What Is Identity Theft? Types, Examples and Warning Signs

Identity theft is the misuse of your personal details, not just their exposure. Here is what it looks like, how it starts and how to spot it early.

By Siddharth ShankarUpdated October 11, 2026

The US Federal Trade Commission describes identity theft in one plain sentence: it is when someone uses your personal or financial information without your permission. That covers a lot of ground. A stranger might charge purchases to your card, open a new account in your name, claim your tax refund or give your name to police when they are arrested.

This guide explains the main types of identity theft, how criminals usually get the information they need and the signs that tell you something is wrong. It also separates identity theft from a data breach, because the two are often confused and the difference changes what you should do next.

What identity theft actually means

Identity theft is about misuse. Your details being visible somewhere is exposure. Your details being used by someone else, without your consent, to gain something is theft. Many people live with exposed information for years without ever being targeted, and some people are targeted after only a single leaked detail.

The information involved can be financial, such as card or bank numbers, or personal, such as your full name, date of birth, address and government ID numbers. A thief often needs several pieces at once. That is why combining data from different sources is so valuable to criminals.

Common types of identity theft

The FTC does not publish a fixed list of categories and notes that IdentityTheft.gov covers more than 30 types of identity theft. In practice, most cases fall into a handful of patterns, based on what the thief does with your information:

• Existing account misuse: someone makes purchases on your card or takes money from your bank account.
• New account fraud: a thief opens credit cards, loans or phone, electricity and gas accounts in your name.
• Tax refund fraud: someone files a return using your details and collects the refund.
• Employment or medical identity theft: a person uses your identity to get a job or medical care.
• Criminal identity misuse: someone gives your name when they are arrested.

These are descriptions, not legal categories, and a single incident can involve several of them. A thief who steals a card number may also try to open new accounts if they can find your date of birth and address.

How thieves get the information

Criminals rarely need to hack you personally. They work with what is already out there:

1. Data breaches. When a company is breached, names, emails, passwords and sometimes identification numbers can be copied and traded. Our guide to what a data breach is and how it happens explains how this works. 2. Phishing and scams. A convincing message tricks you into typing a password or sharing a code. See how scammers get your phone number and email for where they find their targets. 3. Public listings. People-search sites and data brokers compile addresses, phone numbers, relatives and ages. Read what information data brokers collect to see what a stranger can assemble. 4. Stolen mail and lost documents. The FTC notes that mail theft and insider theft are among the ways information is taken.

Public information is not the same as stolen information, but it helps a thief answer security questions, sound credible on the phone and guess which accounts you hold.

Warning signs to watch for

The FTC lists several signs that someone may be using your identity:

• Bills stop arriving, which can mean someone changed your mailing address.
• Charges or bills appear that you do not recognize.
• Money leaves your bank account without your involvement.
• Accounts you never opened appear on your credit report.

Other clues are debt collectors calling about debts that are not yours, a tax return rejected because one was already filed, or a notice about medical services you never used. None of these proves identity theft on its own, but each deserves a prompt check.

Identity theft versus a data breach

A data breach is an event where an organization loses control of data. Identity theft is what a criminal may later do with some of that data. If your email appears in a breach, you have been exposed, not necessarily victimised.

That distinction matters because the first response is different. After a breach you change passwords and consider a credit freeze. After confirmed misuse you follow the recovery steps in what to do if your identity is stolen.

Why your digital footprint matters here

The more personal details sit in public view, the easier it is for someone to impersonate you convincingly. A thief who knows your old addresses, relatives and birth year can pass many identity checks without any breach at all. Reducing unnecessary exposure does not make you immune, but it removes easy material. The digital footprint check is a good starting point for seeing what is out there.

What to do if you suspect it

If you recognize any of the signs above, act quickly: contact the company where the fraud happened, check your credit reports and report the theft through the official channel for your country. In the United States that is IdentityTheft.gov. In England, Wales and Northern Ireland, the Report Fraud service replaced Action Fraud on 4 December 2025.