My Parents Are Aging
Menu
Illustration of a calm adult child at a desk with a phone and blank notepad while an older parent stands beside them looking relieved

report, freeze, check, protect

Identity theft is fixable if you work in the right order.

A new card the parent never applied for, a tax return in their name: the response order matters more than the panic. Report it officially, freeze the credit, check the damage, and protect what is left.

When a Parent's Identity Is Stolen: The Response Order

A new credit card the parent never applied for. A tax return filed in their name. A medical bill for treatment they never had. Identity theft in older adults is common, underreported, and fixable if you work in the right order. This page is that order: report, freeze, check, and protect, with the official place to do each step.

Last reviewed August 2026 Reading time: 6 minutes

report, freeze, check, protect

The identity theft recovery map

The order matters: report to the official identity-theft site first for the recovery plan, freeze the credit files to stop new damage, check the damage in order, then protect what is left.

  1. Step 1Report firstFile an Identity Theft Report at the federal site: it creates the recovery plan, gives legal protection from the fraudulent accounts, and is the document the bureaus and police will ask for.
  2. Step 2Freeze the credit filesA free credit freeze at Equifax, Experian, and TransUnion blocks new accounts being opened in the parent's name. It does not hurt the score and stays until lifted; keep the PINs in the family vault.
  3. Step 3Check the damage in orderFree credit reports read for accounts never opened, fraudulent accounts reported to creditors, bank accounts checked for unauthorized charges, and the separate IRS and Medicare fraud tracks if those were touched.
  4. Step 4Protect what is leftChange passwords (email first) and turn on two-factor, watch the mailbox, shred anything with a Social Security number, and review EOB statements for medical identity theft: this is fixable and never the parent's fault.

The rule, in one sentence: work in this order: report to the official identity-theft site, freeze the credit files, check the damage, then protect what is left. The order matters because reporting first gives you the recovery plan, and freezing first stops new damage while you check.

How identity theft shows up in older adults

The classic signs in a parent: collection calls for debts they do not recognize, a credit card or loan they never applied for, a tax return rejected because one was already filed, medical bills for treatment they did not receive, or a sudden problem with their Social Security benefits. The theft often began with a scam call, a phishing text, a lost wallet, or paperwork from a downsizing or a move that was not shredded.

Step 1: report (this is the official recovery plan)

Go to the federal government's identity-theft site and file an Identity Theft Report. That report does three things: it creates your recovery plan, it gives you legal protection from being held responsible for the fraudulent accounts, and it is the document the credit bureaus and the police will ask for. Do this first, before calling the credit bureaus, because the plan tells you what to do next in your specific situation. See Sources for the link.

Step 2: freeze the credit files

A credit freeze blocks new accounts from being opened in the parent's name, which is the whole game: identity thieves want to open new credit, and a freeze stops them at all three major bureaus. It is free, it does not hurt the parent's credit score, and it stays until you lift it. Do all three bureaus, keep the PINs in the family vault, and remember that a freeze does not stop charges on existing cards, so check those too.

Step 3: check the damage, in order

  • Get the free credit reports from the three bureaus and read them for accounts the parent never opened. Dispute anything fraudulent in writing, with a copy of the Identity Theft Report.
  • Call any creditor that shows a fraudulent account and tell them the account is fraudulent, using the report as backup.
  • Check the bank accounts the parent actually has for unauthorized charges or transfers, and set up alerts on them.
  • If the theft involves a tax return (a rejected e-file or a notice about a return the parent never filed), follow the IRS identity-theft recovery steps, which are separate from the general report.
  • If Medicare or Medicaid was used fraudulently (medical identity theft), report it to the Medicare fraud hotline, because fraudulent claims can poison the parent's medical record with someone else's treatments.

Step 4: protect what is left

  • Change passwords on the email and financial accounts, email first, and turn on two-factor authentication. See Two-factor authentication for parents.
  • Watch the parent's mailbox. Stolen mail is how much of this starts. Consider a locking mailbox or a PO box if mail theft is likely.
  • Shred paperwork properly. Anything with a Social Security number, account number, or signature goes through a cross-cut shredder, not the trash. See the downsizing disposal guide for the paperwork in the piles.
  • Check for medical identity theft specifically: review the Explanation of Benefits statements for services the parent did not receive.

The conversation with your parent

Identity theft is not the parent's fault, and the shame of "how did this happen to me" makes older adults hide it. Say it plainly: this happens to millions of people, it is fixable, and the two of you will fix it together, one step at a time. Do not interrogate about how it happened; the report and the freeze matter more than the post-mortem. The same shame-free tone from the scam-recovery guide applies here.

Related

Sources

Found an error? Report it.

The next thing your family needs

A bank account was compromised: the first-hour response

Also relevant: