTC builds a personalized recovery plan with pre-filled letters for creditors and credit bureaus, and your FTC Identity Theft Report can be used as proof when disputing fraudulent accounts. If the theft involved an online scam or a data breach, you can also file a complaint with IC3.

Step 3: File a Police Report If Needed

Some creditors and agencies ask for a police report. If they do, file one with your local police and keep the report number. In the 2021 BJS survey, only about 7% of victims reported the incident to police, while 67% contacted a credit card company or bank.

Step 4: Contact Affected Financial Institutions

Call each bank, card issuer or lender where fraud occurred. Ask for fraudulent accounts to be closed and charges reversed, and ask for written confirmation once the fraud is resolved.

Step 5: Freeze Your Credit (If Not Already Done)

If you have not frozen your credit, do it now at all three bureaus. If your credit was already frozen and theft still occurred, the thief probably used an existing account rather than opening a new one.

Step 6: Secure Your Accounts

Change passwords on financial, email and other sensitive accounts using your password manager, and turn on MFA. Review signed-in devices and remove any you do not recognize. Check your email for forwarding rules or filters you did not create. Our credential compromise checklist walks through this in order.

Step 7: Keep Monitoring

Stolen information can be reused long after the first incident. Keep checking credit reports, bank statements and account alerts for at least a year, and keep fraud alerts or freezes in place.

How Long Recovery Takes

For most people, recovery is quicker than they fear, but a minority face long cases. In the 2021 BJS survey, 86% of victims had resolved the related financial or credit problems by the time they were interviewed. Of those, 56% spent one day or less, and about 10% spent a month or more. Victims who resolved all problems spent an average of 4 hours on them (median 1 hour), while those hit by several types of identity theft averaged 7 hours.

Out-of-pocket losses are less common than total losses, because card issuers and banks often reimburse fraud. About 12% of victims had out-of-pocket losses of $1 or more, with a mean of $790 and a median of $100. About 10% of victims reported being severely distressed by the crime, a cost that does not show up in the dollar figures.

Identity Theft Protection Services: Are They Worth It?

These services typically offer:

Credit monitoring across the three bureaus
Dark web scanning for your SSN, email and other data
Financial account monitoring
Recovery help from case managers
Identity theft insurance, with coverage that varies by policy

They may be worth it if:

You have already been a victim and want ongoing monitoring and help
Your data has been exposed in a breach and you will not monitor it yourself
You value having a case manager handle recovery paperwork

They are often unnecessary if:

Your credit is frozen, you use a password manager, and you check your reports and account alerts yourself
You are comfortable using the free tools: credit freezes, AnnualCreditReport.com, bank alerts, haveibeenpwned.com and IdentityTheft.gov

Key Takeaways

About 9% of U.S. residents aged 16 and older experienced identity theft in a year, mostly misuse of existing accounts (BJS)
Credit freezes are free and block most new-account fraud, but not misuse of accounts you already have, so account alerts matter too
Unique passwords from a password manager, plus MFA on email and financial accounts, close the most common routes in
IdentityTheft.gov gives you a structured recovery plan if theft occurs
Most victims resolve problems within a day, but cases involving several types of theft take longer

Next Steps

Build full phishing defenses with the Phishing Protection Guide 2026
Secure credentials with Best Password Managers 2026
Complete the Online Security Checklist for broader account protection
Protect devices with Best Antivirus Software 2026
Answer remaining questions in our Cybersecurity FAQ

Report identity theft at IdentityTheft.gov. For fraud on a financial account, contact your bank or card issuer immediately.

Identity Theft Protection: Prevention & Recovery