By Jackson Godwin | Cybersecurity Analyst & Penetration Tester, Jackson Technology
Identity theft rarely announces itself. There is no alarm, no dramatic notification — just small, easy-to-miss signals that appear weeks or even months before the full damage becomes visible. By the time most people realize something is wrong, criminals may have already opened accounts, filed fraudulent tax returns, or run up charges in their name.
The scale of the problem is significant. Consumers filed more than 2.6 million identity theft reports with the FTC in 2024, and when combined with reports shared from federal, state, and local law enforcement agencies, that number topped 6.5 million. Credit card fraud alone accounted for over 540,000 reported cases in just the first three quarters of 2025, and identity theft has topped the list of consumer security concerns for two years running.
The good news is that identity theft almost always leaves a trail — small charges, unexpected mail, unfamiliar credit inquiries — before it escalates into something serious. Knowing what these early signals look like, and acting on them quickly is the single most effective way to limit the damage. This guide walks through the warning signs that matter most, organized by where they typically first appear, along with the specific steps to take if you spot one.
Financial Account Warning Signs
Financial accounts are where the signs of identity theft most often become visible first — but only if you're looking. Bank statements, credit card bills, and credit reports are the earliest battlegrounds, and criminals know exactly how to stay under the radar within them.
Small, Unfamiliar Charges
One of the earliest and easiest-to-miss signs of identity theft is a small, unfamiliar charge — sometimes as little as $1 or $2 — on a checking account or credit card. Criminals frequently test stolen card information with these tiny transactions before attempting larger purchases. If a charge doesn't look familiar, even if it's trivial, it's worth investigating.
Unexplained Withdrawals
Any withdrawal from a bank account that you did not authorize is a direct red flag identified by the FTC. This applies whether the withdrawal is large or small, and whether it occurred through a physical transaction, an online transfer, or an ACH debit.
Merchants Refusing Checks or Cards
If a merchant unexpectedly refuses your check or declines a card that should have available credit or funds, it can indicate that your account has been flagged for suspicious activity — sometimes before you've even noticed anything wrong yourself.
Credit Report and Credit Inquiry Warning Signs
Your credit report is one of the most powerful early-warning tools available, precisely because most fraudulent activity involving your identity has to pass through the credit system at some point. Federal law entitles every consumer to free credit reports from each of the three major bureaus, and reviewing them at least quarterly can help catch unauthorized activity before it compounds.
Hard Inquiries You Didn't Initiate
A hard credit inquiry that you did not request is a strong sign that someone is attempting to open an account using your personal information — even if the attempt was ultimately unsuccessful. This is often one of the earliest visible signals, appearing before any account is actually opened.
New Accounts You Didn't Open
New credit cards, store accounts, or loans appearing on your credit report that you didn't open confirm that identity theft has already occurred, not merely been attempted. At this stage, immediate action — placing a fraud alert or credit freeze with all three major bureaus — is critical.
A Sudden Wave of Pre-Approved Credit Offers
An unexpected surge in pre-approved credit offers from lenders you don't normally use can indicate that a thief has opened, or attempted to open, accounts in your name, triggering your information to be shared more broadly across the credit marketing ecosystem.
Debt Collectors Contacting You About Unfamiliar Debts
Being contacted by debt collectors about debts that aren't yours is a clear sign that someone has used your identity to obtain credit or services without your knowledge.
Mail, Tax, and Document-Based Warning Signs
Some of the most overlooked warning signs arrive through the mail or during tax season — channels people check less frequently than their bank apps, and where criminals know scrutiny tends to be lower.
Missing or Redirected Mail
Missing bills or other expected mail can indicate that a criminal has redirected your mail — sometimes through a fraudulent change-of-address request. If you receive a USPS Move Validation Letter for an address change you did not request, treat it as an active red flag rather than a clerical error. USPS sends this letter to your old address within ten business days of any change-of-address request specifically so you can catch unauthorized changes.
Unexpected Tax Forms
Receiving a 1099 or W-2 from a company you never worked for is a significant warning sign that someone has used your Social Security number to earn income reported under your name. Left unaddressed, the IRS may treat that income as yours, creating a tax liability that takes time and documentation to correct.
IRS Notices of Duplicate Tax Filings
An IRS alert indicating that more than one tax return has been filed in your name is one of the clearest possible signs of identity theft, often indicating a criminal attempted to claim a fraudulent refund using your information before you filed.
Data Breach Notifications and Medical Record Warning Signs
Data Breach Notifications
A notification that your information was compromised in a company data breach is not just background noise — it is a direct signal that your personal data may now be circulating among criminals, even if no fraudulent activity has occurred yet. This is the moment to proactively monitor accounts and credit reports more closely, rather than waiting for fraud to materialize.
Medical Billing and Insurance Discrepancies
Medical bills for services you never received, or health plan rejections and denials because your records show conditions or benefit limits that don't apply to you, can indicate medical identity theft — where someone has used your insurance information to obtain treatment or prescriptions in your name.
Warning Sign Categories at a Glance
| Category | Example Warning Sign | What It Often Means |
| Financial accounts | Small unfamiliar charge, unexplained withdrawal | Stolen card or account credentials being tested or used |
| Credit report | Hard inquiry or new account you didn't open | Active attempt to open credit in your name |
| Mail and address | Missing bills, unexpected change-of-address letter | Mail redirection to intercept sensitive documents |
| Tax records | 1099/W-2 from unknown employer, duplicate filing alert | Your SSN used to report income or claim a refund |
| Data breach notices | Company notification of a breach involving your data | Your information may now be circulating among criminals |
| Medical records | Bills for services not received, plan benefit discrepancies | Medical identity theft using your insurance information |
What to Do If You Spot a Warning Sign
The response to nearly every warning sign above follows a similar pattern, and acting quickly meaningfully limits the damage in most cases.
- Contact the relevant financial institution immediately to dispute any unfamiliar charge or withdrawal and request a replacement card if needed
- Place a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — if you spot unfamiliar inquiries or accounts
- Report identity theft to the FTC at reportfraud.ftc.gov, which provides an official recovery plan tailored to your situation
- Contact the IRS directly if you receive an unexpected tax form or duplicate filing notice, and follow their identity theft documentation process
- Notify the USPS if you receive a Move Validation Letter for a change you didn't request, to halt the unauthorized redirection
- Review and update passwords for any accounts associated with a breach notification, prioritizing accounts where you've reused that password elsewhere
- Keep detailed records of every step taken — dates, reference numbers, and names of representatives contacted — as this documentation is often required to resolve disputes and remove fraudulent items from your record
| 📋 The Most Important Habit Most of the warning signs covered in this guide are only useful if you're actually looking for them. Reviewing your credit reports at least quarterly, checking bank and credit card statements regularly for small unfamiliar charges, and treating every data breach notification as an active prompt to increase monitoring — rather than routine background noise — are the habits that turn identity theft from a months-long ordeal into a quickly contained incident. |
Final Thoughts
Identity theft is rarely a single dramatic event. It's a slow accumulation of small signals — a $2 charge, a credit inquiry you don't remember authorizing, a piece of mail that never arrived — that, taken individually, are easy to dismiss. Taken together and acted on early, they represent the best chance most people have to stop identity theft before it escalates into months of disputes, credit damage, and lost time.
The single most effective thing you can do is build the habit of regularly checking the places where these signs first appear: your bank and credit card statements, your credit reports, your mail, and your tax records. None of this requires special tools or technical expertise — just consistency and a willingness to investigate anything that looks even slightly out of place.
About the Author
Jackson Godwin is a Cybersecurity Analyst and Penetration Tester, and the founder of Jackson Technology, a cybersecurity and data protection consulting firm based in Abuja, Nigeria. Jackson Technology provides VAPT, cloud security, compliance advisory (ISO 27001, NDPA, GDPR), and AI governance consulting to enterprise clients across banking, fintech, oil and gas, and the public sector. Jackson is also affiliated with TechTrain Academy, where he contributes to cybersecurity capacity-building initiatives.
For consulting inquiries, data protection assessments, or security awareness training, contact: info@jacksontechnology.com.ng