Identity Theft: Recognizing It and Responding to It

What this means

The most useful thing to understand about scams is that the story is not the signal. The stories change constantly, tracking whatever is in the news, and trying to memorize a list of current scams means being unprepared for next year's. The structure is far more stable, and it can be recognized in seconds.

Nearly every attempt shares four features. The contact is unsolicited, meaning it arrives without you having initiated anything. It manufactures urgency, insisting that something must be resolved immediately. It discourages verification, sometimes by explicit secrecy and sometimes by simply not leaving room for you to hang up and call back. And it requests payment or information through a channel that cannot be reversed or traced easily, such as gift cards, wire transfers, cryptocurrency, or payment apps sent to strangers. That combination is the pattern, whatever the cover story.

PhishingA message designed to look like it comes from a trusted organization in order to get the recipient to reveal information or click a harmful link. is the email version, and the same technique delivered by text message is often called smishing. The tells are usually visible without any technical skill: a sending address or link domain that resembles a real organization's without matching it, a greeting that does not use your name, a request that a legitimate institution would not make by email, and pressure to act before you check. Caller ID can be made to display a number other than the caller's, so a familiar number appearing on your phone is not verification of anything.

One specific move deserves naming because it is unusually effective. Real organizations do not ask you to move money to a "safe account," and government agencies do not call demanding immediate payment or threatening arrest. Any message doing either is fraudulent, without exception and without needing further analysis.

The second half of the standard concerns what you disclose. A Social Security numberA number issued by the Social Security Administration, used for tax and benefit purposes and widely relied on as an identifier in financial records. is valuable to a criminal precisely because so many institutions treat it as proof of identity. There is a short list of situations where providing it is ordinary: an employer needs it for wage reporting, a financial institution generally needs it to open an account, a lender needs it for a credit application, and government agencies need it for their own programs. Outside that category, you may ask why it is required, how it will be stored, and what happens if you decline. Many organizations request it out of habit and will accept an alternative when asked. You should never provide it, or an account number, in response to unsolicited contact, no matter who the sender appears to be.

The last part of the standard is the one people are least prepared for: what to do afterward. Identity theft is common enough that reasonable precautions reduce risk without eliminating it, and the response is well documented. A fraud alertA notice placed on your credit file telling lenders to take extra steps to verify identity before extending credit. and a credit freezeA restriction that blocks new creditors from accessing your credit file, preventing most new accounts from being opened in your name until you lift it. are two different tools with different strengths, and knowing which is which before you need them is the point of learning this now.

Why it matters

You are in the highest-exposure group for one specific reason: young people have credit files that are rarely checked. An account opened fraudulently in a teenager's name can sit undetected for years, and is frequently discovered only when the person applies for their first apartment, loan, or job. The damage is not that the money vanishes immediately. It is that the discovery comes late, at the moment you most need your records to be clean.

The recognition skills also transfer well beyond finance. The four-part structure described above is the anatomy of manipulation generally. Learning to notice manufactured urgency and discouraged verification is useful in a great many situations that have nothing to do with money.

Try it

This activity is about recognition and response. Do not attempt, simulate, or write instructions for any deceptive technique, and do not use real personal information belonging to yourself or anyone else at any point.

1. Build the structural checklist first. From the Federal Trade Commission's consumer materials and the FBI's public fraud resources, extract the recurring features that identify a fraud attempt. Express them as a short list of questions a person could run through in under thirty seconds.
2. Collect real examples from official archives. The FTC, the Consumer Financial Protection Bureau, and many state attorney general offices publish consumer alerts describing current scam patterns. Gather examples across at least four channels: email, text message, phone, and online marketplace or social platform.
3. For each example, annotate it against your checklist from step 1. Mark which structural feature each part of the message satisfies. The goal is to show that different stories share one skeleton.
4. Identify the reversibility signal specifically. For each example, note what payment or information channel was requested and whether that channel allows recovery. Build a short ranking from most to least recoverable and explain what makes the difference.
5. Now the disclosure question. Build a two-column table: situations where providing a Social Security number is ordinary and expected, and situations where a request is a warning sign. Source the first column from the Social Security Administration and the FTC rather than from intuition.
6. Draft the three questions a person should ask when an organization requests a Social Security number: why it is needed, how it will be protected, and what happens if you decline. Write out what an acceptable answer to each sounds like.
7. Extend the table to account numbers, dates of birth, and account credentials. Note which of these an institution would ever legitimately request through inbound unsolicited contact. The answer to that is short, and discovering how short is the point.
8. Build a prevention set. Research current guidance on account security, document handling, and credit file monitoring from the FTC and CISA. Include the difference between a fraud alert and a credit freeze, what each does, what each costs, and how each is placed and lifted.
9. Identify the detection signals. Research what indicates that identity theft may have already occurred: unrecognized accounts or inquiries on a credit report, bills or collection calls for unknown debts, an unexpected denial of credit, notices about a tax return you did not file, or medical statements for care you did not receive.
10. Now write the response protocol, which is the most important product of this lesson. Using IdentityTheft.gov as your primary source, write the ordered sequence a victim should follow. It should cover reporting to the FTC and obtaining a recovery plan, placing a fraud alert or freeze with each of the three nationwide credit bureaus, obtaining and reviewing credit reports through the official annual report service, contacting affected institutions and closing or securing accounts, filing a police report where appropriate, and disputing fraudulent accounts in writing.
11. Add the documentation layer. Specify what a victim should record and keep: dates, names, reference numbers, and copies of every written communication. Explain why written disputes matter more than phone calls.
12. Identify the special cases. Determine what additional steps apply if a Social Security number is misused, if a fraudulent tax return is filed, or if the victim is a minor whose credit file should not exist at all.
13. Produce a one-page reference card, suitable for someone with no background, containing the recognition checklist on one side and the response protocol on the other. Cite every source with the date you accessed it, since agency procedures are updated.

Check yourself