What to Do If Your Identity Is Stolen: The Step-by-Step Recovery Plan

Quick answer: Call the company where the fraud happened and close or freeze that account, then freeze your credit for free at Equifax, Experian and TransUnion. Report it at IdentityTheft.gov, the FTC’s free site, which builds a recovery plan for you.

Finding a credit card, loan or tax return you never applied for is scary, but acting fast limits the damage. The FTC’s free site, IdentityTheft.gov, builds a personal recovery plan for you. Here is the step-by-step order to follow, starting with what to do in the first hour.

📱 Short on time? Swipe through the 1-minute Web Story version.

Step 1: Stop the damage

• Call the fraud department of each company where an account was opened or misused. Ask them to close it and send you a letter confirming you aren’t responsible.
• Freeze your credit at all three bureaus so no new accounts can be opened.
• Or place a fraud alert: contact one bureau and it tells the other two. A basic alert lasts one year; an extended alert for identity theft victims lasts seven years.

Step 2: Report it to the FTC

Go to IdentityTheft.gov (or call 1-877-438-4338). Answer the questions and you’ll get an FTC Identity Theft Report and a checklist tailored to what happened. The report helps you prove to businesses that you’re a victim. Some people also file a police report, which some companies may ask for.

Step 3: Fix your accounts and records

Step 4: Protect yourself going forward

• Keep your credit frozen unless you’re applying for credit.
• Check your free credit reports regularly.
• Opt out of pre-approved credit offers to reduce mail thieves can use.
• Never share one-time codes, and watch for scam texts pretending to “help” victims.

Signs your identity has been stolen

Identity theft is one of the most-reported problems in the U.S.: the FTC received more than 1.1 million identity theft reports in 2024. Many victims find out late. Watch for these warning signs:

• Charges, withdrawals or accounts you don’t recognize.
• Bills, collection calls or letters for debts that aren’t yours.
• A credit card or loan denial when your credit should be good.
• An IRS notice that a tax return was already filed in your name, or income from an employer you never worked for.
• Medical bills or insurance statements for care you never got.
• Your phone suddenly losing service (a sign of a “SIM swap” to steal your texts).
• Password-reset emails or login alerts you didn’t request.

Credit freeze vs. fraud alert: which do you need?

Most victims should do both: freeze all three credit reports and add an extended fraud alert using their FTC report. Our guide explains how to freeze your credit for free. When you need to apply for a loan or card, you can lift the freeze temporarily online in minutes.

Special cases: taxes, medical, children and benefits

• Tax identity theft: if the IRS says a return was already filed with your Social Security number, file your own return (on paper if needed) and attach IRS Form 14039, the Identity Theft Affidavit. Then sign up for an IRS Identity Protection PIN, a six-digit number that stops anyone else from filing with your SSN. Any taxpayer can get one at IRS.gov.
• Medical identity theft: ask your health insurer and doctors for your records and an “accounting of disclosures,” and dispute any care you didn’t receive. Medicare members should check their Medicare Summary Notices.
• Child identity theft: children rarely have credit reports. If your child has one, someone may be using their information. You can freeze a child’s credit at each bureau for free.
• Government benefits: if someone used your information to claim unemployment or other benefits, report it to the state agency and to IdentityTheft.gov. If it involves Social Security, contact the Social Security Administration and consider blocking electronic access to your record.
• Stolen driver’s license: contact your state motor vehicle agency to report it and ask about getting a new license number.

Keep a recovery log

Recovery can take weeks or months, so keep everything in one place. For every call or letter, write down the date, the company, the person’s name, what they said, and any reference number. Save copies of your FTC report, police report, dispute letters and replies. Send important letters by certified mail with a return receipt. This log makes it much easier to prove what happened if a company doesn’t fix an error.

Your rights as an identity theft victim

• You can get fraudulent information blocked from your credit report by sending the bureaus your FTC Identity Theft Report.
• Companies must give you copies of records for accounts opened in your name, if you send them your FTC report.
• Debt collectors must stop collecting a debt you dispute as identity theft until they verify it.
• You can get free credit reports and place an extended fraud alert for seven years.

How thieves usually get your information

• Data breaches at companies you’ve done business with. You can’t stop these, which is why a credit freeze matters.
• Phishing texts, emails and calls pretending to be your bank, the IRS, Social Security, a delivery company or tech support.
• Stolen mail, such as bank statements, new cards and pre-approved credit offers.
• Weak or reused passwords that leak in one breach and unlock other accounts.
• Public Wi-Fi and fake websites that capture logins and card numbers.
• Someone you know, such as a relative or roommate with access to your papers.

10-minute prevention checklist

1. Freeze your credit at Equifax, Experian and TransUnion.
2. Turn on two-factor login for email, banking and phone accounts, using an app or security key where you can.
3. Ask your mobile carrier for a SIM lock or port-out PIN.
4. Get an IRS Identity Protection PIN.
5. Create your my Social Security account before a criminal does.
6. Opt out of pre-approved credit card offers.
7. Turn on transaction alerts for every bank and card account.
8. Use a password manager and a different password for every account.
9. Shred old statements and documents with personal details.
10. Check your free weekly credit reports every few months.

Will you lose money? What the law says

Usually much less than people fear, if you act quickly. Under federal law, your liability for unauthorized credit card charges is capped at $50, and most card companies offer $0 liability. For debit cards and bank transfers, the timing matters a lot: reporting within two business days of learning about the loss limits what you can lose, while waiting more than 60 days after your statement is sent can leave you responsible for much more. That is why calling your bank the same day is step one.

Accounts or loans a thief opened in your name are not your debt. With your FTC Identity Theft Report and disputes, you should not have to pay them, and they should be removed from your credit report.

Frequently asked questions

Last reviewed: October 16, 2026.

Sources: FTC: IdentityTheft.gov; FTC: What to know about identity theft; FTC: Consumer Sentinel Network Data Book 2024; IRS: Get an Identity Protection PIN; AnnualCreditReport.com; FTC: Lost or stolen credit, ATM and debit cards.

Please leave this field empty

Oh hi there 👋
It’s nice to meet you.

Sign up to receive awesome content in your inbox, every month.

We don’t spam! Read our privacy policy for more info.

You're in! Check your inbox (and spam folder) to confirm.