Think someone has stolen your identity? Don’t wait until you know exactly what happened. Unauthorized charges, unfamiliar accounts, or unexpected collection notices could be the first signs of a much bigger problem.
Your first priority is to stop further fraud. That means contacting affected financial institutions, securing your accounts, and freezing your credit reports before dealing with the damage.
Here are 10 steps to take if your identity is stolen, from reporting the theft to disputing fraudulent accounts and correcting your credit reports. Each step follows guidance from the Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB).
Key Takeaways
- Act immediately by contacting affected banks and credit card companies, securing compromised accounts, and stopping unauthorized transactions.
- Protect your credit by freezing your credit reports with all three credit bureaus, reviewing your credit reports for fraudulent activity, and filing an FTC Identity Theft Report.
- Dispute fraudulent charges and accounts, keep records of your recovery efforts, and monitor your financial accounts and credit reports for additional fraud.
What to Do Immediately If Your Identity Is Stolen
You don’t need to complete every recovery step in one day. Focus on stopping additional fraud first, then work through the disputes and documentation.
| When | What to Do |
|---|---|
| Immediately | Contact affected financial institutions and secure compromised accounts. |
| As soon as possible | Freeze your credit reports, check for fraudulent accounts, and report identity theft to the FTC. |
| Over the next few days | Dispute unauthorized charges, close fraudulent accounts, and request credit report corrections. |
| Until the issue is resolved | Follow up on disputes, save documentation, and monitor for additional fraud. |
Don’t wait until you’ve gathered every document before contacting your bank or credit card company. Some federal protections depend on how quickly you report unauthorized transactions.
1. Contact Your Banks and Credit Card Companies
If someone has accessed your financial accounts or made unauthorized purchases, contact the affected bank or credit card company immediately. Ask for the fraud department and explain what happened.
Use the official phone number on your card, account statement, or financial institution’s website. Don’t rely on phone numbers from suspicious emails or text messages.
When you speak with the fraud department, take these steps:
- Report the fraud: Identify every transaction you don’t recognize and explain why you believe it was unauthorized.
- Secure the account: Ask whether the company should freeze the account, close it, or issue a replacement card.
- Stop unauthorized access: Change your account PIN or other security credentials if someone may have obtained them.
- Request a case number: Ask how to submit a formal dispute and when you should expect a response.
- Get confirmation: Request written documentation of the fraud claim and any changes to your account.
You can use this short script when you call:
I believe someone has stolen my identity and used my account without my permission. I need to report the unauthorized activity, secure my account, and start a fraud investigation. Can you give me a case number and explain what happens next?
Check your other bank and credit card accounts as well. Even if you’ve only discovered fraud on one account, the thief may have obtained additional financial information.
2. Secure Your Email and Online Accounts
Your email account should be one of your first priorities because thieves can use it to reset passwords for other accounts. If someone controls your email, they may be able to access your bank accounts, shopping accounts, and other personal information.
Start with your primary email account and any financial accounts that may have been compromised.
Take the following security measures:
- Change passwords: Create new, unique passwords for compromised accounts and any other accounts that share those passwords.
- Enable multifactor authentication: Use an authenticator app, passkey, or security key when supported. These are generally safer than text message codes.
- Review account activity: Look for unfamiliar devices, active sessions, password resets, and changes to your contact information.
- Check recovery settings: Make sure your recovery email address and phone number haven’t been changed.
- Remove suspicious access: Sign out unfamiliar devices and revoke access for apps you don’t recognize.
A password manager can help you create and store unique passwords. If you already use LastPass or another password manager, make sure its account is secure and protected with multifactor authentication.
You should also check whether someone added email forwarding rules or changed your account recovery options. A thief could continue receiving sensitive messages even after you’ve changed your password.
3. Freeze Your Credit Reports With All Three Credit Bureaus
A credit freeze is one of the strongest ways to help prevent someone from opening new credit accounts in your name. It restricts access to your credit report, which makes it harder for lenders to approve fraudulent credit applications.
You can freeze your credit reports for free with all three nationwide credit bureaus:
- Equifax: Request a credit freeze through Equifax’s official website or customer service.
- Experian: Request a separate credit freeze through Experian.
- TransUnion: Request another credit freeze through TransUnion.
You must contact each credit bureau separately. A credit freeze with one credit bureau doesn’t automatically freeze your credit reports with the other two.
A credit freeze stays in place until you lift or remove it. You can temporarily lift a credit freeze when you want to apply for a credit card, mortgage, auto loan, or other financing.
Credit freezes don’t affect your credit score, and they don’t prevent you from using existing credit accounts. However, they won’t stop someone who already has access to one of your accounts.
For instructions, see our guide on how to freeze your credit reports for free.
4. Place a Fraud Alert on Your Credit Report
A fraud alert tells lenders that they should take extra steps to verify your identity before approving new credit. Unlike a credit freeze, a fraud alert doesn’t generally block access to your credit report.
You only need to contact one of the three nationwide credit bureaus to request a fraud alert. That credit bureau must notify the other two.
There are two main types of fraud alerts:
- Initial fraud alert: Lasts one year, costs nothing, and can be renewed. You don’t need to prove that identity theft occurred to request one.
- Extended fraud alert: Lasts seven years and is intended for identity theft victims who provide the required identity theft documentation.
You can also have a credit freeze and fraud alert at the same time.
Here’s how the protections compare:
| Protection | How Long It Lasts | Who You Contact |
|---|---|---|
| Initial fraud alert | 1 year | One credit bureau |
| Extended fraud alert | 7 years | One credit bureau |
| Credit freeze | Until you lift or remove it | All three credit bureaus |
All three options are free. An extended fraud alert also requires creditors to meet stronger identity verification requirements before they extend new credit.
For more details, read our guide on how fraud alerts work or review the FTC’s explanation of extended fraud alerts and credit freezes.
5. Check Your Credit Reports for Fraudulent Accounts
Identity thieves sometimes open credit cards, personal loans, or other accounts without the victim’s knowledge. These accounts may appear on your credit reports before you receive any bills or collection notices.
Get your credit reports from Equifax, Experian, and TransUnion through AnnualCreditReport.com. You can currently review your credit reports from each credit bureau online every week for free.
Examine each credit report for the following problems:
- Unknown accounts: Credit cards, loans, or other accounts you never opened.
- Unfamiliar inquiries: Credit applications you didn’t authorize.
- Incorrect personal information: Addresses, names, or other details that don’t belong to you.
- Fraudulent debts: Collection accounts or balances that resulted from identity theft.
- Unexpected account changes: Changes to existing accounts that you can’t explain.
Don’t assume that an account is legitimate because it only appears on one credit report. Creditors don’t necessarily provide information to all three credit bureaus.
Make a list of every suspicious item, along with the creditor’s name, account information, and the credit bureau that displays it. You’ll use these details when you report identity theft and request corrections.
Also remember that identity theft doesn’t always appear on a credit report. Fraud involving bank accounts, taxes, medical records, or government benefits may require separate checks.
6. Report Identity Theft to the FTC
The Federal Trade Commission provides a free identity theft recovery service through IdentityTheft.gov.
Visit IdentityTheft.gov to report what happened and create an FTC Identity Theft Report. You can also contact the FTC at 1-877-438-4338.
The website asks for details about the identity theft and uses that information to create a recovery plan.
Your FTC Identity Theft Report is important because it helps establish that someone misused your identity. Financial institutions and credit bureaus may require it when you request certain corrections or protections.
Save a copy of your FTC Identity Theft Report and any supporting documents. If you don’t create an account on IdentityTheft.gov, make sure you download or print the documents before you leave the website.
Do You Need to File a Police Report for Identity Theft?
You don’t need a police report for every identity theft case. An FTC Identity Theft Report is generally sufficient for many standard recovery steps.
However, filing a police report may be appropriate if a financial institution requests one, you know who stole your identity, someone used your identity during a criminal investigation, or you need additional evidence for a dispute.
Some requests for fraudulent account records may also require a police report.
If you file a police report, bring your FTC Identity Theft Report, government-issued identification, proof of your address, and any evidence of the identity theft. Ask for a copy of the police report for your records.
7. Dispute Unauthorized Charges and Close Fraudulent Accounts
After you secure your accounts and document the identity theft, work with the affected companies to reverse unauthorized transactions and close accounts that someone opened in your name.
Contact the fraud department of each company involved. Explain which charges or accounts are fraudulent and ask what documentation the company needs to resolve the issue.
For accounts you never opened, request written confirmation that the account has been closed, that you’re not responsible for the debt, and that the company has corrected any information it supplied to the credit bureaus.
Credit Card vs. Debit Card Fraud Protections
Federal law provides different protections for unauthorized credit card charges and debit card transactions. The timing of your notification can make a significant difference.
| Issue | Credit Cards | Debit Cards |
|---|---|---|
| Liability | Generally capped at $50 for unauthorized use | Depends on when you report the fraud and how it occurred |
| Important deadline | Written billing error notice generally must reach the issuer within 60 days after the statement was sent | Reporting within two business days matters for lost or stolen cards; a 60-day statement deadline also applies |
| Potential risk | Fraudulent charges and disputes | Money may be withdrawn directly from your bank account |
Under the Fair Credit Billing Act, consumers generally can’t be held responsible for more than $50 in unauthorized credit card charges. Many credit card issuers provide zero-liability protection.
For billing errors, you generally must send a written dispute to the credit card issuer’s billing inquiries address within 60 days after the first statement with the error was sent. Contact the issuer immediately even if you plan to submit a written dispute.
Debit card protections are different. If you lose your debit card and notify your bank within two business days after discovering the loss, your liability is generally limited to $50. If you wait longer, it can rise to $500.
If an unauthorized electronic withdrawal appears on your bank statement, you generally must notify your bank within 60 days after the statement was sent. Additional losses may become your responsibility if you miss that deadline.
You can review the FTC’s explanation of the Fair Credit Billing Act and credit card disputes.
Request Records From Companies Involved in the Identity Theft
If someone opened an account in your name, you may have the right to obtain records that show how the fraudulent account was created.
Section 609(e) of the Fair Credit Reporting Act gives qualifying identity theft victims the right to request certain application and transaction records from businesses involved in the fraud.
For example, you may be able to obtain a fraudulent credit application, transaction history, or other account documents.
The business generally has 30 days to provide qualifying records after it receives a proper written request and the required documentation. Depending on the circumstances, it may ask for proof of your identity, a police report, and an identity theft affidavit.
These records can help you establish that the account isn’t yours and support further disputes.
8. Remove Fraudulent Information From Your Credit Reports
Closing a fraudulent account doesn’t automatically guarantee that the account will disappear from your credit reports. You should verify that the credit bureaus have corrected the information.
There are two important processes to know about: credit report disputes and identity theft blocks.
A credit report dispute challenges inaccurate information. An identity theft block is a specific protection that can prevent qualifying fraudulent information from appearing on your credit report.
To request an identity theft block, contact each credit bureau that displays the fraudulent information and submit the required documentation.
Your request generally needs these items:
- Proof of identity: Documentation that confirms you’re the person affected.
- FTC Identity Theft Report: A copy of the identity theft documentation.
- Fraudulent account details: Identification of the specific credit report information that resulted from identity theft.
- Written statement: Confirmation that the information doesn’t relate to a transaction you made.
Under the Fair Credit Reporting Act, a credit bureau generally must block qualifying identity theft information within four business days after receiving a complete request.
There are limited circumstances in which a credit bureau may decline or reverse an identity theft block. For example, a credit bureau may do so if it determines that the request was based on a material misrepresentation.
If a credit bureau refuses to correct fraudulent information, ask for an explanation and review the reason for its decision. You can also submit a complaint to the CFPB.
After a correction, request an updated credit report to confirm that the fraudulent information no longer appears.
9. Protect Your Social Security Number and Other Personal Information
Identity theft isn’t limited to credit cards and bank accounts. Someone can use stolen personal information to file tax returns, obtain medical care, apply for government benefits, or impersonate you.
The additional steps you need depend on which information was stolen and how it was used.
If Your Social Security Number Was Stolen
A stolen Social Security number can expose you to several forms of identity theft. Someone may attempt to open accounts, apply for benefits, or file a fraudulent tax return in your name.
Start with a credit freeze and check for suspicious credit activity. You should also review any notices from the Social Security Administration or IRS that you don’t recognize.
For more information about the risks, see what someone can do with your Social Security number.
If Someone Used Your Identity to File Taxes
Tax identity theft can happen when someone files a fraudulent tax return with your personal information or attempts to claim a refund in your name.
One way to protect yourself is to request an IRS Identity Protection PIN. This six-digit number helps the IRS verify your identity when a federal tax return is filed.
You can get an Identity Protection PIN through the IRS for free. The IRS issues a new number each year.
If someone has already filed a fraudulent tax return in your name, follow the IRS’s identity theft instructions. You may need to complete additional identity verification or submit Form 14039.
If Your Driver’s License or Passport Was Stolen
Contact your state’s Department of Motor Vehicles if someone stole or misused your driver’s license. Ask whether you should replace the license or take additional steps to protect your record.
For a stolen or missing U.S. passport, contact the U.S. Department of State and follow its replacement procedures.
If someone used your identity during an arrest or criminal investigation, contact the appropriate law enforcement agency immediately. You may need additional documentation to correct criminal records.
If Someone Used Your Identity for Medical Care or Benefits
Medical identity theft occurs when someone uses your personal information to obtain health care, prescriptions, or other medical services.
Contact the affected health care provider or insurer and request copies of the relevant medical and billing records. Dispute services you never received and ask the provider to correct inaccurate information.
You should also contact the appropriate government agency if someone used your identity to claim unemployment, Social Security, or other benefits.
Utility accounts can also be opened fraudulently. If you receive bills for electricity, gas, water, or phone services you never requested, contact the provider’s fraud department.
10. Monitor Your Accounts and Track Your Identity Theft Recovery
Even after the initial problems are resolved, continue to watch for new signs of identity theft. Someone who has your personal information may attempt to use it again.
Set up transaction alerts through your bank and credit card companies. Review your financial statements regularly and check your credit reports for unfamiliar activity.
You can check your credit reports weekly for free, although you may not need to review them that often once the immediate risk has passed.
Keep a record of your recovery efforts. Your file should contain the following information:
- FTC documents: Your FTC Identity Theft Report and recovery plan.
- Account records: The names of affected companies and the account numbers involved.
- Dispute details: Case numbers, dates, correspondence, and responses.
- Credit report corrections: Copies of your credit reports before and after fraudulent information was removed.
- Confirmation letters: Written proof that companies closed fraudulent accounts or reversed unauthorized transactions.
Keep these documents in a secure location. You may need them if fraudulent accounts reappear or a debt collector contacts you about an account that isn’t yours.
Don’t assume the problem is resolved simply because a company says it has closed a case. Check that any fraudulent charges were reversed, affected accounts were secured, and inaccurate credit report information was corrected.
Common Signs Your Identity Has Been Stolen
Sometimes identity theft is obvious because money disappears from an account. Other times, the warning signs are less direct.
Watch for these common indicators of identity theft:
- Unrecognized transactions: Charges or withdrawals appear on accounts you use.
- Unexpected credit activity: You receive notices about credit applications or accounts you never opened.
- Missing statements: Bills or account statements stop arriving without an explanation.
- Unfamiliar debts: Collection agencies contact you about money you don’t owe.
- Account security alerts: You receive password reset notices or account change notifications you didn’t request.
- Tax problems: The IRS rejects your tax return because someone already filed with your Social Security number.
An unexpected change in your credit score can also be a warning sign, although a credit score change alone doesn’t prove identity theft.
If you’re unsure whether your information has been compromised, review our guide to the warning signs of identity theft.
Don’t ignore suspicious activity while you try to determine exactly what happened. Contact the affected institution if you see a transaction, account, or security alert you can’t explain.
Frequently Asked Questions
How long does it take to recover from identity theft?
Identity theft recovery can take anywhere from a few days to several months or longer. The timeline depends on how many accounts were affected, the type of fraud, and whether financial institutions or credit bureaus dispute your claims.
A single unauthorized credit card charge may be easier to resolve than several fraudulent loans, tax identity theft, or criminal identity theft.
Can someone steal your identity without affecting your credit score?
Yes. Identity theft doesn’t always cause an immediate change to your credit score. Someone could access your bank account, misuse your medical information, or file a fraudulent tax return without opening a new credit account.
Even when someone opens fraudulent credit accounts, the activity may not affect your credit score immediately. That’s why you should monitor more than your credit reports.
Do you need to pay for identity theft protection after identity theft?
No. You can freeze your credit reports, place fraud alerts, review your credit reports, and create an FTC Identity Theft Report for free.
Paid identity theft protection services may provide additional monitoring, alerts, insurance benefits, or recovery assistance. However, they can’t guarantee that identity theft won’t happen again.
If you’d prefer additional monitoring or professional recovery assistance, compare the features and costs of the best identity theft protection services before signing up.
