Identity theft rarely announces itself with an obvious alert. It tends to surface sideways — a loan application gets declined for reasons you can't explain, a debt collector calls about an account you never opened, or a credit check reveals accounts you don't recognise. Knowing the early warning signs, and having a clear recovery sequence ready, makes a real difference to how much damage it does before you catch it.
Early warning signs worth taking seriously
- Unexpected declines on credit or account applications, when your own financial history doesn't explain why.
- Bills or statements for accounts, cards, or services you never opened arriving at your address.
- Missing mail you were expecting — a stolen or redirected statement is a known method for gathering the details needed to open accounts in your name.
- Calls or letters from debt collectors about debts that aren't yours.
- Your bank flags unusual activity you didn't initiate, even if the specific transaction gets blocked.
- You can't log into an existing account because the password's been changed — a sign the account itself may already be compromised.
Checking your position proactively
You don't have to wait for a warning sign. South Africans can request a copy of their credit report from the major credit bureaus (Experian, TransUnion, Compuscan), and by law you're entitled to one free report per year from each. Reviewing it periodically for accounts or enquiries you don't recognise is a genuinely useful habit, not just a reactive one.
If you suspect it's happened
1. Contact your bank immediately if any financial account is involved, to freeze or secure it before further damage occurs.
2. Place a fraud alert with the credit bureaus. This flags your profile so new credit applications get extra verification before being approved.
3. Report it to the South African Police Service and get a case number — you'll likely need this for insurance claims, bank disputes, or clearing fraudulent accounts later.
4. Change passwords on any account that might be connected, starting with email, and enable two-factor authentication where it isn't already on.
5. Document everything — dates, who you spoke to, reference numbers. Identity theft recovery often takes weeks or months of back-and-forth with different institutions, and a clear paper trail speeds every step of it up.
6. Follow up in writing with any company where a fraudulent account was opened, disputing the debt formally rather than relying on a phone call alone.
Reducing how much there is to steal
Much of the advice elsewhere on this site connects directly here: fewer companies holding your full ID number and details (see the POPIA piece), stronger unique passwords, and two-factor authentication all reduce the raw material available for someone to build a stolen identity from in the first place.
The realistic timeline
Full recovery from a serious case of identity theft can take months, not days — the goal in the first 48 hours isn't to fix everything, it's to stop the bleeding: freeze what can be frozen, flag what can be flagged, and start the paper trail. Everything else follows from there.