Discovering that someone has stolen your identity is frightening. Whether you spotted an unfamiliar charge on your bank statement, received a bill for an account you never opened, or got a notice from the IRS about a return you never filed, the sinking feeling is the same. The good news is that acting quickly and following a clear plan can limit the damage and help you reclaim your identity. Here are the steps you should take right away.
1. Don't Panic, but Act Quickly
The first and most important thing to do is stay calm. Panic clouds your judgment and wastes precious time. Identity theft is a serious problem, but it is also a solvable one. Millions of Americans recover from it every year, and federal laws provide strong protections for victims. What matters most is the speed of your response. The faster you act, the less damage a thief can do.
Key Fact
According to the FTC, consumers reported losing over $10 billion to fraud in 2023 alone. Early detection and quick action are the single most important factors in minimizing financial harm from identity theft.
2. Report to the FTC at IdentityTheft.gov
Your first official step should be filing a report with the Federal Trade Commission at IdentityTheft.gov (or by calling 1-877-438-4338). When you create an account on the site, the FTC will:
- Walk you through a personalized recovery plan based on your situation
- Generate an official Identity Theft Report that guarantees you certain legal rights
- Pre-fill letters and forms you can send to businesses and credit bureaus
- Track your progress through each recovery step
Your FTC Identity Theft Report is a critical document. It proves to creditors, debt collectors, and credit bureaus that you are a verified victim, and it entitles you to protections such as blocking fraudulent debts from your credit report.
3. Place Fraud Alerts on Your Credit Reports
Contact one of the three major credit bureaus — Equifax, Experian, or TransUnion — to place a fraud alert on your credit file. By law, whichever bureau you contact must notify the other two. An initial fraud alert lasts one year and requires creditors to take extra steps to verify your identity before opening new accounts in your name.
If you have already filed your Identity Theft Report with the FTC, you can request an extended fraud alert that lasts seven years and requires creditors to contact you directly before approving new credit.
4. Freeze Your Credit at All Three Bureaus
A credit freeze (also called a security freeze) is even stronger than a fraud alert. It completely blocks new creditors from accessing your credit report, which means no one can open new accounts in your name — including you — until you lift or temporarily thaw the freeze. Freezing and unfreezing your credit is free by federal law.
You must place a freeze separately with each bureau:
- Equifax: equifax.com/personal/credit-report-services/credit-freeze
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
Don't Skip the Freeze
A fraud alert asks creditors to verify your identity, but a credit freeze legally blocks access to your credit file. Experts recommend doing both. Remember to also freeze your report with the lesser-known bureaus Innovis and NCTUE for comprehensive protection.
5. Review Your Credit Reports for Unauthorized Accounts
Pull your free credit reports from all three bureaus at AnnualCreditReport.com. Carefully review each report for:
- Accounts you don't recognize
- Hard inquiries you didn't authorize
- Addresses where you've never lived
- Incorrect personal information
If you find fraudulent accounts or charges, dispute them directly with the credit bureau and the company involved. With your FTC Identity Theft Report, the bureau must block the fraudulent information within four business days.
6. File a Police Report
While not always required, filing a police report with your local law enforcement creates an official record of the crime. Some creditors and financial institutions may require a police report before they will remove fraudulent charges or accounts. Bring your FTC Identity Theft Report and any supporting documentation — fraudulent bills, account statements, or correspondence — when you visit your local police department.
7. Contact Affected Financial Institutions
Reach out to the fraud department of every bank, credit card company, and financial institution where you know fraud has occurred. Ask them to:
- Close or freeze compromised accounts immediately
- Open new accounts with new account numbers
- Reverse fraudulent charges and issue new cards
- Flag your account for enhanced security monitoring
Keep detailed records of every call, including the date, the representative's name, and what was agreed upon. Follow up in writing whenever possible.
8. Change Passwords and Enable Two-Factor Authentication
If a thief accessed your accounts, your passwords may be compromised. Take these steps immediately:
- Change passwords on all financial accounts, email, and any account that uses the same or similar credentials
- Use unique, strong passwords for every account — at least 12 characters with a mix of letters, numbers, and symbols
- Enable two-factor authentication (2FA) everywhere it is available, prioritizing email, banking, and social media
- Use an authenticator app (such as Google Authenticator or Authy) rather than SMS codes, which can be intercepted through SIM-swapping attacks
- Consider a password manager like 1Password or Bitwarden to generate and securely store your credentials
9. Monitor Your Accounts Going Forward
Recovery from identity theft is not a one-time event. Stolen information can resurface months or even years later. Build ongoing monitoring into your routine:
- Review bank and credit card statements at least monthly
- Check your credit reports regularly — you are entitled to free weekly reports at AnnualCreditReport.com
- Set up transaction alerts with your bank and credit card companies
- Watch for signs of medical or tax-related identity theft, such as unexpected bills from healthcare providers or IRS notices about returns you didn't file
- File your tax return early each year to prevent tax refund fraud
10. Consider Identity Theft Protection Services
After experiencing identity theft, many people turn to dedicated protection services to avoid becoming a repeat victim. A good identity theft protection service will monitor your personal information across data breaches, financial accounts, and the dark web, alerting you to threats before they escalate.
But the best protection goes beyond monitoring — it addresses the root cause. Identity thieves rely on personal data that is publicly available through data broker websites. These sites collect and sell your name, address, phone number, email, family members, and more to anyone willing to pay. That information is often the starting point for identity theft, phishing, and social engineering attacks.
How PrivacyOn Helps Prevent Identity Theft
PrivacyOn removes your personal information from 100+ data broker sites — cutting off the supply of data that fuels identity theft in the first place. Instead of waiting for fraud to happen and reacting to it, PrivacyOn proactively shrinks your digital footprint so that criminals have far less to work with. The service also includes dark web monitoring, which alerts you if your personal data appears in leaked databases or criminal marketplaces. By combining data removal with ongoing surveillance, PrivacyOn offers a comprehensive layer of defense that complements the recovery steps outlined above.
Take Back Control
Having your identity stolen is stressful, but it is not permanent. By following these steps — reporting to the FTC, freezing your credit, disputing fraudulent accounts, and securing your digital life — you can recover and come out stronger. And by taking proactive measures like removing your data from broker sites with PrivacyOn, you make it significantly harder for identity theft to happen again.