Financial identity theft is what happens when someone gets hold of your personal information — a Social Security number, a bank login, a card number — and uses it to drain your accounts, open credit in your name, or claim your tax refund. The Federal Trade Commission logged more than 1.1 million identity theft reports in 2024, with consumer fraud losses topping $12 billion overall.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 It’s a distinct problem from medical or criminal identity theft, where the goal is treatment or dodging a warrant. Here the goal is money, and the sooner you spot it, the less of yours disappears.
How It Happens
Thieves get your information in a handful of predictable ways. Phishing emails and texts impersonate banks, delivery services, and the IRS, pointing you to a login page that looks real and captures your credentials. Malware does the same thing without asking, by logging keystrokes or lifting saved passwords once it lands on your device. Large data breaches at banks, retailers, and healthcare companies spill millions of records at a time, and the stolen data gets sold in bulk on the dark web, sometimes months before you hear about the breach.
SIM swapping has grown with mobile banking. A thief calls your wireless carrier, impersonates you, and moves your number to a new SIM. Every two-factor code your bank sends then goes to them, and they use it to reset passwords and empty accounts. The FCC now requires carriers to verify identity before changing a SIM and to alert customers the moment a change is requested.2Federal Register. Information Collections Being Reviewed by the Federal Communications Commission
Low-tech methods haven’t gone away. Thieves pull bank statements and pre-approved credit offers out of trash cans. Skimmers attached to ATMs and gas pumps copy the magnetic stripe during a normal swipe. Someone watching over your shoulder at an ATM gets your PIN for free.
The Main Forms It Takes
Not all financial identity theft looks the same, and the recovery depends on which kind hit you.
Takeover of an Account You Already Have
The most direct form. A thief gets into your bank or credit card account and starts spending or transferring. Many change the billing address first, so statements stop arriving and you lose weeks before you notice. Some call customer service posing as you to reset PINs. By the time a fraud alert fires, the money is already out.
New Accounts Opened in Your Name
Here the thief uses your Social Security number and other details to open credit cards, loans, or utility accounts you’ve never heard of. You get no statements because you have no relationship with the lender. The first sign is often a collections notice for a debt that isn’t yours, or a credit-score drop months after the fact.
Tax Refund Theft
A criminal files a return under your Social Security number, claims a refund, and keeps it. You usually find out when the IRS rejects your real return as a duplicate, or when a notice arrives about income from an employer you’ve never worked for.3Federal Trade Commission (FTC). Did Someone Use Your SSN to File Taxes? Here’s What to Do The IRS won’t process your real return or send your refund until it clears the case, and as of 2025 those cases were taking more than 21 months on average to resolve.4Internal Revenue Service. National Taxpayer Advocate Delivers Annual Report to Congress
Synthetic Identity Theft
A thief combines your real Social Security number with a fabricated name and address and builds a brand-new credit profile. Because the number verifies, the identity passes checks, builds history over months or years, then “busts out” by maxing every available credit line and vanishing. You may not notice until you apply for credit yourself and find unexplained activity on your file. Children and older adults are frequent targets because no one checks their numbers.
Child Identity Theft
A child’s Social Security number is useful precisely because nobody looks at it. Thieves can open accounts that stay hidden for a decade, surfacing only when the child applies for a first student loan or credit card. Watch for pre-approved credit offers arriving in a child’s name, denials when opening a custodial account, or any note that their number is already tied to government benefits.
Warning Signs to Watch For
Catch it early and the damage stays small. Signs something is wrong:
- Credit cards, loan statements, or collection notices for accounts you never opened.
- Small test charges on a debit or credit card, often under $5, which typically come before a bigger drain.
- Hard inquiries on your credit report that you didn’t authorize, or a sudden score drop. You can pull a free report from each of the three major bureaus every year at AnnualCreditReport.com.5Consumer Financial Protection Bureau. How Do I Get a Free Copy of My Credit Reports?
- An IRS letter saying more than one return was filed under your Social Security number, or that you owe tax on wages you never earned.
- A two-factor code or login push notification arriving when you aren’t trying to sign in. Do not approve it.
- A credit application denied unexpectedly, or being told your Social Security number is already on file somewhere.
What You’re Actually on the Hook For
Federal law treats credit and debit fraud very differently, and the gap drives how fast you need to act.
Credit Cards
Federal law caps your liability for unauthorized credit card charges at $50, no matter how long the fraud goes on before you catch it.6GovInfo. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major issuers waive even that under their own zero-liability policies. Thousands in fraudulent charges on a stolen number aren’t your problem once you report it.
Debit Cards
Debit cards are riskier because the money leaves your account immediately, and your liability depends on how quickly you report:
- Within 2 business days of learning of the loss, your liability is capped at $50.
- Between 2 and 60 days, it can reach $500.
- After 60 days from the date your statement was sent, there is no cap on what you can lose from transactions occurring after that window.
These rules come from Regulation E, which governs electronic fund transfers.7eCFR. Section 205.6 Liability of Consumer for Unauthorized Transfers Check your accounts often and report anything suspicious within two business days. A week’s delay can multiply your loss by ten.
What to Do If It Happens to You
Every day you wait gives the thief more room. Work through these steps in order.
File an Official Report
Go to IdentityTheft.gov. The FTC’s portal walks you through the facts and produces an official Identity Theft Report along with a personalized recovery plan.8Federal Trade Commission. IdentityTheft.gov That report is the document you’ll hand to credit bureaus, lenders, and debt collectors later. File a police report too, especially if you know the person involved or a creditor requires one.
Freeze Your Credit, or at Least Place a Fraud Alert
These are different tools. A fraud alert tells lenders to verify your identity before opening credit in your name. An initial alert lasts one year, and the bureau you contact must notify the other two.9Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts With an identity theft report in hand, you can request an extended alert that lasts seven years.
A credit freeze blocks access to your file entirely. No one, including you, can open new accounts until you lift it. Freezes and unfreezes are free under federal law.10Federal Trade Commission (FTC). Free Credit Freezes Are Here For most victims, a freeze on all three bureaus is the stronger move.
Call Your Banks and Card Issuers
Contact every institution where you have an account. Close or freeze any compromised account, get new card numbers, and change online banking passwords and security questions, especially any you reused on other sites. If a debit card was involved, remember the two-business-day window to cap your liability at $50.7eCFR. Section 205.6 Liability of Consumer for Unauthorized Transfers
Dispute the Fraudulent Items
Pull reports from all three bureaus and flag every account, inquiry, and address you don’t recognize. Submit a written dispute to each bureau with your identity theft report and supporting documents. The bureau has 30 days to investigate, and confirmed fraudulent information must be corrected and the other bureaus notified.11Federal Trade Commission (FTC). Disputing Errors on Your Credit Reports
You can go further. The Fair Credit Reporting Act lets identity theft victims demand that bureaus block fraudulent accounts entirely. Once you submit an identity theft report, proof of identity, and a list of the fraudulent items, the bureau must block them within four business days and notify the furnisher.12Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft A block is stronger than a standard dispute because the bureau must prove the block was wrong before it can reverse it.
Handle Tax Issues Separately
If the IRS sends a letter about a return you didn’t file, follow the verification instructions in the letter — online or by phone. If you can’t e-file your real return, submit it on paper with Form 14039 (Identity Theft Affidavit) attached.13Internal Revenue Service. IRS Identity Theft Victim Assistance: How It Works Expect a long wait: resolution now averages more than 21 months, so plan around that if you were counting on a refund.
Once resolved, request an Identity Protection PIN from the IRS. It’s a six-digit number, reissued every year, that must appear on your return before the IRS will accept it. Any taxpayer who can verify identity can enroll through an IRS Online Account.14Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
Federal Penalties
Identity theft is a federal crime under 18 U.S.C. 1028. The base penalty is up to 5 years in prison. If the fraud produces $1,000 or more in value in any one-year period, the maximum rises to 15 years. Cases tied to drug trafficking or violence carry up to 20 years, and theft facilitating terrorism up to 30.15Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Individual defendants face fines up to $250,000 and organizations up to $500,000 under the general federal fine statute.16Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine
When identity theft is committed in the course of another felony such as bank fraud, wire fraud, or immigration violations, 18 U.S.C. 1028A adds a mandatory 2-year sentence that runs consecutively to the underlying crime. Courts can’t shave the underlying sentence to offset it, and probation is not available. If the theft is tied to terrorism, the add-on is 5 years.17Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Victims can also seek restitution. The Identity Theft Enforcement and Restitution Act of 2008 allows courts to order offenders to reimburse victims for the value of time spent cleaning up — hours on the phone with banks, filing disputes, dealing with credit bureaus.18GovInfo. H.R. 5938 – Identity Theft Enforcement and Restitution Act of 2008