What to Do If Your Identity Is Stolen: A Step-by-Step Response Guide
Identity theft cost consumers $12.5 billion in reported fraud losses in 2024 alone, according to the FTC, and the number keeps climbing. Knowing exactly what to do in the first hours and days after discovering it makes the difference between a manageable inconvenience and a years-long mess. This guide covers the actual sequence of steps that matter.
Step One: Confirm What Actually Happened
Before taking action, review recent bank and credit card statements for unfamiliar transactions, and check for unexpected account or credit denial notices. A single fraudulent charge is different from someone opening new accounts in your name, and the right response depends on which situation you’re actually dealing with.
Step Two: Contact Financial Institutions Immediately
If a bank account or credit card is compromised, notify the institution’s fraud department right away. Banks can freeze pending and future transactions immediately, and most accept reports by phone or online without requiring an in-person visit first.
Step Three: File a Report at IdentityTheft.gov
The FTC’s IdentityTheft.gov creates an official Identity Theft Report and, critically, generates a personalised, step-by-step recovery plan specific to your situation, whether that involves a stolen tax refund, medical identity theft, or new accounts opened in your name. This report also serves as documented proof of the theft when dealing with banks, credit bureaus, and insurers afterward.
Step Four: Place a Fraud Alert or Credit Freeze
Contacting just one of the three major credit bureaus (Equifax, Experian, or TransUnion) is enough, since US law requires that bureau to notify the other two. A fraud alert lasts one year and requires lenders to verify your identity before opening new credit; a credit freeze goes further, blocking new accounts from being opened entirely until you lift it.
Step Five: Review Your Full Credit Reports
Request free reports from all three bureaus at AnnualCreditReport.com and check carefully for unfamiliar accounts, loans, or inquiries. Dispute anything you don’t recognise directly with the credit bureau, providing your Identity Theft Report as supporting evidence.
Step Six: File a Police Report If Needed
For cases involving new accounts opened in your name or other significant fraud, bring your Identity Theft Affidavit, a government-issued photo ID, and proof of address to your local police department. Some businesses and credit bureaus specifically require a police report, not just an FTC affidavit, before removing fraudulent items from your file.
Handling Tax-Related Identity Theft
If someone files a fraudulent tax return using your Social Security number, filing your own return as early as possible, and requesting an IRS Identity Protection PIN, both help prevent this specific form of theft from succeeding again in future tax years.
Handling Medical Identity Theft Separately
Medical identity theft, where someone uses your identity to receive treatment or prescriptions, requires its own process: request copies of your medical records from any provider the thief used, review them for errors, and send written correction requests along with a copy of your FTC report to each provider and your health insurer.
Can You Get a New Social Security Number?
In rare, severe cases, yes, but the Social Security Administration requires proof that you’ve already tried other remedies and are still facing serious ongoing harm. Even then, your old number stays permanently linked to your history and will still surface in background checks.
Preventing a Repeat: What to Do Afterward
- Change passwords and enable multi-factor authentication on every affected account, and any account reusing the same password
- Set up account alerts with your bank for unusual activity going forward
- Sign up for credit monitoring if your bank or employer offers it as a benefit
- Stay alert for follow-up scams, since criminals often retarget identity theft victims with new attempts
Frequently Asked Questions
How long does identity theft recovery usually take?
It varies significantly by severity, from a single fraudulent charge resolved in days to new accounts and tax fraud that can take weeks or months to fully unwind across multiple institutions.
Do I need both an FTC report and a police report?
Not always, but for significant cases involving new accounts in your name, some businesses and credit bureaus specifically require a police report in addition to the FTC’s Identity Theft Report.
Conclusion
Identity theft recovery follows a fairly predictable sequence: confirm the scope, lock down accounts, file the FTC report for a personalised plan, freeze credit, and dispute fraudulent records with documentation in hand. Moving through these steps quickly and in order is what limits the damage most effectively. Preventing it in the first place starts with the habits covered in our complete personal cybersecurity guide.
About the Author
