How to Prevent Identity Theft

Suddenly, your entire life is a house of cards. You feel violated, exposed, and entirely alone. If you’ve already experienced identity theft, you know about gut-wrenching panic and sleepless nights. 

But if you haven’t, consider this your wake-up call.  

In 2024, consumers lost over $12.5 billion to scams, up 25% from the year before. And the FTC’s IdentityTheft.gov site received more than 1.1 million reports of identity theft.  

As attackers deploy increasingly sophisticated tactics, being vigilant is more critical than ever. Whether you’re picking up the pieces after an attack or hoping to learn how to fight back when the unthinkable happens, this article is for you. 

What every “safe” person needs to know – before identity thieves strike 

You may think you’re safe. After all, your passwords are good enough, and you’ve never clicked on suspicious links. According to the 2025 CYBSAFE Cybersecurity Attitudes and Behaviors report, 67% of survey participants say they “very often” or “always” check their messages for phishing signs before clicking links. 

Identity thieves know this and are relentless in searching for new ways to bypass your defenses. 

Here’s the truth: most people don’t realize their identity has been stolen until the damage is done. Below are tell-tale signs you should look out for – before things spiral out of control. 

The tell-tale signs your identity has been stolen 

#1 Phantom withdrawals from your accounts

It often starts with small purchases. Maybe it’s a cup of coffee in a city you’ve never visited or a few dollars at a convenience store. 

These “phantom” transactions are often the first sign of identity thieves testing the waters. Ignore it, and you could wake up to find your entire account drained. 

#2 Unexpected credit or loan denials

You apply for a new credit card or car loan, confident you’ll get the terms you want. 

After all, you have great credit. 

But despite your spotless financial history, your loan is denied. 

When you check your credit report, you’re shocked to see multiple new accounts you don’t recognize. This is a major red flag that someone else is using your identity – and your core data (such as SSN) is likely compromised. 

#3 Bills for medical services you never received

A bill arrives for a hospital visit you never made, or a collection agency calls about a surgery you never had. You may see unrecognized claims on your insurance paperwork and new prescriptions your doctor didn’t authorize.  

And that’s not all: If someone receives treatment in your name, their conditions, lab results, treatments, and medications will be added to your file. This may result in dangerous errors during emergencies, such as receiving the wrong transfusion for your blood type. 

Did you know? The Federal Trade Commission (FTC) receives over 28,000 reports of medical identity theft every year – and close to 500,000 have been victimized since 2003. 

#4 Unexpected correspondence from the IRS

Nothing sends a chill down the spine like an IRS letter saying you can't e-file because someone has already used your Social Security number to do it.  

To inform you of potential identity theft, the IRS may send one of these four notices to you: 

• Letter 5071C, Potential Identity Theft with Online Option: This tells you to use an online tool to verify your identity and tax return information.  

• Letter 4883C, Potential Identity Theft: This tells you to call the IRS to verify your identity and tax return information.  

• Letter 5747C, Potential Identity Theft In Person Appointment: This tells you to verify your identity and tax return information in person at a local Taxpayer Assistance Center.  

• Letter 5447C, Potential Identity Theft Outside the U.S.: This tells you to use an online tool or call the IRS to verify your identity and tax return information. 

Regardless of which letter you receive, be sure to follow the instructions. Note that receipt of a letter releases you from filing Form 14039, Identity Theft Affidavit. 

How do identity thieves get your information? 

The numbers don’t lie: There’s a new identity theft case every 22 seconds. Here’s how scammers are getting your info right now: 

Phishing attacks 

Did you know? 

• 60% of cybercrime victims experienced phishing in 2024.  

• 80% of phishing campaigns aim to steal credentials. 

• Ready-to-use phishing kits on the Dark Web are up 50%, enabling less skilled attackers to deploy sophisticated phishing campaigns. 

• QR code phishing (quishing) has become mainstream, up 587% from previous years. 

• AI tools like EvilProxy are being used to generate phishing pages that mimic login portals for banking and cloud services – so scammers can steal MFA-protected credentials. 

And that’s not all: Voice phishing (vishing) attacks with deepfake impersonations increased 442% between the first and second half of 2024.  

According to CrowdStrike’s 2025 Global Threat report, scammers posing as IT support staff used vishing to pressure targets into compliance.    

By creating believable scenarios and building rapport over time, the scammers managed to trick users into downloading malware, granting remote access to their devices, and entering their credentials on phishing pages. 

Dark Web data sales 

Did you know? 

• According to Fortinet’s 2025 Threat Landscape report, infostealers like Redline and Vidar are driving a 500% increase in credentials sold on the Dark Web. 

• Infostealers are sold for as little as $150 on Dark Web forums. 

• They enable mass data exfiltration, sweeping up passwords, banking logins, payment card info, and VPN credentials. 

• If you live in a country like Czech Republic, Lithuania, or Slovakia, your passport can fetch around $3,800 on the Dark Web. 

• Full personal identity sets (name, Social Security number, birth date, address, credit card data) are sold for $16-$228. 

Synthetic identity fraud 

This isn’t your garden-variety identity fraud. With AI, scammers are now stitching together parts of multiple identities and combining them with fake details to create new, fraudulent identities. The Federal Reserve has warned about the alarming rise of synthetic identity theft, which will generate at least $23 billion in losses by 2030. Here’s what you’re up against: 

• Scammers prefer targeting children, seniors, and homeless individuals - because they know these individuals are less likely to access their credit reports. 

• Digital document manipulation is up 244% - thanks to AI tools that make fake IDs look more real. 

• Synthetic identity fraud now comprises 30% of all identity theft cases. 

• Use of your SSN to commit synthetic identity fraud can lead to a fragmented credit file, which can seriously harm your credit scores. 

What this means is scammers who use your SSN to create hybrid identities can qualify for loans and credit cards – and default on them all. Because synthetic identities can bypass KYC checks, synthetic identity fraud detection is extremely challenging. While the scammer escapes prosecution, you’re left holding the bag. 

SIM swapping 

Here’s how SIM swaps work: Scammers trick your mobile provider to switch your phone number to a SIM card they control. This means all your calls, texts, and SMS MFA codes are re-routed to untraceable burner phones. 

In minutes, they’ll lock you out of your accounts and drain them of cash. Let’s talk numbers: 

• Nearly 3,000 SIM swap cases hit the UK in 2024 alone, with identity fraud linked to mobile products surging 87%. 

• In the US, losses from SIM swapping scams topped $48 million in 2023, with 800 cases recorded nationwide by Dec 2024. 

• Scammers are offering mobile phone company employees up to $3,000 per swap to redirect phone numbers. 

• A recent SIM swapping attack in California resulted in the theft of $38,000 – even though the victim had SMS MFA enabled. 

And that’s not all: Criminals are ramping up credential theft by combining SIM swapping and CAPTCHA bypass systems to hide phishing sites. Seniors are the main targets, suffering $5 billion in losses in 2024 alone. 

Outsmarting the modern identity thief 

The secret weapon that protects your credentials – even if you’ve been hacked before 

While many people have heard of password managers, 29% prefer to write down their passwords in a notebook. A 2025 CYBSAFE survey reveals even more concerning statistics: 

• 40% prefer using their internet browser to store their passwords. 

• 21% rely on their memory. 

• 66% of the Silent Generation and 60% of Baby Boomers have never even tried password managers. 

• 48% don’t know WHICH password manager to use. 

• 38% don’t know HOW to use one. 

But here’s the truth: If you value your time, privacy, and sanity, an advanced password manager is the simplest, smartest upgrade you can make. Here’s why: 

• It’s like hiring a bodyguard for your online presence: With a proven Secure by Design password manager, you can keep passwords and other critical information like your Social Security number, bank login details, driver’s license, or passport safe.   

• Creating strong passwords is a breeze: Instead of using the name of your pet or your favorite takeout order, you can use a password manager to auto-generate secure passwords according to NIST and CISA guidelines. 

• Security while you sleep: Our Dark Web Monitoring service ensures your credentials are monitored 24/7. You get instant alerts if your data is compromised. 

• You’ll save HOURS every year: A single master password or passwordless login gives you access to everything – no more forgotten passwords and pesky resets. 

• It works everywhere: A password manager that syncs on every device means your login credentials are within reach anytime, anywhere, and on any device of your choosing. 

Use phishing resistant multi-factor authentication (MFA) 

Due to SIM swapping scams targeting SMS, the FBI and CISA now recommend phishing resistant multi factor authentication (MFA) over SMS-based MFA. A Secure by Design password manager provides this - ensuring your logins are safe every single time. 

These four (4) tips put you ahead of the crowd when it comes to phishing 

Think you’re pretty savvy when it comes to phishing?  

If you already do all of these things, pat yourself on the back. 

• Exercise caution by hovering over the ad to see the URL – before clicking. 

• Type the business's URL directly into the browser address bar or use Bookmarks/Favorites instead of searching for it on Google. 

• Use a browser ad block extension like uBlock Origin.  

• Use an advanced password manager with FIDO2-based MFA and secure autofill to prevent your credentials from being entered on phishing sites. 

Properly dispose of sensitive documents 

Looking to declutter your home? It’s best to shred sensitive documents like bank statements, credit card bills, and legal documents. 

Shredding medical documents is also the best way to stop medical identity theft. This includes documents like: 

• EOB (Explanation of Benefit) statements from your health provider 

• Prescription labels 

• Health insurance documents 

• Old health records 

• Billings statements from doctor’s offices 

• Any documents with your medical record number, Social Security number, or health plan beneficiary number 

Sign up for ID threat monitoring 

Is identity theft protection worth it?  

Identity theft isn’t just about money – it's about your health, safety, way of life, and future. 

To a thief, your identity is a blank check to free healthcare, prescriptions, and medical services.  

In February 2022, two women were found guilty of falsifying claims for durable medical equipment (DME) using stolen Medicare patient data. 

DMEs include expensive equipment like wheelchairs, scooters, hospital beds, CPAP machines, and patient lifts.   

Once your insurance or Medicare has paid for the fraudulent claims, you may find yourself without coverage when you’re in actual need of medical equipment. 

You could also find yourself responsible for charges from multiple claims totaling thousands of dollars each, damaging your credit and financial standing. 

Services like Aura identity theft protection provide comprehensive features like three-bureau credit monitoring, financial transaction alerts, and medical identity theft protection. 

And while banks can implement synthetic identity fraud prevention strategies like multi-layered identity verification, ID threat monitoring services can help catch signs of fraud that slip past institutional defenses. 

Ultimately, the cost of protection is a fraction of what a single incidence of identity theft could cost in terms of your health, peace of mind, money, and time. 

What to do if you’re hit: The rapid response protocol you need  

Set up a credit freeze and fraud alert to take back control 

Implement a fraud alert right away with all three credit bureaus – it's free to set up. 

This tells lenders to verify your identity before granting credit in your name. You’ll also get free copies of your credit report – scrutinize them for unauthorized activity. 

Next, go a step further and implement a credit freeze – this stops lenders from accessing your credit reports altogether, which means scammers can’t open new lines of credit in your name. 

Monitor your accounts to catch every last unauthorized charge 

Immediately contact the fraud department at your bank to freeze or close compromised accounts. You’ll also want to set up transaction alerts, change your passwords, and enable MFA. 

Notify the right authorities to turn the tide and protect your rights 

File a report with the Federal Trade Commission online at IdentityTheft.gov to get a personal recovery plan. Include as many details as possible. 

You’ll also want to report the theft to your local police department. Visit them in person and take:   

• A copy of your FTC Identity Theft Report   

• A government-issued photo ID  

• Proof of address like a utility bill or paper bank statements  

• Any IRS notices you received 

Filing a report with both the police and FTC serves as official proof to banks and creditors that you’re a victim of identity theft and aren’t responsible for fraudulent charges on your records. It also unlocks additional protections such as the ability to place an extended fraud alert on your credit file. 

You have the right to demand justice 

If you’re a victim of identity theft, you have robust protections under the Fair Credit Reporting Act (FCRA). This includes: 

• Free credit reports: You’re entitled to free copies of your credit report – if you’re a victim of identity theft and have implemented a fraud alert. 

• Right to dispute: You can dispute fraudulent information and have it removed from your credit history. 

• Access to transaction records: Businesses must provide you and law enforcement with documents related to the theft. 

• The right to legal action: If a consumer reporting agency violates any part of FCRA, you have the right to sue in state or federal court. 

You also have protections under the Fair Debt Collection Practices Act (FDCPA). This includes: 

• Limits on communication: Debt collectors can’t contact you before 8AM or after 9PM. 

• Protection from harassment and abuse: Debt collectors also can’t use threats of violence, excessive phone calls, or intimidation tactics to get you to pay. 

• Right to dispute debts: You have the right to dispute a debt or any portion of it. 

• Right to sue: You have the right to sue a debt collector who violates any part of your rights under the FDCPA. 

AI: The double-edged sword that’s changing the game 

Strike back with AI as the new defender 

Let’s cut to the chase: Scammers are using AI to create smarter and sneakier ways to steal your identity. But here’s the good news: You can use AI to beat the scammers at their own game.  

Here's how it works. 

• Transforming a sea of evidence into crystal clear insights: You can use large language models (LLM) to scan mountains of paperwork, emails, and bank statements for signs of identity theft. Then, the LLM can distill the evidence into a clear, concise summary. If someone’s pretending to be you, AI will speed up the discovery process. 

• Spotting data points that don’t belong: You can also use AI to spot inconsistencies such as unfamiliar accounts or changes in transactions that may indicate identity theft. 

• Unmasking subtle identity mismatches scammers count on: With advanced matching algorithms and natural language processing, you can identify variations in your name, address, or other identifiers across your records. AI can pinpoint where discrepancies first appeared and where scammers inserted false information. 

• Uncovering how scammers exploit your social media footprint: AI can analyze your social media footprint for signs of impersonation or unauthorized activity. By comparing this data to info from banks or credit bureaus, AI can pinpoint inconsistencies that suggest fraud. 

• Detecting the imposter who looks and sounds like you: Scammers may have cloned your face, voice, and mannerisms – to commit crimes in your name. In response, you can use dynamic liveness solutions to provide forensic-quality evidence that a deepfake was used to impersonate you - so you aren’t blamed for what you didn’t do.  

Should I hire a lawyer for identity theft?  

In a nutshell, here are five (5) reasons to hire an identity theft lawyer: 

• When law enforcement disputes that someone committed a crime in your name 

• If you’ve already filed complaints, filled out countless forms, and spent a huge chunk of time on the phone with banks/creditors/credit bureaus - with no solution in sight 

• When you’ve lost significant sums of money or your reputation with creditors and employers has been damaged 

• If you’re facing lawsuits, IRS complications, or criminal charges 

• When businesses refuse to provide records or correct fraudulent information 

When your life has been turned upside down by identity theft, a lawyer can help cut through the confusion, get results fast, and restore sanity to your life. 

• With an identity theft lawyer at your side, you don’t have to worry about stressful conversations that go nowhere. They’ll talk to banks, credit bureaus, and the police on your behalf. 

• They'll also make sure debt collectors stop hounding you. 

• If credit bureaus keep reporting fraudulent activities as “real” transactions or violate any part of the FCRA or FDCPA, your lawyer can help you get compensation for the ordeal. 

• Banks and credit bureaus have a duty to investigate fraud claims properly. When they fail, an identity theft lawyer holds them accountable. 

As can be seen, vigilance – and the right allies – are your best defense against identity theft. 

In a world where scammers never sleep, you need another ally.  

With 2025 Business Titan and G2 awards for password management, MFA, and Dark Web Monitoring services, LastPass is a proven credential security solution. 

We’re so confident you’ll love LastPass that we’re giving you 30 days FREE of LastPass Premium, no credit card or commitment required. Join millions of customers across the world who demand reliable protection, ironclad security, and the peace of mind only an industry winner can deliver.