What to Do If Your Identity Is Stolen

Discovering that your identity has been stolen is alarming — but how fast you act in the first 24 to 72 hours will determine how much damage you can limit. Identity thieves move quickly, opening accounts, filing false tax returns, and draining bank balances before most people even realize something is wrong. This guide walks you through every step you need to take, in order.

Step 1: Report to the FTC at IdentityTheft.gov

Your first call should be to the Federal Trade Commission. Go to IdentityTheft.gov and file a report. The site will walk you through a series of questions about what happened and then automatically generate two critical documents:

• An Identity Theft Report — a legally recognized document you can use when disputing fraudulent accounts with creditors and credit bureaus
• A personalized recovery plan — a step-by-step checklist tailored to the specific type of theft you experienced

Keep copies of everything. The FTC report serves as your paper trail and is often required by banks, creditors, and government agencies before they will take action on your behalf.

Step 2: Contact Your Bank and Credit Card Companies

Call the fraud departments of every financial institution where you have accounts — even ones you don't think were touched. Explain that your identity has been stolen and ask them to:

• Review recent transactions for unauthorized activity
• Dispute and reverse any fraudulent charges
• Freeze or close compromised accounts and issue new account numbers
• Flag your account for additional verification requirements going forward

Most banks have 24-hour fraud lines. Don't wait until business hours. Every minute counts when someone has access to your accounts.

Step 3: Place a Fraud Alert with the Credit Bureaus

A fraud alert tells lenders that they must take extra steps to verify your identity before opening any new credit in your name. The good news: you only need to contact one bureau, and they are legally required to notify the other two.

• Equifax: 1-800-525-6285
• Experian: 1-888-397-3742
• TransUnion: 1-800-680-7289

An initial fraud alert lasts one year and is free. If you have an FTC Identity Theft Report, you can request an extended fraud alert that lasts seven years.

Step 4: Freeze Your Credit at All Three Bureaus

A fraud alert is a warning. A credit freeze is a lock. When your credit is frozen, no lender can access your credit file to open a new account — which means thieves cannot take out loans, open credit cards, or obtain financing in your name, even if they have your Social Security number.

You must freeze your credit separately at each of the three bureaus. Visit their websites or call the numbers above to do this. While you're at it, also consider freezing your file at NCTUE (used by telecom and utility companies) and ChexSystems (used by banks when opening checking accounts).

Step 5: Check Your Credit Reports for Unauthorized Accounts

Go to AnnualCreditReport.com — the only federally authorized site for free credit reports — and pull your reports from all three bureaus. You are entitled to free weekly reports. Review each one carefully for:

• Accounts you don't recognize
• Hard inquiries from lenders you never contacted
• Addresses or employers listed that aren't yours
• Negative items that result from fraudulent activity

For any account you didn't open, file a dispute directly with the bureau reporting it and include a copy of your FTC Identity Theft Report. Under federal law, bureaus must investigate and respond within 30 days.

Step 6: File a Police Report

Visit your local police department and file an identity theft report. Bring your FTC Identity Theft Report, a government-issued ID, and any evidence of the fraud (account statements, emails, letters). Get a copy of the police report with the case number.

Some creditors and agencies require a police report before they will remove fraudulent accounts or charges. Even if yours don't, having one strengthens your case and creates an official record.

Step 7: Change Passwords and Enable Two-Factor Authentication

If your accounts were compromised, assume your passwords are no longer safe. Change passwords on every account that may have been affected — email, banking, social media, shopping sites, and anywhere you have saved payment information. Follow these security practices:

• Use a unique, strong password for every account (a password manager makes this practical)
• Enable two-factor authentication (2FA) on every account that supports it, especially email and financial accounts
• Revoke access to any third-party apps connected to compromised accounts
• Check your email settings for forwarding rules or filters that a thief may have set up

Step 8: Watch for Tax Identity Theft

Tax identity theft — where someone files a fraudulent return using your Social Security number to claim your refund — is one of the most common and costly forms of identity theft. Take these steps:

• File your taxes as early as possible. The first return filed with your SSN is processed; any subsequent return gets flagged. Beat the thief to the IRS.
• Request an Identity Protection PIN (IP PIN) from the IRS at IRS.gov/IPPIN. This six-digit number is required on your tax return and prevents anyone else from filing under your SSN.
• Watch for IRS notices. If the IRS sends a letter saying it received more than one return under your name, respond immediately using the contact information on the notice.

Step 9: Set Up Ongoing Monitoring

Recovery from identity theft doesn't end once you've disputed the fraudulent accounts. Thieves often use stolen information in waves, or sell it to other criminals. You need to stay vigilant:

• Review your bank and credit card statements every week
• Set up account alerts for all transactions above a minimum threshold
• Continue pulling your credit reports regularly through AnnualCreditReport.com
• Consider a credit monitoring service that alerts you to new inquiries or accounts in real time

Prevention: Remove Your Data from Data Broker Sites

Identity thieves don't always need to hack a database. In many cases, they find everything they need — your full name, address history, date of birth, phone number, and family members — on data broker and people-search websites that publish this information publicly and for free.

Removing your personal information from these sites eliminates a major source of raw material that identity thieves rely on. The problem is that there are hundreds of these sites, each with their own opt-out process, and they re-list your data regularly from public records.

PrivacyOn automates this process, submitting removal requests across 100+ data broker sites and monitoring them continuously so that when your data reappears — and it will — it gets removed again automatically. Reducing your exposure on data broker sites won't prevent every form of identity theft, but it meaningfully raises the cost and effort for anyone trying to target you specifically.

A Note on Recovery Time

Identity theft recovery is not a single event — it's a process that can take months or longer depending on the severity. Stay organized, keep records of every call and correspondence, and don't be discouraged if it takes multiple rounds of disputes to fully clean up your credit. The steps above, taken systematically, will get you there.