What to Do If Your Identity Is Stolen: A Step-by-Step Plan

If your identity is stolen, act in this order: contact the companies where fraud happened and close or freeze those accounts, place a fraud alert or credit freeze with the three credit bureaus, report the theft to the FTC at IdentityTheft.gov, then change your passwords and turn on two-step verification. After that, work through each fraudulent account and record one by one, keeping a written log of every call and letter.

Identity theft is exhausting, but most of the recovery work is routine and in your control. This guide walks through the first day, the first week and the months after, including the part people often miss: the damage a stolen identity can do to your name online.

Signs your identity has been stolen

You might discover identity theft all at once, or through a slow trickle of odd events. Common warning signs include:

• Charges or withdrawals you don’t recognize on a bank or card statement.
• Bills, collection calls or letters about accounts you never opened.
• A credit report showing accounts, addresses or hard inquiries you don’t know about.
• Being denied credit, or offered worse terms, for no reason you can explain.
• A notice from the IRS that more than one tax return was filed in your name.
• Medical bills or insurance statements for care you never received.
• Password reset emails you didn’t request, or being locked out of your email or social accounts.
• Friends telling you “you” have been messaging them asking for money.

One sign on its own can be an error. Two or more, or anything involving new accounts in your name, is worth treating as identity theft until you know otherwise. Thieves sometimes combine a real Social Security number with invented details, known as synthetic identity theft, which can be harder to spot.

Step 1: Stop the damage at the source

Start with the companies where you can see fraud. Call the fraud department, not general customer service, using the number on the back of your card or on the company’s official website, not a number from a suspicious email or text.

1. Explain that you’re a victim of identity theft and ask them to close or freeze the affected accounts.
2. Dispute the fraudulent charges and ask what documentation they need from you.
3. Change any passwords, PINs or security questions tied to those accounts.
4. Ask for written confirmation that the account was closed and the fraudulent debt is not yours.

Write down who you spoke to, the date, and what they agreed to do. You’ll refer back to this log more than you expect.

Step 2: Place a fraud alert or freeze your credit

The three nationwide credit bureaus in the US are Equifax, Experian and TransUnion. You have two main tools, and many people use both.

Tool	What it does	How to set it up
Fraud alert	Tells lenders to take extra steps to verify your identity before opening new credit.	Contact one bureau; it is required to tell the other two.
Extended fraud alert	A longer-lasting alert for confirmed identity theft victims.	Usually requires an identity theft report, such as the FTC report below.
Credit freeze	Blocks most new creditors from seeing your report at all, which stops most new accounts being opened.	Contact each bureau separately. Freezing and unfreezing is free under federal law.

A freeze is usually the stronger protection. It doesn’t affect your credit score or your existing accounts, and you can lift it temporarily when you need to apply for credit yourself.

While you’re at it, get copies of your credit reports from all three bureaus through AnnualCreditReport.com, the official free source. Read every line and note any account, address or inquiry you don’t recognize.

Step 3: Report identity theft to the FTC

The federal government’s central place to report identity theft is IdentityTheft.gov, run by the Federal Trade Commission. When you file there, you get an FTC identity theft report and a personalized recovery plan with prefilled letters you can send to creditors and credit bureaus.

The FTC identity theft report matters because it’s proof that you’ve reported the theft. Businesses and credit bureaus use it when you ask them to block fraudulent information, remove fraudulent accounts or place an extended fraud alert. Save a copy and keep it with your log.

You may also want to file a report with your local police, particularly if you know who stole your information, if a creditor asks for a police report, or if someone has used your name when dealing with the police. Bring your FTC report, a photo ID and proof of address.

Step 4: Secure your email, phone and social accounts

Your email account is the master key to almost everything else, because password resets go there. If a thief controls it, they can take over your bank, your social media and your online identity.

• Change your email password first, from a device you trust, then your bank, phone carrier and social accounts.
• Use a different, long password for each account. A password manager makes this realistic.
• Turn on two-step verification everywhere it’s offered, preferably with an authenticator app or security key rather than text messages.
• Check your email settings for forwarding rules or recovery addresses you didn’t add.
• Ask your mobile carrier about a PIN or port-out protection to reduce the risk of someone moving your number to a new SIM.

If a thief has already taken over an account, our guides on a hacked Gmail account and a hacked Facebook account cover the recovery steps.

Step 5: Deal with specific types of identity theft

Different kinds of theft have their own clean-up routes. Work on the ones that apply to you.

Tax identity theft

If the IRS tells you a return was already filed with your Social Security number, respond to the notice using the instructions it gives. The IRS has an Identity Theft Affidavit (Form 14039) for victims, and it offers an Identity Protection PIN that makes it harder for someone else to file in your name.

Social Security number misuse

A stolen Social Security number can be used for credit, jobs, tax returns and benefits. Our guide on social security identity theft covers what to check and who to contact.

Medical identity theft

Ask your health insurer and providers for records of the claims and visits in your name. Dispute anything that isn’t yours, and ask for errors to be corrected in your medical records so they don’t affect your future care.

Criminal identity theft

If someone gave your name to police when they were arrested or cited, contact the law enforcement agency involved and the court. You may need to prove your identity with fingerprints or documents. This is a situation where talking to an identity theft lawyer is sensible, because a record in your name can follow you into background checks.

A worked example

This is an illustrative scenario, not a real client.

A teacher notices a hard inquiry on her credit report from a lender she’s never heard of, then gets a welcome email for a store card she didn’t open. She calls the store’s fraud department, which closes the account and asks for an FTC report. That evening she files at IdentityTheft.gov, downloads her report and recovery plan, and freezes her credit with all three bureaus.

Her full credit reports show a second account opened at a phone carrier. She sends that carrier the prefilled dispute letter from her recovery plan, along with her FTC report, and asks the credit bureaus to block the fraudulent information. She changes her email password, turns on app-based two-step verification and finds a forwarding rule she didn’t create, which she deletes.

Two months later both accounts are gone from her reports. She keeps her freeze in place and checks her reports again every few months.

The reputation side of identity theft

Most identity theft guides stop at credit. But a stolen identity can also leave marks where people look you up, and those can linger after the money side is fixed.

• Fake social profiles using your name and photos, sometimes used to scam your contacts. Report them to the platform as impersonation. Our guide to online impersonation covers each step.
• Posts or messages sent from your hacked accounts, such as scam links or offensive content. Delete them once you regain access and tell your contacts what happened.
• Collection or court records for debts that aren’t yours. Get them corrected at the source first; search results usually follow once the source changes.
• Your personal details on people-search sites, which thieves use to answer security questions. Removing yourself reduces the risk of it happening again.

Search your name in a private browser window and note anything that came from the theft. If you find fake accounts or damaging pages you can’t remove yourself, our personal reputation management service helps clean up what shows up when people search for you.

Common mistakes to avoid

• Only fixing the account you found first. Pull all three credit reports; thieves rarely stop at one account.
• Keeping no records. Disputes can drag on, and a dated log of calls and letters makes them far easier.
• Paying a debt that isn’t yours to make collectors stop. Dispute it in writing instead.
• Using contact details from a suspicious message. Always look up the number or website yourself.
• Lifting your freeze too soon. A freeze costs nothing to keep, and you can lift it temporarily when you need it.

Preventing it from happening again

Once the immediate crisis is over, a few habits make a repeat much less likely: keep your credit frozen, use unique passwords and two-step verification, shred documents with personal details, check your credit reports regularly, and remove your address and phone number from data broker sites. Our guide on ways to prevent identity theft goes into each one.

Frequently asked questions

How do I report identity theft?

In the US, report identity theft to the FTC at IdentityTheft.gov, which gives you an official report and a recovery plan. Also contact the companies where fraud happened, place a fraud alert or freeze with the credit bureaus, and file a police report if a creditor requires one or you know who did it.

What is an FTC identity theft report used for?

It’s proof that you’ve reported the theft. You can use it to ask credit bureaus to block fraudulent information, to dispute accounts with businesses, and to place an extended fraud alert on your credit file.

Should I freeze my credit or place a fraud alert?

Many victims do both. A fraud alert asks lenders to verify your identity, while a freeze blocks most new creditors from accessing your report at all. A freeze is the stronger protection, is free, and can be lifted when you need to apply for credit.

How long does it take to recover from identity theft?

It depends on how many accounts are affected and how quickly companies respond. Simple cases can be resolved in weeks; cases involving tax, medical or criminal records can take much longer. Keeping organized records speeds things up.

Do I need a lawyer for identity theft?

Most people can handle recovery themselves using the FTC’s recovery plan. Talk to a lawyer if a creditor or collector won’t correct fraudulent debts, if you’re sued over an account that isn’t yours, or if criminal records have been created in your name.