An unfamiliar account, a debt you do not recognize, or a changed account recovery address deserves investigation. Verify the evidence through official channels before sharing information or paying anyone.
Start with the evidence
Identity theft means someone uses your identifying information without permission. An unexpected credit inquiry can be a warning, but it can also reflect a legitimate application or a company name you do not recognize. Treat an alert as a reason to investigate, not as a complete diagnosis.
Write down exactly what changed: the account name, date, amount, reference number, and where you saw the notice. Keep screenshots and original messages in a private folder. Avoid forwarding documents containing a Social Security number or full account number to an unverified address.
| What you notice | First verification step |
|---|---|
| A new account on a credit report | Ask the named lender about the account through its official fraud team |
| An unfamiliar card transaction | Check the merchant description, then contact your bank |
| A password or recovery-email change | Open the service directly and review active sessions |
| Missing expected statements | Check your contact details with the institution |
Check accounts through a route you trust
Open your bank app or type a known website address yourself. Do not use the callback number in a suspicious message. For a credit-file issue, obtain your reports through the official route described by the CFPB and compare the underlying entries, not just a score change.
Start with your main email account because it often controls password resets elsewhere. Review recovery addresses, forwarding rules, connected apps, and signed-in devices. If a session is unfamiliar, sign it out after securing the account. Use a unique password and the strongest available sign-in protection.
Check one account at a time and record the result. A simple incident log prevents conflicting reports when several providers are involved. It also helps you distinguish a confirmed fraudulent account from an alert that has already been explained.
Contain confirmed misuse
If a financial account is affected, contact that institution promptly using its official fraud process. Ask what it can restrict, how to preserve access to legitimate funds, and how to document the dispute. Do not assume that changing your email password closes a fraudulent financial account.
For U.S. identity theft, IdentityTheft.gov provides reporting and recovery guidance. A credit freeze is another tool: contact each of the three nationwide credit bureaus when you want a freeze across all three files. It helps restrict new credit access; it does not reverse existing charges or protect every type of account.
Keep confirmation numbers, dates, copies of submitted evidence, and follow-up deadlines together. When a company asks for a document, use its verified secure upload route. A demand to buy gift cards or transfer funds to a “safe account” is not a legitimate recovery step.
A realistic example
Imagine an alert names a store card you never applied for. First check whether the name belongs to an existing account or authorized application. If it is unfamiliar, contact the issuer, ask its fraud team to investigate, and record the case number. Then inspect the other reports and secure any account involved in the application.
A monitoring subscription may organize alerts and provide assistance, but you can begin these steps without buying one. Compare identity-protection services only after identifying which ongoing help you need. If the issue is a lost document, use the separate Social Security card checklist.
Sources & review notes
Source review: September 25, 2026. Official resources support the steps above. U.S. procedures apply where stated; follow the relevant authority in your country.
About the author
Luca MoreauIdentity protection & practical securityLuca’s coverage turns identity-protection and everyday security questions into manageable checklists. The weekly briefings cover accounts, networks, and safer browsing, with a practical action readers can complete in a single sitting.
View profile and articles
