Someone used my identity: wrongful arrests, debts and the road back

Most people picture identity theft as a card statement with a charge they do not recognise. You call the bank, the charge disappears, and life carries on. For some people it goes the other way. A loan appears that they never signed, a collector starts calling, and when they try to explain, nobody believes them. This guide covers what happened to a few people who went through that, how thieves manage it, and what to do if it is happening to you. If you are in the middle of it now, skip to the section on your first day.

The man who was jailed under his own name

In August 2019, William Woods was homeless and living in Los Angeles when he learned that someone had been running up debt in his name. He walked into a bank branch with his real Social Security card and a genuine California ID card, and said he wanted to close the accounts, according to the Justice Department.

The accounts held a lot of money, so the branch manager asked him security questions. He could not answer them, because the accounts had been set up by someone else. The bank called the Los Angeles Police Department. Officers spoke by phone to the man listed on the accounts, Matthew Keirans, who said he had not given anyone in California permission to use them and faxed in identity documents he had obtained fraudulently. Police arrested Woods.

The Associated Press reported that Keirans, a high-level IT worker at an Iowa hospital, had lived as William Woods for about three decades. The two men met in the late 1980s at a hot dog cart in Albuquerque. According to the Justice Department, Keirans obtained a Kentucky birth certificate in Woods's name and used the identity to get his hospital job and nine loans worth more than $250,000 from two credit unions.

In court, Woods kept insisting he was Woods. A California judge found him not mentally competent to stand trial, and he was sent to a state mental hospital and given psychotropic medication. He spent 428 days in county jail and 147 days in the hospital. In March 2021 he pleaded no contest to two felony charges in exchange for release, a $400 fine and an order to use only the name Matthew Keirans. The Justice Department said California later billed him more than $118,000 for the hospital stay.

What changed the outcome was one person who kept looking. In January 2023, Woods contacted the security department of the hospital where Keirans worked, and the complaint reached the University of Iowa police. Detective Ian Mallory compared DNA with the elderly man in Kentucky named on the birth certificate. The test showed that Woods, not Keirans, was the man's son. Shown the result, Keirans confessed. He was sentenced in January 2025 to 144 months in federal prison, and a California court exonerated Woods. The AP noted that Woods did not respond to its requests for comment, and this article does not guess at how he is now.

Three more people who had to prove who they were

Michelle Brown told a U.S. Senate subcommittee in July 2000 that a woman had impersonated her for about a year and a half. Brown found out when a Bank of America representative called about the first payment on a truck she had never bought. The impostor, who began with a rental application taken from Brown's landlord's office, obtained more than $50,000 in goods and services, and was later booked into a federal prison under Brown's name after a drug trafficking arrest. She spent more than 500 hours restoring her name and credit, and called it the darkest and most terrifying chapter of her life.

Malcolm Byrd, of Wisconsin, was the subject of a 2003 NBC News report. A man arrested on drug charges in 1998 had given Byrd's name. Over the next five years Byrd was handcuffed more than once, lost a part-time job after being accused of lying about a record, and had his driver's licence suspended. He gave fingerprints and received court papers proving his innocence, yet the warrants kept appearing. On one holiday weekend he spent two days in jail, even though his wife brought the clearing papers to the sheriff's office that night. Byrd was considering changing his name.

Amy Krebs described a quieter version in Forbes in 2014. In February 2013 a credit card company called to ask whether she had applied for a card. She had not. She could not get into two of her three credit reports, because the thief's details had overridden hers. The thief used Krebs's maiden name and a ten-year-old address and attempted to open more than 50 accounts, from utilities to a medical collection account. The thief was caught and pleaded guilty, but Krebs was left with the cleanup.

How someone ends up using your identity

The thief rarely has to hack anything. The ingredients are ordinary papers and facts that sit in many places.

• A stolen document. Brown's started with a rental application. Keirans used a genealogy website to research Woods's family history and then obtained his birth certificate by fraud, federal prosecutors said.
• An old name and address. Krebs's thief needed only a maiden name and an address from a decade earlier, and companies took them at face value.
• A credit file that can be overwritten. Because accounts were linked to Krebs's Social Security number, the thief's information replaced hers and locked her out of her own report.
• A police booking that nobody double-checks. NBC reported that, for lesser offences, officers often take a suspect's word on a name and date of birth. When the impostor skips court, the warrant goes out in the victim's name.
• A phone number. The Federal Communications Commission warns that scammers collect personal details from social media or buy them from hackers, convince a phone company to move your number, then race to reset passwords on your bank and social accounts. The first sign is often a phone that goes dark.

Once a false record exists, it is hard to remove. Beth Givens of the Identity Theft Clearing House told NBC that officials who run criminal records databases are reluctant to delete information once it is in there. That is why the first days matter.

What a long dispute does to a person

The debt is only part of the weight. The rest is being disbelieved, being asked to prove your name to strangers, and not knowing when it will stop. Brown wrote that she was treated as guilty until proven innocent. Krebs said victims must prove who they are to a greater extent than the thief ever had to. Stress and anxiety are among the most common causes of insomnia, according to the NHS, and a dispute that runs for months gives both plenty to feed on.

The Identity Theft Resource Center, a U.S. nonprofit, surveys the people it helps. In its 2023 report, based on 144 victims who contacted the center during 2022 and 1,048 general consumers, 16 percent of the center's victims reported thoughts of suicide, up from 10 percent the year before. The center's chief executive said the figure says as much about the lack of support for victims as about the victims themselves. It does not mean identity theft causes suicide, and many things shape how a person copes. It does mean that if you feel this low, you are far from alone, and that support matters.

A study in The Gerontologist looked at more than 2,000 identity theft victims aged 65 and over in national U.S. crime surveys from 2014 and 2016. About a third reported moderate to severe emotional distress. Distress was linked to how long the information was misused, to later money problems and trouble with friends and family, and to the hours spent resolving the case. The authors suggested that limiting losses and shortening the misuse might reduce the emotional toll.

Your first day: what to do in order

These are United States tools. In the UK, report to Action Fraud at actionfraud.police.uk. For online crime in the US you can also use ic3.gov.

1. Secure your e-mail account and phone first (the next section). Almost every other account resets its password through them.
2. Look at your credit reports. Get them free at AnnualCreditReport.com, where the Federal Trade Commission says you can check weekly. Look for accounts and inquiries you do not recognise.
3. Freeze your credit at all three bureaus. The FTC says a freeze is free and does not affect your score. Experian is 888-397-3742, TransUnion is 888-909-8872 and Equifax is 800-685-1111.
4. Report it at IdentityTheft.gov, which gives you a recovery plan and an identity theft report.
5. File a police report. Krebs said you will need a police report and an FTC affidavit, and that even these are not always enough, so keep several copies.
6. Contact each lender involved using a phone number you trust, such as the one on a statement, and ask for the fraud department.
7. Start a log of every call, date, name and reference number.

A freeze and a fraud alert do different things. The FTC describes them like this.

Tool	What it does	How long	Who can use it
Credit freeze	Nobody can open new credit in your name until you lift it. Free to place and lift.	Until you lift it	Anyone, at all three bureaus
Initial fraud alert	Businesses must verify your identity before opening new credit. Free.	One year, renewable	Anyone who suspects identity theft; one bureau tells the others
Extended fraud alert	Same as initial, and removes you from marketing lists for credit and insurance offers for five years.	Seven years	Victims with an FTC identity theft report or police report

Secure your e-mail, your Windows account and your phone

E-mail comes first because a thief who controls it can reset almost everything else. If you use a Microsoft account for Outlook or Windows, this is the order Microsoft's help pages describe.

1. Sign in to your Microsoft account security dashboard from a device you trust and open Advanced security options.
2. Scroll to Sign out everywhere and select Sign out. Microsoft says this can take up to 24 hours and covers browsers and apps, but not an Xbox console, which you sign out of separately.
3. Change the password, and change it anywhere you reused it. The Identity Theft Resource Center found that 56 percent of its surveyed victims used the same password on every account.
4. Check the Recent activity page in the same dashboard for sign-ins you do not recognise, and check the mailbox for forwarding or filtering rules you did not create.
5. Consider removing the password. Install the Microsoft Authenticator app, then open Additional security options and, under Passwordless account, select Turn on. Microsoft says these methods are harder to guess, steal or phish than a password. Some older apps still need a password or an app password, so test before relying on it.
6. On the PC, open Settings, then Accounts, then Sign-in options to set up Windows Hello, and Settings, then Windows Update to install updates. If you think the PC was infected, run a full scan in Windows Security.

Next, the phone. The FCC advises asking your phone company to add a PIN or password that must be given before any change to your account, and turning on notifications for financial accounts. Ask the carrier for a port-out PIN or number lock. You can also lock the SIM card itself: on an iPhone this is under Settings, then Cellular, then SIM PIN, and on most Android phones under Settings, then Security, then SIM card lock, though the name varies by maker. If your phone suddenly loses service, the FCC says to call the carrier and your bank at once.

The long middle: paperwork, records and proof

Most of the work is here, and it is the part that wears people down. Brown estimated more than 500 hours. Krebs, almost two years in, said it felt like it had just happened.

Keep the log. Krebs advised writing down the date, who you spoke to and what they said, and mailing everything certified. Her log reached no fewer than 200 entries and she referred back to it many times. Dispute each false account in writing, and keep going when it returns. A free legal aid clinic or consumer attorney can send the letter that ends it. Krebs got her cease and desist letter from a lawyer working for free.

If a false criminal record is involved, treat it as its own track. Ask the court or agency that handled the arrest how to correct the record, and carry copies of any clearance papers. They do not always prevent an arrest, as Byrd found. NBC reported in 2003 that California had a registry for identity theft victims, with a PIN officers could check, so ask whether your state has anything similar.

Check the other places a thief can use your number. IdentityTheft.gov suggests reviewing your Social Security work history at socialsecurity.gov/myaccount and says you can lock your number in E-Verify. The Identity Theft Resource Center offers free guidance from an advisor on 888-400-5530 or through live chat at idtheftcenter.org.

Looking after yourself during a long dispute

You cannot control how fast a bureau or a court moves. You can control how much of your day and night it takes.

• Keep the fight to set hours. The study linked hours spent resolving the theft with distress, so a fixed hour a day, with the log open, can stop calls and e-mails spreading across every evening.
• Find someone who has been through it. Krebs said the most helpful thing she found was one woman in a similar situation, a person rather than an agency listing ninety steps. Writing about it was therapeutic for her.
• Tell people close to you. The study tied problems with friends and family to distress. You did not do this.
• Protect your sleep. The NHS advises going to bed only when sleepy, getting up at the same time every day, relaxing for an hour before bed, keeping the bedroom dark and quiet, and avoiding alcohol, caffeine and nicotine for six hours before bed. It also advises against phones just before sleep, because the blue light makes you more awake.
• See a doctor if it does not ease. The NHS says to see a GP if changing habits has not helped, if trouble sleeping has lasted for months, or if it is making it hard to cope. Cognitive behavioural therapy is one treatment a GP may offer.

How to lower the chance of it happening again

No one is immune. Krebs was careful and shredded documents, and still became a victim, because many organisations hold your Social Security number. You can still make it harder.

• Keep the freeze in place. The FTC says you can lift it at a single bureau when you apply for credit and put it back afterwards.
• Ask why when someone requests your Social Security number. Krebs said she was often told it was not needed.
• Keep verification details off social media: date of birth, the last four digits of your Social Security number, pet names and your mother's maiden name, which the FCC says thieves use to pass phone company checks.
• Use a port-out PIN, a SIM PIN, an authenticator app or passkeys, and a different password for every account.

If you need to talk to someone now

If the weight of this has reached the point where you are thinking about harming yourself, please talk to someone today. These feelings can pass, and people who reach out get through the hardest stretch. In the United States, call or text 988 to reach the 988 Suicide and Crisis Lifeline. In the UK and Ireland, call Samaritans free on 116 123. In an emergency, call your local emergency number. You do not need to have solved the problem first.

Frequently asked questions

Someone is using my identity. What should I do first?

Secure your e-mail and phone, check your three credit reports at AnnualCreditReport.com, freeze your credit at Equifax, Experian and TransUnion, and report it at IdentityTheft.gov. Then file a police report and start a log of every call and letter.

Someone took a loan in my name. Do I have to pay it?

Do not pay it out of fear. Contact the lender's fraud department using a number you trust, report the theft at IdentityTheft.gov and dispute the account in writing with your identity theft report. Because rules differ by state and lender, a legal aid clinic or consumer attorney can tell you where you stand.

Does a credit freeze cost anything or lower my credit score?

No. The FTC says freezing and unfreezing is free and does not affect your score. You place it at all three bureaus and lift it at one when you apply for credit.

How long does a fraud alert last?

An initial fraud alert lasts one year and can be renewed. An extended fraud alert lasts seven years, but needs an FTC identity theft report or a police report.

Can identity theft lead to a wrongful arrest?

It can, though officers say it is uncommon. Malcolm Byrd and William Woods were both arrested because of someone else's use of their names. Keep copies of court papers and police reports, and ask the agency involved how to correct the record.

How do I know my identity was stolen?

Common signs are accounts or inquiries on your credit report you do not recognise, calls from collectors about debts you never took, and a phone that suddenly loses service. Krebs's first sign was a credit card company asking if she had applied for a card.

How long does it take to recover from identity theft?

It varies widely. Michelle Brown spent over 500 hours, and Amy Krebs was still finding new problems almost two years later. Acting quickly and keeping a detailed log helps shorten it.