What do you do after your identity is stolen?
Run this in order. The paperwork does the fighting.

What do you do in the first 24 hours?

Triage first, paperwork second. Hour one: call the fraud department of each company where the theft actually happened, the card issuer with the bogus charges, the bank with the account you never opened, the lender with the loan you never took. Ask them to close or freeze the compromised account, remove the fraudulent charges, and issue new account numbers and cards. Change the login password and PIN on every affected account, and on your email if there is any chance it was compromised, since email is the reset key to everything else. Our financial security page covers the password manager and 2FA stack.

Hour two: place a free initial fraud alert. You only need to contact 1 of the 3 nationwide bureaus (Equifax, Experian, TransUnion); as soon as that bureau processes your alert, it must notify the other 2, which must also place the alert verify×DON'T TRUST, VERIFYClaim: You can place a fraud alert by contacting just one of the three nationwide bureaus; once it processes the alert it must notify the other two, which must also place alerts in your file.Verify at: CFPB: Remedying the Effects of Identity Theft (FCRA summary) ↗The CFPB's official FCRA rights summary for identity theft victims states the one-call rule verbatim.. With the alert in place, a creditor must take reasonable steps to verify it is really you before opening new credit in your name. The alert lasts 1 year and can be renewed when it expires.

Before the day ends: file your report at IdentityTheft.gov (next section) and pull your credit reports from all 3 bureaus at AnnualCreditReport.com ↗, the official free source. Placing an initial fraud alert also entitles you to a free copy of your file from each bureau. Go line by line and list every account, inquiry, and address you do not recognize. You cannot dispute what you have not found.

What does IdentityTheft.gov actually give you?

IdentityTheft.gov ↗ is the FTC's one-stop identity theft portal (also reachable at 1-877-438-4338), and it is the spine of the whole recovery. You answer questions about what happened, and the system does 3 things: it builds you a personal recovery plan sequenced to your specific situation, it pre-fills the letters you will send to merchants, banks, and bureaus, and it completes your FTC Identity Theft Report, your official statement about the crime verify×DON'T TRUST, VERIFYClaim: Reporting at IdentityTheft.gov creates a personal recovery plan, pre-fills letters to merchants and banks, and completes an FTC Identity Theft Report that in most cases can be used in place of a police report.Verify at: CFPB: How to Handle Identity Theft ↗The CFPB's handout lists all three outputs of an IdentityTheft.gov filing and the police-report substitution rule..

That report is not a formality. It is the qualifying document for the extended 7-year fraud alert, it is what the credit bureaus require to block fraudulent accounts under FCRA Section 605B, and in most cases you can use it in place of a police report to clear your accounts and credit history. Save the PDF the moment it generates, and save your login, because the recovery plan updates as you check off steps.

One warning shaped by how the theft usually continues: the FTC will never call you about your report and ask for money, gift cards, or your Social Security number. Follow-up scams that impersonate the FTC, the IRS, or your bank's fraud department target known victims precisely because they are already scared. Treat every inbound call about your case as hostile and call back on the number printed on the official site or your card.

Should you use a fraud alert or a credit freeze?

Both, and they do different jobs. An alert warns; a freeze walls. The freeze mechanics (all 3 bureau links, PINs, lifting) live on our credit freeze page, so this table only maps the decision.

The playbook after confirmed theft: initial alert on day 1 because it is instant and propagates itself, freeze at all 3 bureaus the same day because it actually stops new accounts, then upgrade to the extended 7-year alert once your Identity Theft Report exists. The alert still matters with a freeze on, because it follows your file into places a freeze does not always reach, like existing-account reviews.

How do you force fraudulent accounts off your credit reports?

This is where the Identity Theft Report earns its keep. FCRA Section 605B gives you a blocking right that is faster and stronger than an ordinary dispute: send a bureau (1) a copy of your Identity Theft Report, (2) proof of your identity, and (3) a letter identifying exactly which information resulted from the theft, and the bureau must block that information from your credit report within 4 business days of receiving your request verify×DON'T TRUST, VERIFYClaim: After you submit an identity theft report, proof of identity, and a letter identifying the fraudulent information, the credit reporting company must block that information from your credit report within 4 business days.Verify at: CFPB: What do I do if I've been a victim of identity theft? ↗The CFPB's identity theft guidance states the 4-business-day blocking requirement and the three items you must submit.. It must also notify the furnisher (the company that reported the account), and once a debt is blocked, anyone with notice of the block is barred from selling, transferring, or placing that debt for collection.

Run the same fight at the source: write to the fraud department of each company that opened or reported the fraudulent account and dispute it as identity theft, enclosing your report. You also have a documents right most victims never use: on written request, a business must give you copies of the applications and records the thief used, which shows you exactly what information they had. A business may ask for proof of identity and sometimes a police report or affidavit before releasing them.

If a collector calls about a fraudulent debt, do not argue on the phone. Demand written validation within the 30-day window, send your Identity Theft Report, and know that a collector must tell you the creditor's name and the amount on request. The full collector playbook, including the cease-communication letter, is on our debt collector rights page.

When do you actually need a police report?

Less often than people think. In most cases your FTC Identity Theft Report substitutes for a police report when clearing your accounts and credit history. The CFPB's guidance lists exactly 3 situations where you should also file with local police: you know who did it or have information that could help an investigation, the thief used your name in a traffic stop or any other encounter with police, or a company asks you to produce a police report before it will act.

The third case is the common one in practice: some banks and some bureaus' extended-alert paperwork want a law enforcement report attached. If you do file, bring your FTC report, a government ID, proof of address, and the evidence you have, and get the report number before you leave. Note the FCRA's definition of an identity theft report for the extended alert contemplates a report filed with a federal, state, or local law enforcement agency, so if a bureau pushes back on the extended 7-year alert with only the FTC report, a police report ends the argument.

How do you lock down your IRS tax account?

Do this even if the thief has not touched your taxes yet, because a Social Security number that opened a credit card can also file a refund claim next January. The lock is the Identity Protection PIN (IP PIN): a 6-digit number, valid for 1 calendar year and regenerated annually, that prevents anyone else from filing a federal return with your SSN or ITIN. Anyone who can verify their identity can opt in, including for dependents. The fastest path is the IP PIN section of your IRS.gov online account; if you cannot pass online verification, Form 15227 works when your AGIAdjusted Gross Income (AGI)Your total income minus certain deductions, used to calculate your tax bill.Full definition is below $84,000 (below $168,000 married filing jointly), or you can verify in person at a Taxpayer Assistance Center verify×DON'T TRUST, VERIFYClaim: The IP PIN is a six-digit number valid for one calendar year that prevents someone else from filing a return with your SSN; opt-in is available online, by Form 15227 for AGI below $84,000 single / $168,000 MFJ, or in person.Verify at: IRS: Get an Identity Protection PIN ↗The IRS IP PIN page states the six-digit format, one-year validity, and all three enrollment paths with the 2026 AGI thresholds..

If a fraudulent return already exists, the signal is usually an e-file rejection saying a return was already filed under your SSN, an IRS notice about wages from an employer you never worked for, or a transcript you never requested. Form 14039 (Identity Theft Affidavit) is the formal flag, but the IRS is explicit that in most tax identity theft cases there is no need to file it. File it when your e-file rejects for a duplicate SSN and it is not a typo, when a dependent's SSN was used without permission, or when the IRS tells you to. Do not file it if you received letter 5071C, 4883C, or 5747C; those letters route you to the IRS identity verification service instead. You can submit Form 14039 online through the IRS or attach it when you report at IdentityTheft.gov verify×DON'T TRUST, VERIFYClaim: The IRS says most tax identity theft cases do not require Form 14039; file it for situations like a duplicate-SSN e-file rejection, and not after receiving letters 5071C, 4883C, or 5747C. It can be filed online via the IRS or through IdentityTheft.gov.Verify at: IRS: When to file an Identity Theft Affidavit ↗The IRS newsroom guidance lists the specific filing scenarios, the letters that route to identity verification instead, and both online filing channels..

After the IRS confirms a fraudulent return, it removes it from your account, and confirmed victims are typically enrolled in the IP PIN program automatically each year. Expect your legitimate refund to be delayed while the case works through; paper-file your real return with the affidavit if e-file stays blocked. Completing the affidavit is also what invalidates the fraudulent return filed with your information, per the federal guidance at usa.gov/identity-theft ↗.

How do you clean up the accounts themselves?

Credit reports are only half the mess. For each fraudulent account, work the furnisher directly: ask the fraud department to close the account, reverse the charges, and send you a letter confirming the account was fraudulent, you are not liable, and it was removed from your credit report. That confirmation letter is worth more than any verbal promise, and you will want it if the account resurfaces with a debt buyer in 3 years.

If a thief opened a checking account or bounced checks in your name, the cleanup runs through the banking reporting systems, mainly ChexSystems, not the credit bureaus. Dispute the record there the same way: identity theft report, proof of identity, written dispute. Our second-chance banking page covers how those records work and how to read yours.

When a bureau or furnisher stonewalls, refuses a block, or keeps re-reporting a cleared account, escalate to the CFPB complaint system at consumerfinance.gov/complaint. It covers credit reporting, debt collection, and bank accounts, the complaint is routed to the company, and most companies respond within 15 days verify×DON'T TRUST, VERIFYClaim: The CFPB complaint process covers credit reporting, debt collection, and bank accounts; complaints are sent to the company and most companies respond within 15 days.Verify at: CFPB: Submit a complaint ↗The CFPB complaint page lists the covered products and states that most companies respond within 15 days.. A regulator complaint creates a documented, dated paper trail that companies treat very differently from a consumer phone call. Your state attorney general is a parallel channel.

What should you write down while all this happens?

Everything, because identity theft disputes are won on records, not memory. Start a single folder (paper or digital, ideally both) the day you discover the theft, and treat it like a case file. The habit that matters most: log every call with the date, the time, the full name of the person you spoke to, a reference or case number, and 1 line on what was promised. When a bank says "we have no record of that conversation" 6 months later, your log is the record.

• Send disputes by mail with tracking or a certificate of mailing, and keep a copy of every letter. Dated proof of delivery is what starts legal clocks like the 4-business-day block.
• Save every confirmation: the Identity Theft Report PDF, fraud alert confirmations, freeze PINs, closure letters, police report number, IRS notices.
• Keep the fraud evidence itself: collection letters, statements with bogus charges, the data breach notice. Do not shred the crime scene.
• Note your out-of-pocket costs and hours. If the case ever reaches restitution or a lawsuit, that ledger is your damages.

Then keep watching. Recheck all 3 credit reports a month after your blocks go in, then on a rotating schedule through the year. Blocked items sometimes reappear when a debt gets sold to a buyer who never got the memo; the block right still applies, and your folder makes round 2 a form letter instead of a fight.

What about child identity theft and data breach letters?

A child's stolen identity is usually discovered years late, when bills, credit card offers, or collection calls arrive in the child's name, because children have no reason to check a credit file. One study cited by the CFPB indicated that approximately 2.5% of US households with children have experienced child identity fraud at some point (CFPB). If you see the warning signs, ask each of the 3 bureaus whether a file exists in the child's name and dispute everything on it; a minor cannot legally enter those contracts. Report at IdentityTheft.gov the same as for an adult. For prevention, parents, guardians, and child welfare representatives can freeze the file of a child under 16 for free, and if no file exists the bureaus must create one just to freeze it verify×DON'T TRUST, VERIFYClaim: Parents, legal guardians, and child welfare representatives can freeze the credit file of a child under 16 for free, and if no file exists the bureaus will create one in order to freeze it.Verify at: CFPB: New protections available for minors under 16 ↗The CFPB explains the under-16 freeze right, the free cost, the file-creation rule, and the proof-of-authority requirement.. Expect to mail proof of authority such as a birth certificate.

A data breach letter is exposure, not yet theft, so it gets the prevention response rather than this full runbook: place the free 1-year initial fraud alert (built for exactly this situation), freeze your credit if it is not frozen already, change the breached password everywhere it was reused, and watch your statements and reports. Take or skip the breach company's free credit monitoring, but do not let that decision distract you from the freeze; monitoring tells you about fraud after it happens, a freeze stops the account from opening at all. Escalate to this page's full sequence only when something fraudulent actually appears.

What does the full recovery runbook look like?

The whole page in one table. Print it, work top to bottom, check things off.

Timeframes assume you act on discovery day. The 4-business-day block clock starts when the bureau receives your request, and the 1-year and 7-year alert durations are federal FCRA terms as of 2026.

Related