To check for identity theft, look where a thief’s activity would leave a record in your name: your credit reports from Equifax, Experian and TransUnion, your bank and card accounts, your ChexSystems report, your IRS online account, your Social Security earnings record and your health insurance statements. Every one of these checks is free, and you can start most of them online today. An entry you don’t recognize isn’t proof of theft, so confirm it with the company or agency that keeps the record before you act.
One check isn’t enough, because identity theft takes many forms. People filed about 1.1 million identity theft reports with the FTC in 2024: credit card fraud led with 449,032, and loan or lease, bank, employment or tax, phone or utilities, and government documents or benefits fraud each topped 70,000, according to the FTC’s Consumer Sentinel Network Data Book 2024. Credit reports catch some of these; tax, Social Security and insurance records catch others.
The free identity theft self-check, in order
The first three checks cover card, loan and bank account fraud, among the most commonly reported kinds. The next three catch tax, job and medical theft that may never reach your credit file. The last two cover warning signs and how exposed your details are.
- Bank and card accounts: charges, withdrawals and transfers you didn’t make, even small ones.
- Credit reports from all three bureaus: accounts, inquiries, addresses and debts that aren’t yours.
- Your ChexSystems report: bank accounts applied for or closed in your name.
- Your IRS online account: a tax return, W-2 or 1099 you don’t recognize.
- Your Social Security earnings record: wages you didn’t earn.
- Health insurance and Medicare statements: care or prescriptions you never received.
- Mail, phone and email: missing bills, sign-in alerts you didn’t trigger, forwarding you didn’t set up.
- What’s visible under your name: the details someone could use to pass as you.
Allow extra time if you’ve never used your IRS or Social Security online account, because both verify your identity before you can sign in.
How to run each check, and what it can miss
1. Bank and card accounts. Sign in to every checking, savings and credit card account and read two or three months of activity. Look for purchases, withdrawals and transfers you didn’t make, including small ones: the CFPB warns that thieves sometimes take a small amount and come back for much more if no one notices. Check that every bill you expect has arrived, too; one that stops coming can mean someone changed your billing address, the FTC says.
What it can miss: accounts opened in your name at other companies. Your credit reports catch those.
2. Credit reports from Equifax, Experian and TransUnion. Get all three at AnnualCreditReport.com, where each is free once a week. Type the address yourself, because the FTC warns about look-alike sites. Checking your own report doesn’t affect your credit score, the CFPB says. Each bureau keeps its own file, so read all three, section by section:
- Personal information: names, addresses, employers or a Social Security number that aren’t yours.
- Accounts: cards, loans, leases, phone or utility accounts you never opened, and balances that don’t match yours.
- Inquiries: lenders you never applied to.
- Collections: debts you don’t owe, including medical ones.
What it can miss: individual charges on cards you already have, money taken from your bank account, and tax returns filed with your number.
3. Your ChexSystems report. Banks use ChexSystems to screen people who apply for accounts. It collects data on checking account applications, openings and closures, including why accounts were closed, according to the CFPB. Request your free report, one every 12 months, at chexsystems.com or by calling 800-428-9623. Look for inquiries from banks you never approached and closed accounts you know nothing about.
What it can miss: credit cards and loans, and any bank that doesn’t report to ChexSystems.
4. Your IRS online account. Sign in to your IRS Individual Online Account and look at your tax records and transcripts for a return you didn’t file, your wage and income information (W-2s and certain 1099s) for an employer or payer you don’t know, and any notices. While you’re there, get an Identity Protection PIN, a six-digit number that stops anyone else from filing a federal return with your Social Security number; any taxpayer who can verify their identity qualifies. The online tool is generally open from mid-January to mid-November.
What it can miss: state tax returns. The IRS suggests checking with your state tax agency too.
5. Your Social Security earnings record. Sign in to my Social Security through Login.gov or ID.me and compare the earnings posted for each year with what you made. Wages you didn’t earn mean someone may be working under your number. Having the account also protects you: SSA says it keeps anyone else from creating one in your name, even if they have your number.
What it can miss: anything that isn’t work or benefits, such as credit and bank fraud.
6. Health insurance and Medicare statements. Compare each Explanation of Benefits (EOB) from your health plan with your calendar: provider, date and service. An EOB or bill for care or prescriptions you didn’t get, or a notice that you’ve reached a benefit limit, is a sign of medical identity theft, the FTC says. With Original Medicare, read each Medicare Summary Notice or sign in to your Medicare.gov account, which shows claims once they’re processed.
What it can miss: care billed outside your plan. Watch for it as a bill, a collector’s call or a medical collection on your credit report.
7. Mail, phone and email. Note any bill or statement that stopped arriving, bills or collection letters for accounts you don’t know, and password-reset emails or sign-in alerts you didn’t trigger. If anything looks off, ask your phone carrier and the U.S. Postal Service whether anyone changed your account or set up mail forwarding.
What it can miss: these are clues, not proof. Follow any of them up with checks 1 through 6.
8. What’s visible under your name. Details anyone can look up, such as past addresses, age and relatives, make you easier to impersonate. The FTC warned in a 2014 report on data brokers that identity thieves may be drawn to brokers’ profiles, which can help them guess passwords or security answers. You can check yourself on Recordwell for free to see what a stranger finds under your first and last name, and removing your information is free too. For a wider audit, see the digital footprint check and our step-by-step footprint guide.
What it can miss: misuse. It shows exposure, not whether anyone used your details, and Recordwell can’t see credit accounts or tax returns. Results under your name can include people who share it, so an unfamiliar address there means less than one on your credit report.
Signs of identity theft and where to confirm them
This table pulls together the warning signs the FTC, the CFPB, the IRS and SSA list, what each may mean and where to confirm it. When you call, use a number from your card, a statement or the organization’s own website, never one from the message that alarmed you.
| Sign you see | What it may mean | Where to confirm |
|---|---|---|
| A charge, withdrawal or transfer you didn’t make, even a small one | Someone may have your card or account number; a small charge can come before a bigger one | The bank or card issuer, at the number on your card |
| A bill or statement that stops arriving | Your billing address may have been changed | The company, at the number on an old statement; the Postal Service for forwarding |
| A bill, account or collection letter you don’t recognize | An account may have been opened in your name | All three credit reports, then the company’s fraud department |
| You’re unexpectedly turned down for credit | Accounts or debts that aren’t yours may be on your report | The free report you can get within 60 days from the bureau named in the denial notice |
| Your tax return is rejected as a duplicate, or an IRS notice reports income you didn’t earn | Someone may have filed a return or worked using your Social Security number | Your IRS online account and the instructions in the IRS letter |
| A W-2 or 1099 from an employer you never worked for, wages on your Social Security record that aren’t yours, or a 1099-G for unemployment you never claimed | Someone may be working or claiming benefits under your number | IRS wage and income records and my Social Security; for a 1099-G, your state unemployment agency |
| A bill or EOB for care you didn’t get, or a notice that you’ve reached a benefit limit | Someone may have used your health insurance | Your health plan and the provider; for Medicare, 1-800-MEDICARE |
| Password-reset emails or sign-in alerts you didn’t request | Someone may be trying to get into that account | The account’s security settings, opened from the app or a saved bookmark |
| A data breach notice | Your details were exposed, which on its own isn’t misuse | The checks that match what was exposed (see what to check after a breach) |
| Collection notices, an IRS letter or a benefits denial in your child’s name | Your child’s Social Security number may be in use | A manual search at each bureau (see checking your child’s identity) |
One sign on its own can have an innocent explanation, such as a billing error or a merchant name you don’t recognize. Two signs, or any sign tied to your Social Security number, deserve a call the same day.
How to check if someone is using your Social Security number
If you think someone is using your Social Security number, check three records: your Social Security earnings record shows work, your IRS online account shows tax returns and wage reports, and your credit reports show credit. No single lookup shows every use of your number, and these three won’t show medical identity theft, so add the insurance check in step 6. SSA warns that you may not find out until you’re turned down for credit or creditors you don’t know demand payment.
If your number was misused, report it at IdentityTheft.gov, where SSA sends victims. If wages that aren’t yours show up on your earnings record, SSA will review the record with you. To keep someone from getting a job with your number at an employer that uses E-Verify, turn on Self Lock in a myE-Verify account; it covers E-Verify checks only, not other uses of your number.
Data breach notice or identity theft? How to tell
A breach notice means a company lost control of your information; identity theft means someone used it. The two often arrive together, but one doesn’t prove the other. In 2021, 12% of US residents 16 and older were notified of a breach, and identity theft victims were about twice as likely as others to have had a notice (24% vs. 11%), according to the Bureau of Justice Statistics, whose survey didn’t record which came first.
Read the notice for what was exposed, then run the checks that match it:
- Card number: that card’s transactions; ask the issuer for a replacement card.
- Bank account number: your bank statements and ChexSystems report.
- Social Security number: all three credit reports, your IRS account and your earnings record; consider a free credit freeze and an IP PIN. SSA says you don’t need an FTC Identity Theft Report if your number was exposed but not misused.
- Email address and password: change that password wherever you used it and turn on two-step sign-in.
- Health insurance or Medicare number: your EOBs or Medicare Summary Notices.
To see whether an email address you own appears in other known breaches, use Recordwell’s free breach check. Once you confirm the address through a link sent to it, the check shows which breached services list it and, where known, what kinds of data were exposed. It shows exposure, not misuse, and can’t include breaches that haven’t come to light. For protective steps such as credit freezes, see our guide to protecting your personal information online.
How to check your child’s identity
A child under 18 usually has no credit report, so a report in your child’s name deserves a closer look. Ask each of the three bureaus for a manual search for your child’s Social Security number. The FTC says you may need your ID, proof of address, the child’s birth certificate and Social Security card, and guardianship papers if you aren’t the parent.
Other signs the FTC lists: collection notices in your child’s name, benefits denied because the number is already in use, an IRS letter about unpaid taxes (the number may have been used for a job), or a student loan turned down over bad credit your child didn’t create. A parent can request a free credit freeze at each bureau for a child under 16, and it stays in place until it’s removed. Teens of 16 or 17 can place their own.
If a check turns something up
Call the company or agency that keeps the record, using a number you look up yourself, and ask whether the account, charge or filing is real. If it isn’t yours, report it at IdentityTheft.gov, the FTC’s site, which gives you a personal recovery plan and pre-filled letters. Then place a credit freeze or fraud alert, and keep notes of every call. Our companion guide, What to do if your identity is stolen, covers recovery step by step.
Common questions about checking for identity theft
How do I check if someone is using my identity?
Look for records you didn’t create: unfamiliar accounts or inquiries on your credit reports, charges on your statements, a tax return or W-2 that isn’t yours, wages you didn’t earn on your Social Security record, or bills for care you never got. Missing bills and debt collection calls are common early signs.
Is there a free identity theft check?
Yes, though no single tool covers everything. Credit reports from all three bureaus are free every week at AnnualCreditReport.com, a ChexSystems report is free once every 12 months, and your IRS account, my Social Security account and insurance statements cost nothing. Together they cover credit, bank, tax, work and medical misuse.
Does checking my credit report lower my credit score?
No. Checking your own report isn’t an inquiry about new credit, so it has no effect on your score, according to the CFPB. You can check your report from each bureau once a week for free.
Will an identity theft monitoring service catch everything?
No. The FTC notes that credit monitoring won’t alert you when someone withdraws money from your bank account or files a tax return with your Social Security number, and identity monitoring may miss Medicare, Medicaid, unemployment or Social Security benefit claims. The IRS, Social Security and insurance checks cover those gaps for free.
How often should I check for identity theft?
A workable routine: read your bank and card activity at least monthly, pull a credit report every few months, and check your IRS account and Social Security earnings once a year. Run the full check again after a breach notice, a lost wallet or any warning sign.