Identity theft and account takeover
Identity scams collect the pieces needed to become you. The individual requests look small, which is why they get answered.
What it is
An identity scam obtains enough personal information to open accounts, take over existing ones, or impersonate you to an institution.
It rarely arrives as one dramatic event. It is assembled: a date of birth from one place, a Social Security number from a breach, an address from public records, a password from a phishing page, a one-time code from a phone call. Each piece has limited value alone. Together they are enough for a bank, a lender or a phone carrier to believe someone else is you.
The consequences are slower and longer than other categories. Credit opened in your name, tax returns filed before you file, medical treatment billed to your insurance, benefits claimed, and in some cases a criminal record attached to your name.
How it starts
Often somewhere you cannot see. A breach at a company you have an account with puts your details into circulation, and you learn about it later or never.
Then the pieces are gathered actively. A phishing email or text harvests a password. A phone call verifies details "for security". A survey or competition collects a date of birth and address. A fake delivery page takes a card. A public social media profile provides a pet's name, a school, a mother's maiden name, and a birthday.
Account takeover usually turns on the phone number. If someone can move your number to a device they control, which is a SIM swap, they receive your verification codes and can reset the accounts secured by them. That is why a phone suddenly losing service without explanation is an emergency rather than an annoyance.
Why it works
Each request is individually reasonable. Nobody is asked for their identity. They are asked to confirm a date of birth, complete a form, or verify a code. The assembly happens somewhere the victim cannot observe.
Security questions are public information. A mother's maiden name, a first school and a pet's name are all answerable from a social media profile.
Password reuse converts one breach into many. One password taken from a low-value site opens the email account, and the email account opens everything else.
SMS codes are weaker than they feel. Anything protected only by a code sent to a phone number is protected only as well as the phone number, and phone numbers can be moved.
Discovery is delayed by design. Address changes, redirected mail and altered contact details exist to keep you unaware while accounts are opened.
How to spot it
Your phone loses service unexpectedly and the carrier has no outage
Verification codes arrive for logins you did not attempt
Expected mail stops arriving, particularly statements
A notice of an account, card or loan you did not open
A credit report showing enquiries you do not recognise
A tax return rejected because one was already filed in your name
Medical bills or insurance statements for treatment you did not receive
Emails confirming a change of address, phone number or password that you did not make
A debt collector contacting you about a debt you have never heard of
What to do
If your phone loses service suddenly, treat it as urgent. Call the carrier from another phone and ask whether your number was ported or a SIM was reissued. Every minute matters, because your codes are going elsewhere.
Freeze your credit. A freeze at Equifax, Experian and TransUnion is free, prevents new credit being opened in your name, and can be lifted temporarily when you need it. It is the single most effective step available and most people never take it.
Secure email first. Email is the master key. Change that password, make it unique, and enable two-factor authentication using an authenticator app rather than SMS wherever the option exists.
If identity theft has already happened. Report at identitytheft.gov, which generates an FTC affidavit and a personalised recovery plan. File a police report. Contact each affected institution's fraud department directly. Keep a written record of every call, with dates and names, because you will need it repeatedly.
Check what is already exposed. A breach-notification service will tell you which of your accounts appear in known breaches. Change the password anywhere it appears, and anywhere you reused it.
Recovery is slow, and that is normal. Identity theft is resolved through paperwork and repetition rather than a single call. Being organised early shortens it considerably.
Have this emailed to you
Send yourself this page so you can forward it, or read it later when you are not standing in a shop.
Email it to myselfPaste a text, email or direct message
A text, an email or a chat message. Take out names and account numbers first.
Add a screenshot
Check it
No account needed.
What happens to your message
Checking the message now. Stay on this page.
Flggd could not check this message just now. Try again in a moment, or use the Flggd app.
Try again
Flggd could not read this image, so it has not been checked. This is not a verdict. Try a clearer screenshot, or paste the text instead.
Paste a message or add a screenshot first.
Text Submission
Image Submission
Flggd Verdict
Scam
Red flag
High confidence of a scam. The content, the sender, the intent and where its requests lead all point the same way. Do not reply, click, call or pay.
Likely to be a scam
Yellow flag
It asks you to act: a link, a number, a reply or a payment. Where that request leads is where the harm starts.
Looks normal
Green flag
High confidence this is normal. The content reads as expected, the sender has a safe history, and anything it asks leads somewhere legitimate. Accounts can be taken over, so if a request seems out of character, check again.
Likely to be a scam
Grey flag
Nothing is asked of you yet. The content, the sender or the intent do not add up. Scams like this start friendly and ask later.
This result could not be shown. Check the message again. If it happens twice, use the Flggd app instead.
Score
Scam type
Confidence
Why Flggd says this
What this message wants you to do
Has anything happened yet?
You do not have to answer. Nothing you tap here is sent or recorded, and the verdict above stands either way.
Change answer
Nothing has happened yet
Good. Checking first is the safest thing to do. Do not tap any link, reply, or call any number in the message. Block the sender and delete the message. If it claims to be from an organisation you know, contact them using details you already trust.
Change answer
You tapped a link
Opening a link does not usually take money or details on its own. The harm comes from what you do on the page it opens. If you entered nothing and installed nothing, close the page and do not go back to it. If it asked you to sign in, enter a code, or install something, and you did, choose Gave details instead.
Change answer
You gave details
Work through this in order. First, if you gave bank or card details, call your bank now on the number on your card. Next, change the password for any account you entered, and for any other account that uses the same password. If you shared a one-time code, tell the organisation it belongs to straight away. Then turn on two-step verification where you can, and watch your statements for anything you do not recognise.
Change answer
You sent money
Call your bank now, on the number on your card or in your banking app. Say: "I have been scammed and I need to stop a payment." The sooner they hear from you, the more they may be able to stop or recover. In the UK you can call 159 to reach your bank. Do not pay anyone who offers to get the money back. That is another scam.
Report it. US: ReportFraud.ftc.gov, and ic3.gov for online crime. UK: reportfraud.police.uk or 0300 123 2040; in Scotland, Police Scotland on 101. Australia: scamwatch.gov.au. Have ready the message, the sender's number or address, and any payment details.
What to do next
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
No action needed. If the sender later asks for money, codes or personal details, check that message too.
Do not reply at all, not even to say wrong number. A reply tells them the number is live. Block the sender and delete the message. If a request follows, check it again.
Text read from your image
Your image
The closest scam in the Flggd library. Similar, not necessarily the same message.
How this scam works
The closest match is the scam described on this page.
Share this result
Email it to myself
Copied. Paste it anywhere to share it.
Could not copy. Select the text and copy it, or use Email it to myself.
Checked with Flggd at flggd.com
My Flggd verdict
Check the next one on your phone
The Flggd app checks texts, emails and screenshots wherever you are, and teaches you the warning signs as you go. Free on iPhone and Android.
Get the app
What Flggd does about this
Worried about someone else rather than yourself?
Helping someone else
