Disclosure: Some links below may be affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. For more details, see our full disclaimer.
Discovering that someone has stolen your identity is one of the most stressful financial experiences you can face. Fraudulent credit card charges, unauthorized accounts opened in your name, and a damaged credit score can take months or years to fully resolve. But acting quickly and following the right steps can limit the damage and help you recover faster.
This guide provides a comprehensive, step-by-step plan for what to do the moment you discover — or suspect — that your identity has been stolen.
Signs Your Identity Has Been Stolen
Identity theft isn’t always obvious at first. Watch for these warning signs:
- Unauthorized charges: You see transactions on your credit card or bank statements that you didn’t make.
- Unfamiliar accounts: Your credit report shows accounts you didn’t open.
- Unexpected collection calls: Debt collectors contact you about debts you don’t recognize.
- Missing mail: Bills or statements stop arriving, suggesting your address was changed.
- IRS notices: You receive a letter about a tax return you didn’t file or income you didn’t earn.
- Denied credit: You’re unexpectedly turned down for a loan or credit card despite good credit.
- Medical bills for services you didn’t receive: Medical identity theft is increasingly common.
- Data breach notifications: A company you use notifies you that your personal information was compromised.
If any of these apply to you, don’t wait — start the recovery process immediately.
Step 1: Place a Fraud Alert on Your Credit Reports
A fraud alert tells creditors to take extra steps to verify your identity before opening new accounts. You only need to contact one of the three major credit bureaus — they’re required to notify the other two:
| Credit Bureau | Phone | Website |
|---|---|---|
| Equifax | 1-800-525-6285 | equifax.com/personal/credit-report-services/credit-fraud-alerts |
| Experian | 1-888-397-3742 | experian.com/fraud/center.html |
| TransUnion | 1-800-680-7289 | transunion.com/fraud-alerts |
There are two types of fraud alerts:
- Initial fraud alert: Free, lasts one year, and requires only one bureau contact. Creditors must take “reasonable steps” to verify identity before issuing credit.
- Extended fraud alert: Free, lasts seven years, requires an identity theft report (FTC report). Removes you from prescreened credit offers for five years.
Pro tip: Place the initial fraud alert right away — it takes just minutes and provides immediate protection while you work through the remaining steps.
Step 2: Freeze Your Credit
A credit freeze (also called a security freeze) is stronger than a fraud alert. It prevents creditors from accessing your credit report entirely, which effectively blocks anyone from opening new accounts in your name — including you, until you temporarily lift or remove the freeze.
Unlike fraud alerts, you must contact each bureau separately to place a freeze:
- Equifax: equifax.com/personal/credit-report-services/credit-freeze or 1-800-349-9960
- Experian: experian.com/freeze/center.html or 1-888-397-3742
- TransUnion: transunion.com/credit-freeze or 1-888-909-8872
Credit freezes are free by federal law. You’ll receive a PIN or password from each bureau to lift the freeze when needed (for example, when applying for a new credit card or mortgage). For a detailed walkthrough, read our credit freeze guide.
Step 3: File a Report with the FTC
File an identity theft report at IdentityTheft.gov (operated by the Federal Trade Commission). This official report:
- Creates a personalized recovery plan with specific steps for your situation
- Generates pre-filled letters to send to creditors, banks, and debt collectors
- Qualifies you for an extended (7-year) fraud alert
- Provides legal documentation that proves you’re a victim — essential for disputing fraudulent accounts
Save and print your FTC Identity Theft Report. You’ll need it for multiple steps in the recovery process.
Step 4: File a Police Report
While not always required, a police report strengthens your case when disputing fraudulent accounts and can be required by certain creditors or financial institutions. To file:
- Visit your local police department in person
- Bring your FTC Identity Theft Report, a government-issued ID, proof of your address, and any evidence of the fraud (statements, collection letters, etc.)
- Request a copy of the police report for your records
Some police departments allow online reporting for identity theft. Check your local department’s website for options.
Step 5: Contact Your Financial Institutions
Credit Card Companies
Call each credit card issuer where fraud has occurred:
- Report the fraudulent charges and request a new card number
- Ask the issuer to close the compromised account and open a new one
- Dispute all unauthorized charges in writing — federal law limits your liability to $50 for credit cards (most issuers waive even that)
- Request written confirmation that the fraudulent charges have been removed
Bank Accounts
If your bank accounts were compromised:
- Contact your bank immediately to report unauthorized transactions
- Close compromised accounts and open new ones with new account numbers
- Change online banking passwords and PINs
- Set up fraud alerts and transaction notifications on your new accounts
- Review automatic payments and update them to your new account numbers
Under federal law, if you report unauthorized electronic transfers within two business days, your liability is limited to $50. After two days, your liability can rise to $500 or more — so act fast.
Fraudulent Accounts Opened in Your Name
If someone opened accounts you didn’t authorize:
- Contact each institution and explain that the account was opened fraudulently
- Ask them to close or freeze the account immediately
- Send a written dispute with a copy of your FTC Identity Theft Report
- Request that the institution send you copies of all application materials (you’re entitled to this under federal law)
- Request written confirmation that the account has been closed and that you’re not liable for any charges
Step 6: Dispute Fraudulent Items on Your Credit Reports
After filing your FTC report and contacting creditors, dispute all fraudulent items on your credit reports:
- Request free copies of your credit reports from all three bureaus at AnnualCreditReport.com
- Review each report carefully for accounts you didn’t open, inquiries you didn’t authorize, and incorrect personal information
- File disputes with each bureau that shows fraudulent information — include your FTC Identity Theft Report
- The bureau must investigate within 30 days and remove items that can’t be verified
For a complete guide to reading and disputing your reports, see our article on how to read your credit report and dispute errors.
Step 7: Secure Your Accounts and Devices
Change All Passwords
Update passwords for every financial account, email, and sensitive online service. Use strong, unique passwords for each account (at least 12 characters with a mix of letters, numbers, and symbols). Use a password manager like 1Password, Bitwarden, or LastPass to generate and store complex passwords securely.
Enable Two-Factor Authentication (2FA)
Turn on 2FA for all financial accounts, email, and social media. This adds a second layer of security — even if someone has your password, they can’t access your account without the second factor (usually a code sent to your phone or generated by an authenticator app).
Check for Malware
If you suspect your identity theft originated from a compromised device, run a full malware scan on your computers and phones. Use reputable security software and ensure your operating system and apps are up to date.
Monitor Your Mail
If you suspect mail theft or diversion, contact the U.S. Postal Service to check for unauthorized address changes. Consider signing up for USPS Informed Delivery, which emails you images of mail pieces before they arrive.
Step 8: Monitor Your Credit and Accounts Ongoing
Recovery from identity theft isn’t a one-time fix — ongoing monitoring is essential to catch any new fraudulent activity:
- Check credit reports regularly: Review all three credit reports every 4-6 months for the first year after identity theft. Use free credit monitoring services for continuous alerts.
- Set up account alerts: Enable transaction notifications on all bank accounts and credit cards so you’re immediately alerted to any activity.
- Consider an identity theft protection service: Services like LifeLock, Aura, and Identity Guard provide comprehensive monitoring, insurance, and recovery assistance. Compare options in our best identity theft protection services guide.
- Watch for tax fraud: File your tax return as early as possible each year to prevent someone else from filing a fraudulent return in your name. If you’re a victim of tax identity theft, file IRS Form 14039 (Identity Theft Affidavit).
Special Types of Identity Theft
Child Identity Theft
Children’s Social Security numbers are valuable targets because the fraud may go undetected for years. Check whether your child has a credit report — they shouldn’t have one. If a report exists, it likely indicates fraud. Place a freeze on your child’s credit at all three bureaus.
Medical Identity Theft
If someone uses your identity to receive medical care, your medical records become contaminated with their information — which can be dangerous. Request copies of your medical records, correct any errors, and report the fraud to your insurance company and the healthcare provider’s fraud department.
Tax Identity Theft
If someone files a tax return using your Social Security number, the IRS will reject your legitimate return. File IRS Form 14039, include it with a paper tax return, and request an Identity Protection PIN from the IRS for future filings.
Synthetic Identity Theft
This newer form of fraud combines real and fake information (for example, your real Social Security number with a fake name and address) to create a new “synthetic” identity. It’s harder to detect because it may not appear on your credit report initially. Regular monitoring and freezing your credit are your best defenses.
How Long Does Identity Theft Recovery Take?
The timeline varies significantly based on the severity:
| Severity | Examples | Typical Recovery Time |
|---|---|---|
| Minor | One fraudulent credit card charge | 1-2 weeks |
| Moderate | Multiple fraudulent accounts opened | 1-3 months |
| Severe | Tax fraud, medical fraud, criminal identity theft | 6-12+ months |
According to the Identity Theft Resource Center, victims spend an average of 100-200 hours resolving identity theft cases. Document every phone call, letter, and interaction — keeping meticulous records will save you time and frustration.
Your Legal Rights as an Identity Theft Victim
Federal law provides several protections for identity theft victims:
- Fair Credit Reporting Act (FCRA): Bureaus must remove fraudulent information within 30 days of receiving your dispute and FTC report.
- Fair Credit Billing Act: Credit card liability is limited to $50 for unauthorized charges (most issuers waive this entirely).
- Electronic Fund Transfer Act: Limits liability for unauthorized debit card/bank account transactions to $50 if reported within 2 business days.
- Identity Theft and Assumption Deterrence Act: Makes identity theft a federal crime with serious penalties.
- Right to documentation: You can request copies of application materials and transaction records from businesses where accounts were opened fraudulently.
- Free credit freezes and fraud alerts: Both are free by federal law.
Frequently Asked Questions
Should I pay debts from fraudulent accounts?
No. Do not pay any debts associated with fraudulent accounts. Paying acknowledges the debt and makes it harder to dispute. Instead, follow the dispute process: file your FTC report, notify the creditor in writing that the account is fraudulent, and provide documentation. Learn more in our guide on how to dispute a debt.
Will identity theft permanently damage my credit score?
No. While identity theft can severely damage your credit in the short term, fraudulent accounts and inquiries are removed once disputes are resolved. With consistent monitoring and dispute follow-up, most people restore their credit within 3-12 months. Focus on rebuilding your credit score once the fraudulent items are removed.
Should I pay for identity theft protection?
Paid services like LifeLock and Aura can provide convenience — including dark web monitoring, insurance, and recovery assistance. However, you can do most of the monitoring yourself for free using free credit monitoring, credit freezes, and fraud alerts. Consider paid protection if you’ve been a victim before or if your data was exposed in a major breach.
Can I prevent identity theft completely?
You can significantly reduce your risk, but no one is completely immune. Proactive measures include freezing your credit, using strong unique passwords, enabling 2FA, limiting personal information shared online, and shredding sensitive documents. For comprehensive prevention strategies, read our guide on how to protect yourself from identity theft.
What’s the difference between a fraud alert and a credit freeze?
A fraud alert tells creditors to verify your identity before opening accounts — but doesn’t guarantee they will. A credit freeze blocks access to your credit report entirely, providing stronger protection. Freezes are free and can be temporarily lifted when you need to apply for credit. We recommend placing both for maximum protection.
Bottom Line
Discovering identity theft is alarming, but you have more power and legal protection than you might realize. Act quickly: place a fraud alert and freeze, file with the FTC, contact affected institutions, dispute fraudulent items on your credit reports, and secure your accounts. Keep meticulous records of every step, and follow up until every fraudulent account is closed and every false item is removed from your credit reports.
Prevention is always easier than recovery. Once your identity is restored, maintain credit freezes, use free credit monitoring, and stay vigilant. Your financial identity is worth protecting — and now you know exactly how to do it.