Signs of identity theft and how to spot them early

Identity theft happens when someone uses your personal or financial details without permission to impersonate you and gain access to money, credit, or services. Criminals can acquire this info in many ways, and misuse often continues unnoticed, which is why spotting early warning signs is important.

Cases of identity theft are widespread, and it can affect people across all ages and income levels. In this article, we cover the most common warning signs of identity theft and the steps you can take to catch problems early.

Please note: This information is for general educational purposes and does not constitute financial or legal advice.

What are the red flags and warning signs of identity theft?

Identity theft can show up in many ways. Here are some of the key things to look out for to help you detect an issue early.

1. Unrecognized bank or credit card transactions

You should check your financial statements regularly for suspicious purchases, ATM withdrawals, or transfers you don’t remember making. If something looks off, report it to your bank or credit card provider right away.

2. Unfamiliar inquiries on your credit report

When you apply for a loan, mortgage, or new credit card, lenders make what’s called a hard inquiry on your credit report. If you notice inquiries you didn’t authorize, it usually means someone is trying to apply for new credit in your name. These unauthorized inquiries are often the first clear sign that fraud is underway.

3. Unexpected bills or statements

Bills for services or accounts you never used or statements from companies you don’t recognize are both common identity theft red flags. Authorities such as the U.S. Federal Trade Commission list surprise bills and medical charges among typical identity theft warning signs.

4. Missing physical mail or fewer email notifications

If your bills, statements, or replacement cards suddenly stop showing up, it could mean someone changed your mailing address to hide their activity. Fraudsters may also tamper with your email by creating forwarding or deletion rules that divert security messages such as login alerts or password reset confirmations. This can prevent you from seeing critical warnings, giving criminals more time to misuse your accounts.

5. Sudden unexplained drop in your credit score

A sudden credit score drop can be the next sign of identity theft, usually after unfamiliar accounts or inquiries appear. Treat any unexplained fall in your score as a cue to review your reports for suspicious activity.

6. Denial of loan or credit applications

An unexpected denial can follow a credit score drop, which can be caused by fraudulent accounts set up in your name. Use the credit bureau named in the denial notice to pull your file and review unfamiliar entries. A single false entry can block approvals and harm your score.

7. Rejected tax return filings

If your tax return is turned down because one has already been submitted under your name, that is a strong sign of tax identity theft. In most cases, it means someone used your personal details to file early and claim a refund or benefits.

8. Calls from debt collectors about accounts you didn’t open

Collector calls for debts you don’t recognize usually mean that your identity has been misused. Treat these calls as a major red flag that identity fraud is already in progress.

9. Unusual activity in your Social Security account

For those in the U.S., another red flag is when your Social Security record shows earnings from jobs you never worked. That usually means someone else is using your Social Security number for employment purposes, as employers report wages to the SSA under the number provided. You might also see benefit changes you didn’t request or get letters about account activity that makes no sense to you.

10. Alerts that your data was exposed in a breach

A breach notice means your information could be misused. Treat it as an early sign that criminals may attempt to exploit your details. These alerts can come from the company that suffered the breach, your bank, or even credit bureaus that monitor exposure. A notice doesn’t always mean immediate damage, but it does raise your level of risk.

Stolen data is often sold on the dark web and may be combined with other leaks to build a complete profile of you. Criminals can then try to open accounts, impersonate you online, or launch targeted scams. Tools like ExpressVPN Identity Defender, available for users in the U.S., can help by scanning for new credit activity and breach exposures, then sending you actionable alerts so you can respond quickly.

How do I know if my ID is being used by someone else?

Accounts opened in your name without consent

If you see loans, cards, or accounts you never signed up for, it’s a strong sign your information has been misused. Start by pulling your credit reports and scanning for accounts or hard inquiries you don’t recognize.

If something looks off, reach out to the company’s fraud department and have the account frozen or shut down while they investigate. Ask them to give you copies of the application and any transactions tied to it, and keep a record of every call or email you make.

In some cases, the account may be part of a synthetic profile that mixes your real details with invented ones. If you suspect that’s happening, see our guide on synthetic identity theft to understand how it works and what to do next.

Unauthorized use of health insurance benefits

As noted earlier, medical claims or insurance summaries for care you never received can be indicators of medical identity theft. Ask your insurer and each provider for itemized records, review them for errors, and request corrections to your file.

If necessary, you can request a new policy or member number and ask for a fraud alert to be placed on the account. Keep copies of every letter, and note the dates and case numbers.

Criminal charges filed under your identity

If you learn about citations, warrants, or court notices that use your details but are not yours, an imposter may have used your identity during a police encounter. Contact the issuing court or agency to verify the record, file an identity theft report with local law enforcement, and provide proof of identity so the record can be corrected.

You can also request written confirmation of the outcome and ask how similar issues will be handled in the future. Consider legal counsel if the matter is complex.

How do I know if my SSN is compromised?

IRS notices about suspicious returns or wage reports

The IRS may contact you if it detects a suspicious tax return filed with your SSN. Letters like 5071C, 4883C, or 5747C will ask you to verify your identity and confirm whether you filed the return. If you didn’t, it means someone else may have submitted a fraudulent return in your name.

You may also receive notices about wages from employers you’ve never worked for, which is a sign your SSN has been misused. Follow the IRS instructions for victims immediately; this involves filing IRS Form 14039 (Identity Theft Affidavit).

Credit accounts or benefits linked to your SSN without approval

If new accounts or benefit notices appear under your SSN, review your earnings record through your my Social Security account and report misuse. Outside the U.S., apply the same approach to your national ID or tax number.

What to do if you spot signs of identity theft

If you suspect your information has been misused, it’s important to act quickly. We’ve covered the key steps here, but for a complete action plan, see our guide on what to do if your identity is stolen.

Document all suspicious activity

Write down every detail you can: dates, times, names, phone numbers, account numbers, and any case IDs or reference numbers you’re given. Keep copies of statements, letters, and screenshots, and record calls if the law in your area allows it. You should organize everything in a clear, consistent way so you can hand it over quickly if a bank, credit bureau, or investigator asks for proof.

Contact your bank, credit card issuer, or lender immediately

As soon as you notice suspicious activity, call the fraud team at your bank or card issuer. Ask them to secure or close affected accounts, reverse any unauthorized transactions, and issue new credentials or replacement cards. Always follow up in writing, and keep a record of confirmation numbers and case references so you have proof of what was agreed.

Also, check that your phone number, email, and mailing address on file are correct. If your contact details are outdated or changed without your knowledge, you could miss fraud alerts or replacement cards. Update them if needed, and turn on transaction and sign-in alerts so you’re warned about new activity right away.

Place a fraud alert or freeze your credit

In the U.S., you can place an initial fraud alert with any one of the three nationwide credit bureaus (Equifax, Experian, or TransUnion). That bureau must then notify the other two on your behalf. A fraud alert instructs lenders to take extra steps to verify your identity before opening new credit in your name, and it lasts for one year but can be renewed as many times as you like.

A credit freeze is stronger. It restricts access to your credit file entirely, so new accounts can’t be opened, even by you, until you lift the freeze with your PIN. You’ll need to contact each bureau individually to place or lift a freeze, but it’s free to do. If you confirm that new-account fraud has occurred, freezing your credit is often considered the safest option.

Report to the appropriate authorities

Filing a report gives you an official record you can use as proof when challenging fraudulent accounts or charges. In the U.S., you can file at IdentityTheft.gov. In other countries, you can report identity theft to your national consumer protection body, financial regulator, or data protection authority. If required or advised in your country, file a local police report as well, and keep the report number.

Reporting identity theft does more than create a paper trail; it also helps law enforcement and consumer protection agencies spot wider fraud patterns. When many victims file reports about the same scheme, investigators can trace how criminals operate and shut down entire networks. Even if your case feels small, your report could connect with dozens of others and lead to stronger protections for everyone.

Secure your accounts with stronger authentication

Start by resetting the passwords on your most important accounts, especially your email, since it controls password resets for many other services. Then move on to banking, shopping, and cloud accounts.

As you update passwords, review the recovery emails and phone numbers linked to each account and remove any that you don’t recognize. It’s also a good idea to revoke old devices, and to sign out of active sessions across all devices so intruders can’t stay logged in.

Finally, enable multi-factor authentication on your most sensitive accounts. Using a 2FA code generator like the one that comes with ExpressVPN Keys makes it far harder for criminals to regain access, even if they already know your password.

How to protect yourself from identity theft going forward

Monitor your credit reports regularly

Check your credit reports a few times a year to avoid missing unfamiliar accounts or inquiries that may sit unnoticed for months. In the U.S., Equifax, Experian, and TransUnion provide free weekly online reports through AnnualCreditReport.com. Pair this habit with alerts from your bank or card apps, so new transactions are flagged instantly.

Use strong, unique passwords and enable MFA

Use a password manager such as ExpressVPN Keys to create and store strong, unique passwords for every account. Turn on multi-factor authentication wherever it is available: ExpressVPN Keys can generate time-based one-time passcodes for supported sites so you can manage both passwords and 2FA codes in one place. If a password is exposed in a breach, replace it immediately and don’t reuse it anywhere else.

Safeguard your physical documents and mail

Keep passports, national ID cards, Social Security or tax numbers, and birth certificates in a locked location. Store recent bank and tax records securely, and shred documents that contain personal data before disposal. If you move, set up mail forwarding promptly and confirm address changes with banks, insurers, and government portals.

Be cautious with public Wi-Fi and use a VPN

Public Wi-Fi in places like cafes, airports, and hotels can be unsecured or poorly configured. Attackers can set up fake networks with convincing names or intercept traffic on open hotspots. This means that it’s risky to use public Wi-Fi for banking, shopping, or changing account settings.

If you do need to connect, you should do so using a trusted VPN like ExpressVPN. VPNs encrypt your internet connection so people on the same hotspot can’t see what you are doing, even if the Wi-Fi network itself is compromised.

You should also take other sensible precautions, like confirming the exact network name with staff before you connect and turning off auto-join and disabling file sharing on your device. Remember to log out of all accounts when you’re finished, especially on shared computers.

Use an identity theft monitoring service

Identity theft monitoring services keep watch for new credit inquiries, accounts opened in your name, or signs that your personal data has been exposed in a breach. When suspicious activity is detected, you receive an alert so you can take action before the problem grows.

If you’re in the U.S., ExpressVPN’s Identity Defender offers a whole suite of identity theft protection tools, including Credit Scanner, which lets you track your credit score, receive alerts about new activity, and review monthly reports on accounts and balances. It also provides ID Alerts to keep you aware of any suspicious activity involving your details and ID Theft Insurance, so you have access to financial help should the worst happen.

When to seek professional help for identity theft protection

Most cases of identity theft can be resolved by filing reports, placing fraud alerts, and disputing accounts directly. But if the problem continues or becomes complex, you may need additional support:

• Law enforcement: File a police report if you’re a victim of criminal identity theft, such as someone giving your name during an arrest.
• Nonprofit credit counselors: Organizations approved by the National Foundation for Credit Counseling (NFCC) can help if stolen identities leave you with damaged credit or overwhelming debt.
• Legal aid: If identity theft results in false criminal records, lawsuits, or disputes with creditors, free or low-cost help may be available through nonprofit legal aid offices funded by the Legal Services Corporation. These offices provide civil legal assistance to low-income U.S. citizens.