What to Do if Your Identity Is Stolen

The moment you suspect your identity is stolen, do three things in this order: call the fraud line printed on the back of any affected card, place a free credit freeze at all three major bureaus, and file a report at IdentityTheft.gov to get an official Identity Theft Report. Those moves stop new damage and unlock legal rights that make every dispute afterward faster and stronger.

Everything else is cleanup. Below is exactly how to do each step, what most people get wrong, and how the rules differ if you are outside the United States.

The first 48 hours, in order#

Speed matters most in the opening days, because a thief is racing to open accounts before you notice. Work this list top to bottom.

1. Call your bank's fraud department, not the general line. Use the number on your card or a printed statement so you know you have reached the real institution. Ask them to freeze or close the compromised account, reissue cards, and reverse fraudulent charges. Review recent transactions for small "test" amounts under a dollar or two, which fraudsters use to check a card before a large purchase.
2. Freeze your credit at Equifax, Experian, and TransUnion. This is the single highest-value step, and since a 2018 US federal law it is free. A freeze blocks lenders from pulling your report, so no one can open a new credit card, loan, or account in your name.
3. File at IdentityTheft.gov (the US Federal Trade Commission's site). It builds a personalized recovery plan and generates an FTC Identity Theft Report, a document that gives you extra legal leverage described below.
4. Change passwords on your email first, then everything else. Email is the master key: whoever controls it can reset the password on almost every other account through "forgot password" links.
5. Start a log. Record the date, time, name, and reference number for every call. You will reference it for weeks, and it becomes evidence if a dispute drags on.

Fraud alert vs. credit freeze: know the difference#

People routinely confuse these, and the confusion leaves them exposed. They are not the same tool.

Fraud alert#

A fraud alert is a flag telling lenders to take extra steps to verify your identity before extending credit. It is free, and you only contact one bureau, which is legally required to notify the other two. An initial fraud alert now lasts one year. If you have an Identity Theft Report, you can request an extended fraud alert that lasts seven years. The catch: an alert only asks lenders to verify you. A determined thief can still get through a rushed or careless check.

Credit freeze#

A freeze is the stronger option. It seals your credit file so no new lender can access it at all, which stops new-account fraud cold. The trade-off is friction: a freeze is per-bureau, so you must place it separately at all three, and you have to temporarily "thaw" it (usually with a PIN, often lifting within minutes online) whenever you legitimately apply for credit. For most identity-theft victims, a freeze at all three plus the FTC report is the right combination.

Do not stop at the big three. Consider freezing specialty bureaus too: ChexSystems (used by banks to approve new checking accounts), NCTUE (telecom and utility accounts), and Innovis, sometimes called the fourth credit bureau. Thieves love these because most people never think to lock them.

Why the FTC Identity Theft Report is worth the ten minutes#

An Identity Theft Report from IdentityTheft.gov is not busywork. Under US law it entitles you to specific rights that a simple bank call does not: you can block fraudulent information from appearing on your credit report, place the seven-year extended fraud alert, and get fraudulent debts and inquiries removed without the creditor's cooperation. Businesses are also required to give you copies of records related to accounts the thief opened.

In many cases this report replaces the need for a police report. You may still want to file one locally, especially if a specific creditor demands it or if a physical crime (a stolen wallet, mail theft) was involved, but for most digital identity theft the FTC report carries the legal weight.

The pieces people forget: tax, Social Security, and your phone number#

Bank and credit fraud get the attention, but three quieter attack surfaces cause lasting damage.

Tax identity theft#

If someone files a tax return in your name to steal your refund, file IRS Form 14039, the Identity Theft Affidavit, and request an IP PIN (Identity Protection PIN) at IRS.gov/ippin. The IP PIN is a six-digit number the IRS requires on your return each year, so a thief cannot file without it. Warning sign: an IRS notice about a return you did not file, or being told a return was already filed under your Social Security number.

Social Security number misuse#

Report SSN misuse to the Social Security Administration's Office of the Inspector General at oig.ssa.gov, and check your earnings record through a my Social Security account for jobs you never held, which signals employment fraud. Do not request a new SSN except as a genuine last resort; it orphans your credit history and rarely helps.

SIM swapping and number porting#

If a thief convinces your carrier to move your number to their SIM, they intercept every SMS security code you rely on. Call your mobile provider and add a port-freeze or account PIN (Verizon calls it Number Lock, and every major carrier offers an equivalent). This is also why you should move two-factor authentication off SMS wherever possible; more on that below.

A note if you are not in the United States#

The playbook is the same, only the agencies change.

• United Kingdom: report to Action Fraud (0300 123 2040) and consider Cifas Protective Registration, which flags your file so lenders apply extra checks, for a small fee. The three UK credit reference agencies are Experian, Equifax, and TransUnion.
• Canada: contact the Canadian Anti-Fraud Centre and place alerts with Equifax Canada and TransUnion Canada.
• Australia and New Zealand: IDCARE offers a free, specialist case-management service, and you can report scams to Scamwatch.

Common mistakes that cost victims weeks#

• Placing a fraud alert and assuming you are frozen. An alert only asks lenders to verify you; it does not block new accounts. Freeze if you want a hard stop.
• Freezing only one bureau. Unlike a fraud alert, a freeze does not propagate. All three, or the gap becomes the thief's doorway.
• Skipping the FTC report because the bank "handled it." The bank cannot give you the legal rights the report does.
• Using SMS codes for two-factor. If your number is hijacked, texted codes land in the thief's hands. Use an authenticator app (Google Authenticator, Authy) or a hardware security key instead.
• Trusting the "recovery help" call that arrives days later. Fraudsters resell victim lists and call back posing as your bank or a government agency. No legitimate agency asks for your full password or a gift-card payment.

Protect yourself going forward#

Once the fire is out, a little maintenance keeps it out. Turn on transaction alerts in your banking app for near-instant visibility. Pull your reports free every week from AnnualCreditReport.com, the only federally authorized US source, and read them for accounts or addresses you do not recognize. Adopt a password manager so every account gets a unique password, and enable app-based two-factor on your email, bank, and primary cloud account first.

None of this reflects carelessness on your part. Identity theft targets organized, sensible people every day. Work the steps in order and you take back control one confirmed reference number at a time.

FAQ#

Should I place a fraud alert or a credit freeze?#

Use a freeze if you want to actually block new accounts; it is the stronger tool and free in the US. A fraud alert only asks lenders to verify you and can be bypassed by a rushed check. Many people do both: a freeze at all three bureaus plus an extended fraud alert from their FTC report.

Do I have to file a police report?#

Often no. An FTC Identity Theft Report from IdentityTheft.gov carries the legal weight for most digital identity theft. File a police report if a specific creditor requires one, or if physical property like a wallet, passport, or mail was stolen.

How long does recovery take?#

Simple card fraud can be resolved in days once the bank reverses charges. New-account fraud, tax fraud, or SSN misuse can take weeks to months of follow-up. Keeping a detailed log and every reference number is what shortens it.

Is it safe to freeze my credit if I plan to apply for a loan soon?#

Yes. A freeze is not permanent; you temporarily thaw it with your PIN, usually lifting within minutes online for a set window or a specific lender, then it reseals. The minor inconvenience is worth the protection against new-account fraud.