Identity Protection · 11 min

Signs of Identity Theft: Warning Signs and What to Do Next

How to know if your identity has been stolen: the warning signs on credit reports, bills, medical statements, and IRS letters, and the steps to take the week you spot one.

By Trident Research Team

Last updated: October 2026

Affiliate Disclosure: Trident is reader-supported. Some links on our site are affiliate links. When you buy through those links, we may earn an affiliate commission — at no extra cost to you. Links to a brand's official site are not affiliate links. Learn more

People searching for signs of identity theft, or how to know if your identity has been stolen, usually have one concrete thing in front of them. A collection call. A loan denial. A letter from the IRS. An Explanation of Benefits for a doctor they never saw. This page is the checklist for those warning signs, and the order IdentityTheft.gov gives once a sign is real.

A company breach notice means your information was exposed. The checks below are how you find out whether someone is using it. If the only thing you have is the notice, start with what to do after a data breach. If a credit report, a bill, or the IRS already shows a problem, stay here.

The facts below come from the Federal Trade Commission, IdentityTheft.gov, AnnualCreditReport.com, and the IRS. Where a step is the agency's own instruction, it is labeled that way.

If you already see a sign, do these three things first

IdentityTheft.gov's "What To Do Right Away" list starts in this order. Call the fraud department of each company where you know fraud occurred, and ask them to close or freeze those accounts. Place a free, one-year fraud alert by contacting one of the three nationwide credit bureaus. Get your credit reports and report the theft at IdentityTheft.gov. The longer sequence, including a credit freeze, is in the step-by-step section below.

After those free steps, some people want a service that watches credit files and helps with the paperwork. Aura is the identity theft protection service we review for that job. Plan details are on the review. The button below is an affiliate link.

See Aura

Identity theft warning signs

The FTC's consumer guidance treats these as reasons to look closer. One unfamiliar item is enough to start the steps.

Sign	Where it shows up
Account or inquiry you do not recognize	Credit report from Equifax, Experian, or TransUnion
Charge, withdrawal, or new bill you did not expect	Bank statement, card statement, or a bill in the mail
A bill that stops arriving	Mail you usually receive
Debt collector calling about a debt that is not yours	Phone, letter, or a collection on your credit report
Credit, a job, insurance, or housing denied from your credit report	Adverse action notice naming a credit bureau
More than one tax return, or wages from an employer you do not work for	IRS letter, or an e-file the IRS rejects as a duplicate
Medical bill or Explanation of Benefits for care you did not get	Health plan, provider bill, or a medical collection on a credit report
Unemployment benefits you did not apply for	Notice from your state unemployment office or your employer
Password-reset or lockout message you did not request	Email or text from a bank, email provider, or other account

Unfamiliar accounts and inquiries on a credit report

The FTC says to get your free credit report at AnnualCreditReport.com and review it for accounts you did not open or inquiries you do not recognize. A new credit card, a personal loan, or a car loan shows up as a new account. A new cell phone plan, or a utility such as water, gas, or electric, shows up as an inquiry. Read the address and employer lines too. A wrong address can mean someone changed where the bills go.

Bills, missing mail, and debts you do not owe

On the FTC's "What To Know About Identity Theft" page, a bill that stops arriving can mean someone changed the billing address. Charges for things you did not buy, and a new bill you did not expect, are listed the same way. So are withdrawals you did not make. Debt collectors calling about debts that are not yours are on the FTC's warning list as well. The FTC also suggests signing up for text or email alerts from your bank or card company for each new transaction, so a small charge shows up before a statement does.

An unexpected denial belongs in the same check. The FTC's free credit reports guidance says that if an application for credit, employment, insurance, or housing is denied, or another unfavorable action is taken, based on your credit report, you get an adverse action notice. That notice names the bureau. You can request your report from that bureau within 60 days of the notice. The denial itself is the prompt. The report is where you see whether an account you never opened is the reason.

IRS notices and duplicate tax returns

The FTC says a notice that more than one tax return was filed in your name, or that you have income from an employer you do not work for, is a sign of tax identity theft. You can also find out when you file. If you mail a return, the IRS sends a letter explaining that it received more than one return in your name. If you file online or through a preparer, the IRS can reject the return as a duplicate. The IRS identity theft guide for individuals says an IRS letter or notice is sometimes the first sign, and that the IRS may also fax to verify income, withholding, or employment. Open the letter. The steps for answering it are in the tax section below.

Unfamiliar medical bills

The FTC says to review medical bills and Explanation of Benefits statements for services you did not get. An Explanation of Benefits tells you the provider, the date, the services, the cost, what the plan covered, and what you owe. It is a statement from the health plan. The FTC's medical identity theft page also says to look at credit reports for medical billing errors, including medical debt collection notices you do not recognize. A family member's visit can appear on your statement. Compare the name, the date, and the provider before you treat a line as fraud.

Unemployment benefits you did not request

The FTC lists a notice from your state unemployment office, or from your employer, about unemployment benefits you did not apply for. Treat that notice as a warning sign and follow the contact instructions on it. Then run the credit-report and IdentityTheft.gov steps, because the same Social Security number can be used for more than the benefit claim.

Password-reset emails you did not request

A password-reset email, a login alert, or a lockout message you did not request means someone is trying to get into an account you already have. That is account takeover. It sits next to the credit-report signs because a thief who gets into email can reset the bank, the card, and the IRS online account. The FTC's recovery steps say to change logins, passwords, and PINs for accounts where fraud occurred. Its identity-theft guidance also says to use passwords that are hard to guess, and to add multi-factor authentication, such as a code by text, on accounts that offer it.

Give each account its own password so one reset does not open the rest. NordPass is the password manager we review for that. Our password manager roundup compares it with other products. The button uses Trident's NordPass affiliate link.

See the current price at our link

How to check

Work through the records the FTC names. You are looking for accounts, inquiries, addresses, charges, and benefits that are not yours.

Free credit reports at AnnualCreditReport.com

The FTC says AnnualCreditReport.com is the only website authorized to fill orders for the free credit reports you are entitled to by law. The other ways to order are to call 1-877-322-8228, or to mail the Annual Credit Report Request Form to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. The FTC says other sites may charge you or may be set up to steal your information.

Federal law gives you a free report from each nationwide bureau every 12 months. On top of that, the FTC says Equifax, Experian, and TransUnion have permanently extended weekly access: you can check your report from each bureau once a week for free at AnnualCreditReport.com. Order all three. Each bureau gets information from different sources, so an account can show up on one report and be missing from another.

On each report, mark:

Accounts you did not open, including cards, loans, and collections
Inquiries you do not recognize, including phone and utility inquiries
Names, addresses, or employers that are not yours
Medical collections for care you did not receive

If you have an adverse action notice, the FTC says you can also request a free report from the bureau named in the notice, within 60 days. You can request a free report in other listed situations too, including when your report is inaccurate because of fraud. The weekly reports at AnnualCreditReport.com are available either way.

Statements, benefits, and IRS mail

Read bank and credit card statements for charges and withdrawals you did not make, including small ones. Turn on the transaction alerts your bank already offers. Read each Explanation of Benefits when it arrives. For the IRS, the identity theft guide says to verify that a letter or notice is from the IRS, then follow the instructions in it. Keep the envelope and the notice with the rest of your records.

What to do if you spot these signs

Use this sequence when a check above turns up misuse. It follows IdentityTheft.gov's right-away list, then its next steps. Write down who you spoke with, the date, and any reference number. Keep letters and confirmation emails.

Call the companies where you know fraud occurred. IdentityTheft.gov says to call the fraud department, say that someone stole your identity, and ask the company to close or freeze the accounts so nobody can add new charges unless you agree. Change the logins, passwords, and PINs. You may have to contact the same companies again after you have an FTC Identity Theft Report.
Place a free one-year fraud alert with one credit bureau. Contact Equifax, Experian, or TransUnion. That bureau must tell the other two to place the alert. A fraud alert is free. IdentityTheft.gov says it makes it harder for someone to open new accounts in your name, because a business must verify your identity before it issues new credit. You can renew the alert after one year. Each bureau will send a letter confirming the alert. IdentityTheft.gov lists these contacts: Equifax at 1-800-685-1111, Experian at 1-888-397-3742, and TransUnion at 1-888-909-8872. Confirm the current numbers on IdentityTheft.gov when you call.
Get your credit reports and list what is not yours. Order them at AnnualCreditReport.com or call 1-877-322-8228. The FTC says you can check each bureau's report every week for free. Note every account or transaction you do not recognize. That list is what you give the FTC and, if you file one, the police.
Report the theft at IdentityTheft.gov. Complete the form at IdentityTheft.gov or call 1-877-438-4338. Include as much detail as you have. The site creates your Identity Theft Report and a personal recovery plan. The report is what you show businesses as proof that someone stole your identity. If you create an account, IdentityTheft.gov says it will walk you through the steps and update the plan. If you do not create an account, print and save the report and the plan before you leave the page. To report in Spanish, the FTC points to RobodeIdentidad.gov, or the same phone number with an interpreter.
Decide whether to file a police report. IdentityTheft.gov says you may choose to file with your local police. Bring a copy of your FTC Identity Theft Report, a government-issued photo ID, proof of your address (a mortgage statement, rental agreement, or utility bill), and any other proof of the theft, such as bills or IRS notices. Ask for a copy of the police report. Some later steps ask for it.
Close new accounts and get the confirmation in writing. With the Identity Theft Report in hand, call the fraud department of each business where an account was opened. Ask them to close it, and ask for a letter saying the account is not yours, you are not liable for it, and it was removed from your credit report. Keep that letter. For charges on an account that is yours, ask the business to remove the fraudulent charges and to confirm that in writing. The business may ask for a copy of the Identity Theft Report or its own dispute form. IdentityTheft.gov has sample letters for both calls.
Ask the credit bureaus to block the fraudulent information. IdentityTheft.gov says to write to each of Equifax, Experian, and TransUnion. Include a copy of your FTC Identity Theft Report and proof of your identity. Explain which information came from identity theft and ask them to block it. If you have an Identity Theft Report, the bureaus must honor that blocking request. You can still dispute incorrect information without the report. IdentityTheft.gov says that path can take longer, and removal is not guaranteed. Use the bureau addresses and sample letter on the IdentityTheft.gov recovery steps page, so you send the letter to the current fraud address.
Place an extended fraud alert, a credit freeze, or both. The FTC says you can place a fraud alert even when a freeze is already on the file. An extended fraud alert lasts seven years. It is free. You place it with one bureau, and that bureau must tell the other two. You need an FTC Identity Theft Report or a police report. The FTC says an extended alert also takes you off the bureaus' lists for unsolicited credit and insurance offers for five years, unless you ask them not to. A credit freeze is separate. The FTC says it is free to place or lift, it does not affect your credit score, and while it is on, nobody — including you — can open a new credit account in your name until you lift it. A freeze lasts until you lift or remove it. You contact each bureau yourself. When a lender needs to check your credit, lift the freeze at the bureau that lender will use, then freeze it again. Our how to freeze your credit guide is the bureau-by-bureau walkthrough. The FTC also says a freeze does not freeze your credit score. Creditors can still report delinquent accounts, and that can change the score.
If the sign is an IRS notice, answer the IRS the way that notice says. The IRS guide says to verify the letter is from the IRS, follow its instructions, and keep filing and paying as usual. If you received a CP5071-series notice or Letter 5447C, the IRS says to use its Identity and Tax Return Verification Service, and that you do not file Form 14039 unless the IRS tells you to. The FTC says that if the IRS rejects your return because more than one return was filed in your name, report it at IdentityTheft.gov. That report creates an FTC Identity Theft Report, an IRS Identity Theft Affidavit, and a recovery plan, and you can choose to have the affidavit sent to the IRS from the site. You can also get Form 14039 from IRS.gov and mail it. The IRS says most people do not file Form 14039. Skip it if you already sent it, if the IRS already sent you a letter or notice, if you were told to use the verification service, or if the identity theft is not tax-related. File it if the IRS tells you to, if you cannot use the verification service, or if you need to tell the IRS about tax-related identity theft it does not already have on file. Then get an Identity Protection PIN. The IRS says an IP PIN stops someone else from filing a return with your Social Security number or ITIN. If the letter shows wages from an employer you do not work for, follow the IRS notice and the IdentityTheft.gov plan for a misused Social Security number.
If the sign is medical, correct the records and the bill. The FTC says to get your Explanation of Benefits from the health plan and notify the plan's fraud department about errors. Ask each doctor, clinic, hospital, pharmacy, laboratory, and health plan where the information may have been used for copies of the records. Review them for visits and services that are not yours. Report errors to the provider in writing, include the page that shows the mistake, and send the letter in a way you can track. The FTC says the provider must respond within 30 days and must notify other providers who may have the same mistake. If a provider refuses the records, contact the person listed in the Notice of Privacy Practices, the patient representative, or the ombudsman. Then check your credit reports for medical collections you do not recognize and use the blocking step above. Report the theft at IdentityTheft.gov and tell the form it involves medical care.
If the sign is a password reset, lock the account down the same day. Change that password from a device you control. Turn on multi-factor authentication. If you reused the password, change it on every other account that used it, starting with email, then the bank and the card. Email is the account that can reset the others. A password manager is how you store a different password for each login. The NordPass link below is an affiliate link.
Keep the file, and check the reports again. IdentityTheft.gov says to write down every contact and to keep copies of letters. Check your reports on the weekly schedule at AnnualCreditReport.com so a new account shows up while you can still dispute it. If a debt collector contacts you about a debt that is not yours, IdentityTheft.gov says to write to the collector within 30 days of the collection letter, say that someone stole your identity and you do not owe the debt, and include your Identity Theft Report.

See the current price at our link

After the free steps

A fraud alert, a credit freeze, weekly reports, and the IdentityTheft.gov plan are the parts you can do without a subscription. The FTC also says most identity monitoring services will not alert you if someone uses your information to file a tax return, get Medicare or Medicaid benefits, get welfare or Social Security benefits, or claim unemployment. Those signs still depend on the IRS letter, the Explanation of Benefits, and the benefit notice.

A paid service is the option when you want someone else to watch credit files and help with recovery paperwork after the free steps are in place. Do you actually need identity theft protection? is the decision guide. The 10 best identity theft protection services is the comparison. The Aura review covers the service we link below, including the password manager on its plans. The button is an affiliate link.

See Aura

FAQ

What are the signs of identity theft?

The FTC points to unfamiliar accounts or inquiries on your credit reports, charges or withdrawals you did not make, bills that stop arriving, a new bill you did not expect, and debt collectors calling about debts that are not yours. Tax signs include an IRS notice that more than one return was filed in your name, or wages from an employer you do not work for. Medical signs include bills or Explanation of Benefits statements for care you did not receive. A notice about unemployment benefits you did not apply for is another FTC warning sign. A password-reset email you did not request is a separate sign that someone is trying to enter an account you already have.

How do I know if my identity has been stolen?

Order your credit reports from Equifax, Experian, and TransUnion at AnnualCreditReport.com, then read bank and card statements and medical Explanation of Benefits statements. Open any IRS letter and follow its instructions. The FTC says accounts you do not recognize, charges you did not make, and a bill that stops arriving are signs to act on. A company breach notice means your information was exposed. Use the checks above to see whether someone is using it.

Where can I get a free credit report?

AnnualCreditReport.com is the only website the FTC authorizes for the free credit reports required by law. You can also call 1-877-322-8228. The FTC says each nationwide bureau lets you check that bureau's report once a week for free at AnnualCreditReport.com, and that weekly access is permanent. Order all three reports, because each bureau can list different accounts.

What should I do first if I spot a warning sign?

IdentityTheft.gov says to call the fraud department of each company where you know fraud occurred, ask them to close or freeze those accounts, and change the logins, passwords, and PINs. Place a free one-year fraud alert with one of the three credit bureaus. That bureau must tell the other two. Then get your credit reports and report the theft at IdentityTheft.gov so you receive an Identity Theft Report and a recovery plan.

Should I place a fraud alert or a credit freeze?

Both are free, and the FTC says you can place a fraud alert even when a freeze is already on your file. An initial fraud alert lasts one year. You place it with one bureau, and a business must verify your identity before it opens new credit. The alert does not stop a business from seeing your report. An extended fraud alert lasts seven years and requires an FTC Identity Theft Report or a police report. A credit freeze limits access to your report until you lift it. You place a freeze separately at Equifax, Experian, and TransUnion. The freeze guide has the steps for each bureau.

What if the IRS says someone filed a tax return in my name?

Follow the instructions in the IRS letter. If the notice tells you to verify your identity and your return, use the IRS Identity and Tax Return Verification Service. Report what happened at IdentityTheft.gov. The FTC says that report can create an IRS Identity Theft Affidavit. The IRS says most people do not also file Form 14039 when they already received a letter, already submitted the affidavit, or were told to use the verification service. An Identity Protection PIN from the IRS stops another person from filing a return with your Social Security number or ITIN.

Do password-reset emails mean my identity was stolen?

A password-reset email or a lockout notice you did not request means someone is trying to get into that account. Change the password from a device you control, turn on multi-factor authentication, and replace the password anywhere you reused it. Then check your credit reports and account statements. IdentityTheft.gov tells you to change logins, passwords, and PINs when fraud has occurred on an account.

Which links on this page are affiliate links?

The Aura buttons are affiliate links. The NordPass buttons are affiliate links. Links to IdentityTheft.gov, the FTC, AnnualCreditReport.com, and the IRS go to official sites and are not affiliate links. Buying through an affiliate link may earn Trident a commission at no extra cost to you.

Sources

Checked against the pages below in October 2026. Agency steps change. Use the link for the current form, phone number, or mailing address.