A Scammer Has My Name, Address or Phone Number: What Can They Do?

Gave a scammer your name and address, phone number or email, or found out one has them? Some of it may already be out there: people-search sites sell reports that can list your current and past addresses and your birth date (FTC). The real risks are more convincing scams aimed at you, attempts to take over your phone number or accounts, and, if they also have your Social Security number, identity theft. Here’s what each piece can be used for, and the free steps that protect you.

What a scammer can do with each piece of information

What they have	What they could try	What to do
Name and address	Unordered packages with a scam QR code (FBI); combining it with other details to impersonate you (USPS)	Watch your mail; opt out of people-search sites
Phone number	Scam calls with faked caller ID (FCC); asking for a code sent to your phone (FTC); moving your number to their phone (FCC)	Add a PIN and lock to your phone account; never share codes
Email address	Phishing emails that look like a company you know (FTC)	Unique password and multifactor authentication on your email
Date of birth	Passing identity checks, combined with other details (FCC)	Add a phone-account PIN; keep it off social media
Driver’s license or passport	Impersonating you (IdentityTheft.gov)	Report it to your DMV or the State Department; check and freeze your credit
Photos or a selfie	Doctored images for harassment or sextortion (FBI); fake identities (FBI)	Tighten privacy settings; report abuse
Social Security number	Opening accounts, taking out loans, filing taxes, getting a job (IdentityTheft.gov)	Freeze your credit; follow the Social Security number steps
Password or verification code	Signing in to your accounts (IdentityTheft.gov, FTC)	Change that password everywhere you used it; contact the company

What can a scammer do with my phone number?

Your phone number can be a key to your accounts. Banks, businesses and payment services often text codes to confirm it’s you (FCC). A scammer might try:

• Scam calls and texts. Caller ID can be faked to show a local number, or the number of a company or government agency you trust (FCC). If people say you called them and you didn’t, see someone is using my phone number.
• Code tricks. Someone answering your online listing asks you to “verify you’re real” by reading back a code sent to your phone. With it, they’ll try to create a number linked to yours and use it to scam other people (FTC). If it’s the code for one of your accounts, they can log in and move your money (FTC).
• Taking over your number. With details like your address, birth date and the last four digits of your Social Security number, a scammer may con your carrier into moving your number to their device. Then they get your texts and calls, and race to reset the passwords on your bank and social media accounts (FCC).
• Your voicemail. Some voicemail services let you in when you call from your own number. Without a voicemail password, someone who fakes your number could get in (FCC).

What to do:

1. Add a PIN or password to your phone account. The FCC suggests contacting your carrier to ask about one (FCC).
2. Ask about an account lock. FCC rules adopted in 2023 call for carriers to notify customers of SIM change and number transfer requests, and to offer a free lock that blocks them (FCC, 2023). But in July 2024, the FCC postponed compliance until a federal paperwork review is finished and it announces a date (FCC order). Ask your carrier what it offers now.
3. Turn on email and text alerts for your bank and other important accounts (FCC).
4. Never share a verification code. The FTC says anyone who asks you for one is a scammer (FTC).
5. Know the warning sign. Losing service, or a phone that only allows 911 calls, is typically the first sign your number was moved. Contact your carrier and your bank right away (FCC).

What can a scammer do with my email address?

Mostly, send you phishing. These emails pretend to be from your bank or another company you know, and tell a story to get you to click a link (FTC). Login codes can also arrive by email (FTC), so your inbox is worth locking down:

• Use a long, unique password. If you create your own, the FTC says to aim for at least 15 characters, and never to reuse the same username and password. A password manager can create and store them (FTC, FTC).
• Turn on two-factor authentication (also called multi-factor authentication, or MFA), starting with your most sensitive accounts: bank, credit cards, email, social media and payment apps (FTC).
• Check your recovery settings. Make sure the recovery email addresses and phone numbers on the account are ones you entered (FTC).
• Don’t click links in unexpected messages, even if they look real. Contact the company through a website you know is trustworthy (IdentityTheft.gov).

Already clicked? See what to do if you clicked a phishing link. Someone got into your inbox? See what to do if your email was hacked.

What can a scammer do with my name and address?

Your address may already appear on people-search sites (FTC). A scammer can use it to make contact feel personal, or to try:

• Packages you didn’t order. The FBI has warned about unsolicited packages with a QR code that leads to requests for personal and financial information, or to malicious software (FBI). Don’t scan it.
• Changing your address. USPS uses confirmation letters to stop false changes of address, and says thieves often prefer to change an address directly with a bank or other company (USPS). If you stop getting a bill, someone may have changed your billing address (FTC).

If you lost money, expect more contact: scammers buy lists of people who’ve paid scammers, with names, addresses and phone numbers (FTC).

What to do:

• Pick up your mail promptly. USPS also suggests Informed Delivery, its free service for previewing incoming mail (USPS).
• If your mail was stolen or identity theft involved the mail, report it to the U.S. Postal Inspection Service.
• Opt out of people-search sites. Search for yourself, follow each site’s opt-out steps and check back, because information can reappear when public records change (FTC). Paid services can do this for you; the FTC suggests first asking how many sites they cover and how often they re-scan.

I gave a scammer my date of birth. What now?

Your birth date helps prove who you are. USPS lists it, along with your name, address and Social Security number, among the details thieves use to impersonate someone (USPS). The FCC names it among the facts scammers use to fool phone companies (FCC).

You can’t change it, so protect what it can unlock. Add a PIN to your phone account. Keep your birth date and common security-question answers, like your pet’s name, off social media (FCC).

What can a scammer do with my driver’s license?

A thief could try to impersonate you with your driver’s license information, according to IdentityTheft.gov. Its steps:

• Report it to your DMV. Find your state’s motor vehicle agency on USA.gov. The state might flag your license number or suggest you apply for a duplicate (IdentityTheft.gov).
• Check, freeze and monitor your credit (see below).
• Passport instead? Report it to the State Department at travel.state.gov or 1-877-487-2778 (IdentityTheft.gov).

A photo of your ID matters too. Financial institutions have reported criminals using AI to alter ID images and pair them with stolen personal information. Criminals have also opened accounts with identities suspected to be AI-made (FinCEN, 2024).

What can a scammer do with my picture?

• Fake explicit images. Criminals alter ordinary photos, often taken from social media, into explicit content to harass or extort people (FBI).
• Fake identities. The FBI says limiting photos and recordings of yourself online makes it harder for criminals to use AI to create fake identities (FBI).
• Fake emergencies. Criminals can use a short clip of a loved one’s voice to fake a crisis call asking for money (FBI). See grandparent scams and AI voice clones.

What to do: Make social media accounts private, limit followers to people you know, and agree on a secret word with family (FBI). If someone threatens to share images, don’t send money: the FBI says complying doesn’t guarantee they won’t share them. Report it at IC3.gov (FBI).

Under the TAKE IT DOWN Act, covered platforms must remove intimate images shared without consent, including AI deepfakes, within 48 hours of your request. If one doesn’t, tell the FTC at TakeItDown.ftc.gov (FTC). For images taken when you were under 18, the free Take It Down service from the National Center for Missing & Exploited Children can help.

If they also have your Social Security number, a password or account numbers

• Social Security number: See I gave a scammer my Social Security number, and someone filed taxes in my name if that happens.
• A password: Change it, and change it anywhere else you used it. Turn on two-factor authentication. If you can’t log in, contact the company (IdentityTheft.gov).
• Card or bank numbers: See gave a scammer my credit card number or my bank account number.

Should I freeze my credit?

IdentityTheft.gov’s first step for lost or exposed information is to check, freeze and monitor your credit (IdentityTheft.gov). The FTC explains the options:

• Credit freeze: Nobody can open a new credit account in your name until you lift it. It’s free and doesn’t affect your score, but you must contact Equifax, Experian and TransUnion separately. See how to freeze your credit and track it with the credit freeze tracker.
• Fraud alert: Tells businesses to check with you before opening new credit in your name. It’s free, lasts one year, and you only contact one bureau.

Check your credit reports for free every week at AnnualCreditReport.com (IdentityTheft.gov). Accounts, charges or withdrawals you don’t recognize can be signs of identity theft (FTC). If you find some, report it at IdentityTheft.gov to get a recovery plan (FTC). If someone opened a card, see someone opened a credit card in my name.

How to report it

• The scam: ReportFraud.ftc.gov.
• Someone used your information: IdentityTheft.gov.
• Your number was moved without permission: your carrier, your bank and the police, then a complaint to the FCC (FCC).
• Mail theft or mail-related identity theft: the U.S. Postal Inspection Service.
• A scam that started online, or sextortion: IC3.gov.
• Scam texts: forward them to 7726 (SPAM) (FTC).

The report-a-scam tool lists more official channels, and the scam recovery checklist helps you track each step.

Watch for the follow-up scam

Scammers who know a few things about you can sound very convincing (FTC). Hang up if a caller:

• asks for a verification code;
• says your accounts are at risk and tells you to move money to “protect it,” which the FTC calls a scam (FTC);
• offers to recover your money for a fee. Government agencies and legitimate organizations never ask for money to help you get a refund (FTC);
• claims to be from the FBI’s IC3. IC3 never contacts people directly by phone, email or social media, and never asks for payment to recover lost funds (IC3).

To check, contact the company through a website you trust or a number you look up yourself, not caller ID or the message (IdentityTheft.gov). More tips: is this call really from my bank?

What varies

• Your carrier. When the FCC adopted its rules, it noted that some carriers already offered account locks (FCC, 2023), so protections differ.
• Your state. DMV steps differ. California residents can use the state’s free Delete Request and Opt-out Platform (DROP). It tells registered data brokers to delete your information and stop selling it. Brokers had to start processing requests on August 1, 2026 (CalPrivacy).
• What else they have. The steps depend on what was exposed; IdentityTheft.gov lists them by type of information.