Finding a credit card, loan or tax return you never applied for is scary, but acting fast limits the damage. The FTC’s free site, IdentityTheft.gov, builds a personal recovery plan for you. Here is the step-by-step order to follow, starting with what to do in the first hour.
Do these first (today)
- Call the company where the fraud happened and ask for its fraud department. Close or freeze the account.
- Freeze your credit at Equifax, Experian and TransUnion (free).
- Report it at IdentityTheft.gov to get an FTC Identity Theft Report and a recovery plan.
- Change passwords on email, banking and any affected accounts, and turn on two-factor login.
📱 Short on time? Swipe through the 1-minute Web Story version.
Step 1: Stop the damage
- Call the fraud department of each company where an account was opened or misused. Ask them to close it and send you a letter confirming you aren’t responsible.
- Freeze your credit at all three bureaus so no new accounts can be opened.
- Or place a fraud alert: contact one bureau and it tells the other two. A basic alert lasts one year; an extended alert for identity theft victims lasts seven years.
Step 2: Report it to the FTC
Go to IdentityTheft.gov (or call 1-877-438-4338). Answer the questions and you’ll get an FTC Identity Theft Report and a checklist tailored to what happened. The report helps you prove to businesses that you’re a victim. Some people also file a police report, which some companies may ask for.
Step 3: Fix your accounts and records
| Problem | What to do |
|---|---|
| Fake accounts on your credit report | Dispute them with each bureau using your FTC report; check reports free every week at AnnualCreditReport.com |
| Someone filed taxes in your name | Follow the IRS identity theft steps (Form 14039) and consider an IRS Identity Protection PIN |
| Stolen mail | Report it to the U.S. Postal Inspection Service |
| Hacked email or phone | Change passwords, remove unknown devices, add two-factor login, and ask your carrier about a SIM lock |
Step 4: Protect yourself going forward
- Keep your credit frozen unless you’re applying for credit.
- Check your free credit reports regularly.
- Opt out of pre-approved credit offers to reduce mail thieves can use.
- Never share one-time codes, and watch for scam texts pretending to “help” victims.
⚠️ Recovery services that charge upfront fees aren’t needed for most people. IdentityTheft.gov is free and official. Be suspicious of anyone who contacts you claiming they can “fix” your identity for a payment.
Frequently asked questions
What is the first thing to do if your identity is stolen?
Call the fraud department of the company involved, freeze your credit at all three bureaus, and report it at IdentityTheft.gov.
Is IdentityTheft.gov free?
Yes. It’s the FTC’s official, free site, and it creates a personal recovery plan.
How long does a fraud alert last?
A basic fraud alert lasts one year. An extended alert for identity theft victims lasts seven years.
Do I need a police report?
Not always. The FTC Identity Theft Report is often enough, but some businesses may ask for a police report too.
More free protection guides
Last reviewed: October 16, 2026.
