What this answers
On this page
Identity theft is not one crime. It is five different crimes that happen to share a method, and the recovery path is different for each one. Knowing which kind you are dealing with decides who you contact, what you are entitled to demand, and how long it takes to undo.
How Common It Actually Is
Identity theft is among the most reported consumer problems in the country, and the reported cases understate the real number. Many victims never file a report, and many never learn their information was used at all, because the account was opened at a creditor they have no relationship with and the first notice is a collection letter.
The reliable public counts come from the FTC's Consumer Sentinel Network Data Book, which publishes report totals by category and by state each year, and from the Bureau of Justice Statistics. Those are the sources worth checking for a current figure, because the totals move annually and a number quoted from an old article is usually out of date.
What does not move is the pattern. Breaches keep feeding the supply of stolen data, the same people are often hit more than once, and the credit system approves new accounts fast enough that the first sign of trouble is usually a bill or a denial.
The Five Types
Credit Identity Theft
Someone uses your information to open new credit accounts, or takes over an account you already have. This is the most commonly reported type and the one the Fair Credit Reporting Act addresses most directly. It shows up as accounts you never opened, balances you did not run up, and inquiries from lenders you never applied to.
This is also the type with the strongest remedies. Under 15 U.S.C. § 1681c-2, often called section 605B, a credit bureau that receives a complete identity theft block request generally must block the fraudulent information within four business days.
Tax Identity Theft
Someone files a return under your Social Security number to capture the refund. You usually find out when your own return is rejected as a duplicate. The IRS, not the credit bureaus, is the primary venue here, and the remedy runs through an identity theft affidavit and an IP PIN rather than through a dispute letter.
Tax identity theft and credit identity theft often come from the same breach, so finding one is a reason to check for the other.
Medical Identity Theft
Someone uses your information to obtain treatment, prescriptions, or equipment. This one is the hardest to unwind, because the consequence is not only a bill. The treatment gets recorded in a medical file under your name, which means another person's blood type, allergies, diagnoses, or medications can end up attached to you. Correcting the credit reporting is only half the job; the medical record has to be corrected too.
Employment Identity Theft
Someone works under your Social Security number. Wages you never earned get reported to the IRS and to the Social Security Administration under your name, which can distort your tax liability and your benefits record. It frequently surfaces years later, in a notice about unreported income.
Criminal Identity Theft
Someone gives your name and information to police at an arrest or a citation. The result is a record, and sometimes a warrant, in your name for conduct that was not yours. This is the type most likely to cost you a job through a background check rather than through a credit report, and the correction has to happen at the court and the arresting agency, not only at the screening company.
Why It Keeps Growing
- Breaches keep adding records to the supply, and a Social Security number cannot be reissued the way a card number can
- Stolen data is cheap and easy to obtain once it is in circulation
- Automated underwriting rewards speed, and verifying an applicant harder costs money and loses sales
- The consequences for reporting bad data are weak unless a consumer enforces them
- Most people do not know what they are entitled to demand, so most fraud is never challenged
That last point is the one worth sitting with. The system does not correct itself. It corrects when somebody makes it.
How to Protect Yourself
- Assume your data is already exposed and act on that basis. A security freeze is free at all three bureaus and is the only measure that actually stops a new account from being opened.
- Check your reports from all three bureaus, not one. They do not carry the same information.
- Use unique passwords and turn on two-factor authentication on anything financial.
- File your tax return early. The first return filed under your number is the one that gets processed.
- Read the adverse action notice when you are denied. It names which bureau supplied the report, which tells you where the bad data lives.
If You Are Already a Victim
Start with an identity theft report. It is the document that unlocks the rest of your rights, including the four business day block, the extended fraud alert, and the right under § 1681g(e) to the business records of accounts the thief opened in your name.
Then watch what happens next, because this is where consumers lose ground. Blocked items get reinserted. Furnishers keep reporting an account after being told it was fraud. A bureau decides the dispute is frivolous and does nothing. Each of those is a potential claim, and each one depends on your having the paperwork that proves what you sent and when. Keep every report, every letter, and every response.
How the Five Types Overlap
They are described separately because the recovery paths differ, but they rarely arrive separately. One breach supplies the information for all five, and a thief who finds your Social Security number useful for a credit card finds it equally useful on a tax return.
That has a practical consequence worth acting on. Discovering one type is a reason to check for the others, not a reason to deal with one and move on. Someone who finds a fraudulent credit card should pull their Social Security earnings statement and file their tax return early that year. Someone who learns of a medical account in their name should request their file from the specialty agencies as well as the three nationwide bureaus.
What Recovery Actually Looks Like
The frustrating part of identity theft is that the work falls on the victim, and it is mostly correspondence.
The sequence that works: freeze all three files first, because that stops the bleeding while everything else proceeds. File the identity theft report. Pull full file disclosures and read the personal information section before the accounts. Send block requests naming each fraudulent item specifically. Then, and this is the step most people skip, pull the reports again a month later and confirm nothing came back.
Expect it to take months rather than weeks, and expect at least one item to need a second round. That is not a sign you did it wrong. It is a sign the system is built to resist exactly this.
Common Questions
How long does identity theft stay on my credit report?
Fraudulent information that has been properly blocked under 15 U.S.C. § 1681c-2 should come off and stay off. The block is not a seven year wait like ordinary negative information, because the premise is that the account was never yours. If a blocked item reappears, that is a separate violation rather than the item simply aging.
Do I need a police report, or is the FTC report enough?
An FTC report from IdentityTheft.gov is an identity theft report under federal law, and bureaus and furnishers have to accept it. A police report also qualifies. You do not need both, which matters because some departments decline to take a report when the fraud happened in another jurisdiction.
Will freezing my credit hurt my score?
No. A freeze restricts who can access your file. It is not reported as a negative event, lenders do not see it as a mark against you, and it has no effect on your score. It is also free to place, lift, and remove at all three bureaus.
Can I be held responsible for debts a thief ran up?
You are not responsible for a debt you did not incur, but the system does not know that until you prove it, and the proof is the identity theft report plus the documentation. A collector that keeps pursuing you after receiving an identity theft report has its own problem under federal law.
What if the thief is a family member?
This is more common than most people expect, and it is harder because the information was not stolen so much as available. The law does not carve out an exception for relatives. What it does require is that the transaction was not one you made or authorized, which is why an account a relative opened with your knowledge is not identity theft even when you never agreed to pay it.