Identity theft does not always start with a hacked account or a large data breach. A stolen wallet, missing mail, discarded paperwork, or an unexpected request for personal information can give a thief enough details to misuse an existing account or try to open a new one.
The safest approach is not to guess which method is most common. Reduce the amount of personal information that is easy to reach, notice missing documents quickly, and act as soon as a card, statement, or account looks wrong. Here are five low-tech routes to watch and practical steps that can reduce the risk.
1. A stolen wallet, purse, or payment card
A wallet can contain a driver’s license, several payment cards, insurance information, receipts, and other details that help a thief impersonate you. Carry only the cards you expect to use. Leave your Social Security card, birth certificate, and other identity documents secured at home unless you have a specific reason to bring them.
Do not keep a debit-card PIN in the same wallet or bag as the card. If a credit, debit, or ATM card is missing, contact the issuer immediately through the number in its official app, on its website, or on a statement you already trust. The Federal Trade Commission explains that your legal protections can depend on the type of card and how quickly you report the loss.
If the wallet also held your license, Social Security card, or other sensitive documents, use IdentityTheft.gov to get recovery steps that match what was exposed. A missing card is an account-security problem first. It becomes an identity-theft problem when someone uses your information to impersonate you or open accounts.
2. Mail taken from your mailbox or redirected
Statements, replacement cards, tax documents, insurance notices, and preapproved credit offers can expose personal or account information. Pick up incoming mail promptly. If an expected check, card, or other valuable item does not arrive, contact the sender instead of assuming it is late.
The U.S. Postal Inspection Service recommends using USPS Hold Mail when you will be away, filing a change of address when you move, and telling financial institutions your new address. Deposit outgoing mail before the last collection time or take it to a Post Office when it contains sensitive material.
Watch for a sudden stop in bills or statements. The FTC lists missing bills as a possible sign that someone changed your billing address. Review your accounts online through a known app or bookmarked site, and confirm that your mailing and contact information are still correct.
3. Personal records placed in trash or recycling
Bank statements, credit offers, medical paperwork, old IDs, credit reports, and account-related mail can reveal information even when the account itself is closed. Shred documents that contain personal or financial details before discarding them. Cross-cut shredding makes reassembly harder than tearing paper into a few pieces.
Do not destroy records simply because they contain sensitive information. Some records must be kept for tax, property, insurance, legal, or warranty purposes. The FTC’s current document guide separates records to keep from documents to shred, while the IRS says tax records should be retained as long as they may be needed under the applicable limitation period. Store documents you still need in a locked location, and use a community shred event if you do not have a shredder.
Remove labels from prescription containers and packages when they show more information than necessary. Empty mail and document bins before a move, renovation, or service visit so old paperwork is not left behind.
4. Documents left in a car, home, or shared workspace
A break-in does not need to involve a computer. A thief may take a checkbook, tax folder, employee form, insurance record, or spare card. Keep vital records and rarely used cards in a secured location rather than a desk drawer, glove compartment, or visible bag.
Limit the documents you bring to appointments. Ask what information is actually required and take paperwork home when the visit ends. At work or in a shared household, do not leave pay stubs, benefit forms, or copies of identification at a printer or on an open desk.
If physical records disappear, list exactly what was in the folder or container. Contact affected financial institutions, replace exposed identification through the issuing agency, and monitor the accounts tied to those documents. A precise inventory is more useful than a general assumption that every account is compromised.
5. Personal information collected through an unexpected request
Low-tech theft can also begin with a phone call, a paper form, a person at the door, or someone watching while you enter a PIN. Do not give an unexpected caller your Social Security number, account number, PIN, password, or one-time verification code. A caller may already know your name, address, or part of an account number, but that does not prove the request is legitimate.
End the conversation and contact the organization through information you find independently. Shield the keypad when entering a PIN, collect receipts, and do not leave completed forms where other people can see them. Ask why sensitive information is needed, how it will be used, and whether a less sensitive identifier will work.
If you already shared information with a scammer, the FTC recommends using IdentityTheft.gov when the information has been misused and its data-breach guidance when you are not sure whether misuse occurred.
What to do when something is missing or exposed
| What happened | First action | What to check next |
|---|---|---|
| Credit, debit, or ATM card missing | Report it to the issuer immediately | Recent transactions and recurring payments |
| Wallet or identity documents stolen | Contact issuers and the document agencies | Credit reports, bank accounts, and contact details |
| Expected card, check, or statement missing | Contact the sender and check your address | Mail-forwarding changes and account activity |
| Tax, medical, or financial papers missing | Inventory the exposed information | Accounts that use those identifiers |
| Personal information given to an impostor | Contact affected institutions through official channels | IdentityTheft.gov recovery steps and credit reports |
Change credentials for affected online accounts, but do not assume a password change fixes misuse of a Social Security number, account number, or physical ID. Review all three credit reports for accounts or inquiries you do not recognize. Credit Dad’s guide to spotting fraud on your credit reports explains how to separate a reporting error from possible identity theft.
Use freezes and fraud alerts for the right purpose
A security freeze restricts access to your credit file and can make it harder for someone to open a new credit account in your name. It is free, and you must place it separately with Equifax, Experian, and TransUnion. A freeze does not stop theft from an existing bank or card account.
An initial fraud alert tells businesses to take reasonable steps to verify your identity before approving new credit. You can place it with one nationwide credit reporting company, which must notify the other two. The Consumer Financial Protection Bureau says an initial alert lasts one year. An extended alert has different requirements and is intended for people with an identity theft report.
Review the current instructions before acting. Do not pay for a credit lock because you think it is required for protection. The CFPB notes that free security freezes are available under federal law.
Report identity theft and keep a recovery record
If someone used your identity, contact the fraud department at each affected company and report the theft at IdentityTheft.gov. The site creates an FTC Identity Theft Report and a personalized recovery plan. Save case numbers, letters, dates, account confirmations, and copies of the documents you send.
Use AnnualCreditReport.com to obtain reports from the three nationwide credit reporting companies. The official site currently says reports are available weekly. Continue checking bank and card statements because a credit freeze does not detect or stop every form of account misuse.
For a child whose information may be exposed, the steps differ because the child may not yet have a credit file. Credit Dad’s guide to child identity theft and unauthorized card use explains how parents can separate a card-use issue from a fraudulent account.
A low-tech identity protection checklist
- Carry only the cards and identification you need
- Keep PINs and Social Security cards out of your wallet
- Retrieve mail promptly and use Hold Mail when away
- Contact senders about overdue checks, cards, or statements
- Shred sensitive documents only after confirming they are no longer needed
- Lock up tax, identity, property, and account records
- Keep personal paperwork out of cars and shared spaces
- Verify unexpected requests through a separate trusted channel
- Review bank, card, and credit-report activity
- Use IdentityTheft.gov when someone misuses your information
Physical paperwork and everyday routines still matter. You do not need to predict exactly how a thief might act. Reduce exposed information, notice missing items quickly, and use the recovery process that matches the problem.