What to Do If Your Identity Is Stolen: A Step-by-Step Recovery Plan

Act fast and in the right order. Here's exactly what to do in the first hour, the first day and the following weeks after identity theft.

Identity theft happens when someone uses your personal information — such as your Social Security number, credit card numbers or bank details — without your permission. Thieves may open credit cards, take out loans, file tax returns, get medical care or even give your name to police. Recovering takes some effort, but following the right steps limits the damage and gets your records cleaned up.

Warning signs

• Charges or withdrawals you don't recognize
• Bills or collection calls for accounts you never opened
• Unfamiliar accounts or inquiries on your credit report
• Expected mail or bills that suddenly stop arriving
• Being denied credit unexpectedly
• An IRS notice that more than one return was filed in your name
• A data breach notice from a company that holds your information

Step 1: Contact the companies where fraud occurred

Call the fraud department of every bank, card issuer or business where you see fraudulent activity. Explain that someone stole your identity, ask them to close or freeze the affected accounts, and change your passwords and PINs. Write down who you spoke to and when.

Step 2: Freeze your credit at all three bureaus

A credit freeze stops most lenders from viewing your credit report, which makes it very hard for anyone to open new accounts in your name. By federal law, placing and lifting a freeze is free. You must contact each bureau separately:

• Equifax
• Experian
• TransUnion

Each lets you freeze online. A freeze doesn't affect your existing accounts or your credit score, and you can temporarily lift it when you need to apply for credit.

Or place a fraud alert

A fraud alert tells lenders to take extra steps to verify your identity before opening credit. It's free, and you only need to contact one bureau — it must notify the other two. An initial fraud alert lasts one year. If you're an identity theft victim, you can get an extended fraud alert that lasts seven years. Many people use both a freeze and a fraud alert.

Step 3: Report it to the FTC at IdentityTheft.gov

Go to IdentityTheft.gov, the Federal Trade Commission's official site, or call 1-877-438-4338. You'll answer questions about what happened, and the site will generate:

• An FTC Identity Theft Report, which proves to businesses that your identity was stolen and gives you certain legal rights.
• A personalized recovery plan with pre-filled letters to send to companies and credit bureaus.

If you create an account on the site, it tracks your progress and updates your plan.

Step 4: Consider a police report

Some creditors or situations may require a local police report, especially if you know the thief or if the thief used your name in an interaction with police. Bring your FTC Identity Theft Report, a photo ID and any proof of the theft.

Step 5: Clean up your credit reports

Get your free reports at AnnualCreditReport.com and dispute every fraudulent account and inquiry with each bureau. With an FTC Identity Theft Report, bureaus must block fraudulent information from your report. See our guide on disputing credit report errors for how.

Step 6: Handle special types of identity theft

• Tax identity theft: If the IRS says a return was already filed with your Social Security number, follow the instructions in the IRS notice and complete Form 14039, Identity Theft Affidavit, if directed. You can also request an IRS Identity Protection PIN, which prevents anyone else from filing a return with your SSN.
• Medical identity theft: Review explanation-of-benefits statements from your health insurer and request your medical records to correct false information.
• Government benefits: Contact the agency involved, such as the Social Security Administration or your state unemployment office.
• Lost or stolen documents: Report a lost passport to the State Department and contact your state motor vehicle agency about a stolen driver's license.

Step 7: Lock down your accounts

Change passwords on your email, bank and other important accounts, starting with email. Use a unique password for each account and turn on multi-factor authentication. Our guide to protecting your online accounts walks you through it.

Stay alert afterward

Keep your credit frozen unless you're applying for credit, check your reports regularly, review bank and card statements every month, and keep copies of all letters and reports in one folder. Be cautious of follow-up "recovery" calls — scammers sometimes target people who were already victims.