# Identity theft often starts with one thing you don’t recognize. Knowing what to look for · 03 · 10 min read The phrase sounds like one catastrophe. In practice, the first usable evidence is often a particular account, bill, tax filing, benefit claim, or medical record. That record tells you who can investigate and correct it. This page helps you: - Spot signs that someone may be using your details - Understand why misuse can surface months later - Know who can look into each kind of record No single definition travels everywhere. The U.S. Federal Trade Commission uses the term identity theft when someone uses personal or financial information without permission. UK government guidance often separates the taking of information, called identity theft, from using it to obtain goods or services by deception, called identity fraud. Impersonation is the act of pretending to be you. It can be one part of identity fraud, but a copied detail, a fake profile, and an unfamiliar financial account are not the same event. A breach is not proof that any of them has happened. The practical response begins with the specific record. A name and date of birth may make an approach sound credible. A national ID number may connect official records. Control of your email may affect other accounts. Ask, "what could _this particular detail_ become part of, and which organization can check what happened?" Reviewed July 2026. Official terminology: compare the [FTC's definition and examples](https://consumer.ftc.gov/articles/what-know-about-identity-theft) with the [UK government's identity theft and identity fraud distinction](https://stopthinkfraud.campaign.gov.uk/recovery-from-fraud/recovering-losses/what-to-do-if-your-identity-has-been-stolen/). The legal labels and reporting routes vary by country. ## The detail and its context Pick a detail. See what changes the picture. No detail comes with a fixed outcome. Its usefulness changes with what it is combined with, which service receives it, and what that service checks. ### Name + date of birth These details can make an approach sound informed, but they do not come with a fixed consequence. How it might be used: - Making a message or call sound more convincing - Searching for accounts or public records tied to you - Being combined with an account credential or official identifier What changes the picture: Many people share a name or birthday, and the same details appear in ordinary records. What follows depends on what else is known and what the organization receiving a request requires. Where to begin: Check the notice or account activity that brought you here. Treat a caller knowing these details as context, not proof that the caller is legitimate. ### Email address An email address can point toward accounts. Control of the inbox matters much more. How it might be used: - Targeted phishing aimed straight at you - Attempts to discover accounts associated with the address - Password-reset attempts that matter only if the inbox or another recovery route is also controlled What changes the picture: Knowing an address is different from controlling its inbox. The situation changes if a password was reused, the inbox was accessed, or its recovery and forwarding settings were altered. Where to begin: Give the email account a password used nowhere else and add another sign-in step. Then review its recovery and forwarding settings, since email often receives reset links for other accounts. ### Phone number A number can receive contact. Control of the number can affect accounts that rely on it. How it might be used: - More convincing calls or text messages using details tied to you - An attempt to persuade a carrier to transfer the number - Receiving texted sign-in codes if control of the number is successfully transferred What changes the picture: Knowing the number is not the same as controlling it. A SIM swap requires the carrier to transfer the number, and carrier processes and account protections differ. Where to begin: Ask your carrier whether it offers a PIN or transfer lock, and what that protection covers. Where you can, move important logins off SMS codes onto an app or a passkey. [How to protect your phone and key accounts](/your-identity-online/phone-and-accounts) covers this. ### Card number A card number concerns one payment account, and the issuer can see what happens next. How it might be used: - Attempts to make card-not-present purchases - Small authorization attempts before a larger purchase - Pairing the number with a name or billing address from another source What changes the picture: Whether a transaction is accepted depends on the merchant, the issuer, and any other information requested. A card number concerns that payment account, not every account or identity record you hold. Where to begin: Review your statements and report activity you do not recognize. Your card issuer can explain which dispute and replacement options apply. ### National identifier A national identifier can connect records, but its function changes across countries and systems. How it might be used: - Attempts involving records that use the identifier, which may include tax, employment, benefits, or credit - Combining the identifier with information from another source - Making an application or contact appear more complete What changes the picture: Some countries use an identifier across tax, social-insurance, benefits, employment, or civic records. Others do not use one number in the same way. Other details or checks may still be required. Where to begin: Ask the authority responsible for the identifier which reporting steps apply. If the notice or unfamiliar activity involves credit, ask the relevant credit-reporting agencies which alerts or freezes are available where you live. In the United States, IdentityTheft.gov has steps for a Social Security number that may have leaked. ### Home address An address adds context and points to physical mail, but it may not be private or current. How it might be used: - Making a message or call sound more informed - Attempts to redirect or intercept physical mail - Unwanted contact at home What changes the picture: Addresses may be shared, outdated, or available in public records. Knowing one does not establish control of your mail or an account. Missing post or an official redirect notice is more specific evidence that needs checking. Where to begin: Watch for missing mail, which can signal a redirect, and be cautious of anyone quoting your address as "proof". ### Passport / ID photo A document image gathers several official details in one place. How it might be used: - Supporting an attempt to impersonate you - Supplying a photograph, document number, and biographical details together - Making a false account application appear more complete What changes the picture: A copy is not the same as possession of the physical document, and organizations may ask for other evidence. A leaked image does not show that anyone has used it. Where to begin: Use the issuing authority's official guidance. Tell it whether you still hold the physical document and exactly what was copied, then ask whether reporting or replacement is appropriate. ## Why it can surface months later The date information became available and the date someone tried to use it are often different. A detail can be copied, combined with older records, and tried against an account much later. Keep the original notice if there is one. Its date and description can help you explain where a detail may have come from even if the first unfamiliar bill arrives months afterward. **Four moments, not one** - **01 · Information obtained.** A detail is copied, disclosed, or taken. A company breach is one possible source. - **02 · Waiting.** It may be combined with older records or left unused for a long time. - **03 · Attempted use.** Someone tries to use it in a new account, claim, loan, or other record. - **04 · Recovery.** You spot it, report it, and work through the recovery steps. The time involved depends on what happened and which organizations are involved. A freeze or alert may interrupt some new-credit applications before they become accounts. It does not cover every kind of misuse, so the response still depends on the detail involved. > Identity theft may not look the way you imagine. It can be slow to surface, and it often shows up > as small administrative oddities in a particular account, bill, or medical record. ## Signs it may have happened None of these is proof. Any of them is worth a look. Because misuse can surface quietly and late, it tends to show up as small administrative oddities rather than one clear alarm. Mark anything you have noticed. The checklist groups next steps by the account or record that may need correction. ### Have you noticed any of these? - **A bill or statement for something I don't recognize:** Contact the company on the bill directly, using a number you look up yourself. Tell them the account or charge is not yours and ask which dispute process applies. - **I was turned down for credit and don't know why:** Request your credit report through the official route where you live and look for accounts or applications you do not recognize. Access and fees vary by country. - **Post I expected has stopped arriving, or letters look tampered with:** Ask the sender to reissue anything missing, and check with your postal service that no mail redirect was set up in your name. - **I was told a tax return or benefit claim was "already filed" in my name:** Contact your tax authority through its official identity-misuse route and ask which process applies to a return or claim filed by someone else. - **A new account or login I never set up appeared:** Tell the provider the account or login is not yours and ask them to close or secure it. If your email received a related notice, review its password, recovery details, and forwarding settings too. - **A medical bill, claim, or record contains care I never received:** Contact the provider and health plan through numbers on your existing records. Ask how to dispute the billing and correct information that does not belong to you. ### What to do next Sensible next steps for what you ticked, in the order it helps to do them. Tick anything you have seen. If none apply, keep the list as a reference and check any notice or account activity that brought you here. These signs follow the [FTC's identity-theft guidance](https://consumer.ftc.gov/articles/what-know-about-identity-theft). None of them is proof on its own. ## Breach and misuse are different events A leaked detail is not proof that someone has used it. The useful response depends on the detail. A credit freeze may limit new-credit applications where it is available. Account alerts and statement reviews can help you notice activity that needs a closer look. None covers every kind of misuse on its own. Some situations can stay quiet longer. [Federal Reserve research on synthetic identity payments fraud](https://www.federalreserve.gov/newsevents/pressreleases/other20190709a.htm) describes one version in the United States. - **Synthetic identity.** A real identifier is mixed with invented details. An account may not use your name even though one of your numbers sits underneath it. - **A child.** May have no ordinary credit history to review. - **Someone who has died.** No longer checks new mail or tax records. In those cases, ask the relevant credit-reporting, tax, or issuing authority whether it has a process for a minor, a deceased person, or an identifier attached to unfamiliar records. ## Match the protection to the record 1. If information used for new credit leaked, ask whether a freeze, alert, or other protection is available where you live. Here is how those options differ by country. 2. Turn on transaction and login notices where your bank offers them. They can bring account activity to your attention sooner. 3. If it has already happened, the recovery steps depend on the account or record involved. Start with what to do if your identity was stolen. If several are true at once, check each notice or account with the organization that issued it, then use [what to do if your identity was stolen](https://explained.withpersona.com/your-identity-online/identity-stolen). The specific moves, especially freezes and which agency handles them, vary by country. The chapters above show what changes where you live. --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/identity-theft_