What to Do If Your Identity Is Stolen: A Step-by-Step Guide

You check your credit card statement and see a $3,200 charge from a store in a city you’ve never visited. Or a debt collector calls about a credit card you never opened. Or you try to file your tax return and the IRS says someone already filed one using your Social Security number.

Your stomach drops. Your identity has been stolen.

In 2024, the FTC received 1.4 million reports of identity theft. The Identity Theft Resource Center reported a record 3,205 data breaches in 2023, exposing over 353 million victims. With that much personal data circulating, the question is less “if” and more “when.”

The good news: identity theft is recoverable. The bad news: it takes effort, and the first 24 to 48 hours matter the most. This guide walks you through exactly what to do, in order, starting from the moment you discover the problem.

Step 1: Freeze Your Credit (Do This First)

A credit freeze prevents anyone (including you) from opening new credit accounts in your name. This is the single most effective action you can take to stop an identity thief from doing further damage.

How to freeze your credit:

You must contact each of the three credit bureaus individually. The freeze is free by federal law.

Equifax:

• Online: equifax.com/personal/credit-report-services/credit-freeze/
• Phone: 1-800-685-1111

Experian:

• Online: experian.com/freeze/center.html
• Phone: 1-888-397-3742

TransUnion:

• Online: transunion.com/credit-freeze
• Phone: 1-888-909-8872

Each bureau will give you a PIN or password. Save these somewhere secure. You will need them to temporarily lift (“thaw”) the freeze when you legitimately apply for credit.

Important details:

• Freezing your credit does not affect your credit score.
• Freezing does not prevent you from using your existing credit cards or accounts.
• It does not stop identity theft on existing accounts (that’s why the other steps matter).
• Consider also freezing your credit with lesser-known bureaus: Innovis (1-800-540-2505) and the National Consumer Telecom & Utilities Exchange (NCTUE, 1-866-349-5185). Some creditors check these as well.

Freeze vs. Fraud Alert: What’s the Difference?

A fraud alert tells creditors to take extra steps to verify your identity before opening new accounts. It’s easier to set up (you only need to contact one bureau, and it notifies the other two), but it’s weaker. Creditors are supposed to verify your identity, but they’re not always required to.

A credit freeze is a hard block. No new accounts can be opened, period. A freeze is stronger. Do both if you want to be thorough, but the freeze is the priority.

To place a fraud alert, contact any one of the three bureaus:

• Equifax: 1-800-525-6285
• Experian: 1-888-397-3742
• TransUnion: 1-800-680-7289

An initial fraud alert lasts one year. An extended fraud alert (available after filing an FTC identity theft report) lasts seven years.

Step 2: File an Identity Theft Report with the FTC

Go to identitytheft.gov. This is the FTC’s official identity theft recovery website, and it is genuinely useful.

When you file your report, the site will:

1. Walk you through the specific type of identity theft you experienced.
2. Create a personalized recovery plan with specific steps for your situation.
3. Generate an official FTC Identity Theft Report, which you’ll need for disputing fraudulent accounts, filing police reports, and communicating with creditors.
4. Provide pre-filled letters you can send to creditors and bureaus.

Save and print your FTC report. You’ll reference it repeatedly in the following steps.

Step 3: Contact Your Banks and Credit Card Companies

Call the fraud department of every financial institution where you have an account. Use the number on the back of your card or on your statement, not a number from a suspicious email or letter.

For accounts with fraudulent charges:

• Report the specific unauthorized transactions.
• Ask them to close or freeze the compromised account.
• Request a new account number and card.
• Ask for written confirmation that the fraudulent charges have been removed and that you are not liable.

For accounts without fraudulent activity (yet):

• Alert them that your identity has been compromised.
• Ask about enhanced security options (two-factor authentication, verbal password, transaction alerts).
• Monitor these accounts closely for the next 12 months.

Your liability: Under federal law (Regulation E for debit cards, the Fair Credit Billing Act for credit cards), your liability for unauthorized transactions is limited:

• Credit cards: Maximum $50 liability, and most issuers offer zero-liability policies.
• Debit cards: $0 if reported before any unauthorized charges, $50 if reported within 2 business days, $500 if reported within 60 days, and potentially unlimited after 60 days. This is why reporting quickly matters for debit card fraud.

Step 4: File a Police Report

File a report with your local police department. Some jurisdictions allow online reporting for identity theft.

Bring to the police station (or include in your online report):

• Your FTC Identity Theft Report
• A government-issued ID
• Proof of your address
• Evidence of the theft (fraudulent account statements, collection letters, etc.)

The police report serves as additional documentation for your disputes and may be required by some creditors. Some police departments may tell you identity theft is not something they investigate locally. File the report anyway. You need the report number for documentation.

Step 5: Dispute Fraudulent Accounts and Charges

This is the most time-consuming step but critical for cleaning up your credit and financial records.

On Your Credit Reports

1. Request your free credit reports from all three bureaus at AnnualCreditReport.com.
2. Review each report carefully. Flag every account or inquiry you don’t recognize.
3. File disputes with each bureau that shows fraudulent information.

How to dispute:

• Online: Each bureau has an online dispute portal.
• By mail: Send a dispute letter via certified mail (return receipt requested). Include:
  • Your FTC Identity Theft Report
  • A copy of your police report
  • A copy of your government-issued ID
  • Specific identification of each fraudulent item
  • A request to block the fraudulent information under the Fair Credit Reporting Act

The bureaus have 30 days to investigate your dispute. Under the FCRA, information resulting from identity theft must be blocked from your report within 4 business days of receiving proper documentation.

Directly With Creditors

Contact the fraud department of each company where a fraudulent account was opened. Send a letter (certified mail, return receipt) that includes:

• Your FTC Identity Theft Report
• Proof of your identity
• A clear statement that you did not open or authorize the account
• A request to close the account immediately and confirm in writing that you are not liable

Under the FCRA, creditors who receive your identity theft report are required to stop reporting the fraudulent account and stop collecting on the debt.

Step 6: Check for Other Types of Identity Theft

Financial account fraud is the most common, but identity theft can extend further.

Tax Identity Theft

If someone files a tax return using your Social Security number, the IRS will reject your legitimate return. If this happens:

• File IRS Form 14039 (Identity Theft Affidavit).
• Respond to any IRS notices immediately.
• Consider requesting an Identity Protection PIN from the IRS. This is a six-digit number assigned to you that must be included on future tax returns. Request one at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.

Medical Identity Theft

If someone uses your identity to obtain medical care, it can corrupt your medical records (dangerous if wrong blood type or allergies are added) and generate bills in your name.

• Request your medical records from providers and insurers.
• Review your Explanation of Benefits (EOB) statements for services you didn’t receive.
• Contact your health insurer’s fraud department.

Child Identity Theft

Children’s Social Security numbers are especially valuable to thieves because the fraud can go undetected for years. If you suspect your child’s identity has been stolen:

• Check for a credit report in your child’s name (there shouldn’t be one).
• Freeze your child’s credit with all three bureaus.
• File an FTC report and police report.

Synthetic Identity Theft

This is when a thief combines your real information (like your Social Security number) with fake information (a different name and address) to create a new identity. It may not show up directly on your credit report under your name but can still cause problems. Regular credit monitoring helps catch this.

Step 7: Secure Your Accounts Going Forward

Once you’ve addressed the immediate damage, take steps to prevent it from happening again.

Change Your Passwords

• Change passwords on all financial accounts, email, and any account that uses the same password as a compromised account.
• Use unique passwords for every account. A password manager (Bitwarden, 1Password, or similar) makes this manageable.
• Enable two-factor authentication (2FA) on every account that offers it. Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible.

Set Up Account Alerts

• Enable transaction alerts on all bank accounts and credit cards. Get notified immediately for any charge over $1.
• Set up login alerts for your email and financial accounts.
• Enable credit monitoring. You can get free monitoring through AnnualCreditReport.com (weekly free reports), Credit Karma, or your credit card issuer.

Protect Your Social Security Number

• Do not carry your Social Security card in your wallet.
• Never provide your SSN unless absolutely required. Legitimate reasons: employment, tax forms, credit applications, government benefits. Not legitimate: a phone caller “verifying” your identity.
• If your SSN was compromised, you can request a new one from the Social Security Administration, but this is rarely necessary and can create complications. A credit freeze is usually sufficient protection.

Monitor Your Credit

• Review your credit reports at least every four months (rotate between the three bureaus).
• Watch for new accounts, inquiries, or address changes you didn’t initiate.
• Consider a credit monitoring service if your information was exposed in a major data breach. Many breaches include free monitoring (Experian, IdentityForce, etc.) for affected individuals.

Secure Your Mail

• If your address was changed fraudulently, contact the U.S. Postal Service to correct it.
• Consider a locked mailbox if you receive sensitive documents by mail.
• Opt for electronic delivery of bank statements, tax documents, and medical records.

Timeline: What to Expect

Timeframe	What Happens
Day 1	Credit freeze, FTC report, contact banks, file police report
Days 2-7	Review all credit reports, begin disputes, change passwords
Days 7-30	Follow up on disputes, monitor accounts, set up alerts
Months 1-3	Credit bureaus investigate disputes, fraudulent accounts begin getting removed
Months 3-12	Continue monitoring, respond to any new incidents, maintain credit freeze
Ongoing	Regular credit monitoring becomes a permanent habit

The full resolution process typically takes 3 to 6 months for straightforward cases and 6 to 12 months for complex ones involving multiple types of fraud.

Resources

• FTC Identity Theft Recovery: identitytheft.gov
• Annual Credit Reports: AnnualCreditReport.com
• IRS Identity Theft: irs.gov/identity-theft-fraud-scams
• Identity Theft Resource Center: idtheftcenter.org (free assistance from trained advisors)
• FBI Internet Crime Complaint Center: ic3.gov
• Consumer Financial Protection Bureau: consumerfinance.gov/complaint (for issues with financial companies)

The Bottom Line

Identity theft is stressful, time-consuming, and frustrating. But it is manageable if you follow the steps in order: freeze your credit immediately, file your reports, contact your financial institutions, dispute everything fraudulent, and set up monitoring for the future.

The most important thing is to act quickly. The faster you freeze your credit and report the theft, the less damage the thief can do. Don’t let shame or embarrassment slow you down. Millions of people experience identity theft every year, and the systems for resolving it exist because it is that common.

For help recognizing scams before they lead to identity theft, read our guide on how to spot a financial scam.

This guide is for educational purposes only. Identity theft situations vary. If you need personalized assistance, the Identity Theft Resource Center (idtheftcenter.org) offers free help from trained advisors.