When You Discover the Theft
Identity theft often reveals itself through unexpected credit card charges, collection calls for debts you never incurred, denial of a loan application you expected to be approved, unfamiliar accounts on your credit report, or IRS notices about tax returns you did not file. The moment you suspect identity theft, speed becomes critical. Every hour of delay gives the criminal more time to cause damage.
Take a deep breath. This is recoverable. Millions of people have navigated this process successfully. Follow these steps in order.
Step 1: Document Everything
Before you take any action, start a log. Record dates, times, and details of every fraudulent transaction or account you discover. Save screenshots, letters, and statements. This documentation will be essential for disputes, police reports, and insurance claims.
Create a dedicated folder, physical or digital, for all identity theft correspondence. You will reference it repeatedly over the coming weeks and months.
Step 2: Place Fraud Alerts and Credit Freezes
Contact one of the three major credit bureaus to place a fraud alert. That bureau is required to notify the other two.
- Equifax: 1-800-525-6285
- Experian: 1-888-397-3742
- TransUnion: 1-800-680-7289
Then place a credit freeze at all three bureaus plus Innovis and ChexSystems. A fraud alert lasts one year. A freeze remains until you lift it. Use both.
Step 3: File an FTC Identity Theft Report
Visit IdentityTheft.gov and complete the FTC's identity theft report. This generates a personalized recovery plan and an official Identity Theft Report that carries legal weight. Creditors and credit bureaus are legally required to honor this report when you dispute fraudulent accounts.
The FTC report also generates pre-filled letters you can send to creditors and debt collectors.
Step 4: File a Police Report
Visit your local police department and file a report. Bring your FTC Identity Theft Report, a government-issued ID, proof of your address, and documentation of the fraudulent activity. Some jurisdictions allow online filing.
A police report strengthens your position with creditors and is required by some institutions before they will remove fraudulent accounts.
Step 5: Contact Affected Financial Institutions
Call the fraud departments of every institution where fraudulent accounts were opened or existing accounts were compromised:
- Credit cards: Request the accounts be closed and new cards issued. Ask for written confirmation that fraudulent charges have been removed
- Bank accounts: Close compromised accounts and open new ones with new account numbers. Review all recent transactions
- Loans: Contact the lender's fraud department with your FTC report and police report. Request the fraudulent loan be removed from your record
- Investment accounts: Notify your brokerage and request enhanced security measures
Step 6: Dispute Fraudulent Items on Credit Reports
Request free copies of your credit reports from all three bureaus at AnnualCreditReport.com. Review each one carefully and identify every item you did not authorize.
File disputes for each fraudulent item with each bureau that reports it. Include your FTC Identity Theft Report. Under federal law, the bureaus must investigate and remove confirmed fraudulent items within 30 days.
Step 7: Address Tax-Related Identity Theft
If someone filed a tax return using your Social Security number, file IRS Form 14039 (Identity Theft Affidavit). Respond to any IRS notices promptly. The IRS will issue you an Identity Protection PIN for future tax filings.
State tax agencies may require separate notifications. Contact your state's department of revenue.
Step 8: Secure Your Accounts Going Forward
- Change passwords on all financial, email, and social media accounts. Use unique passwords for each account
- Enable two-factor authentication everywhere possible, preferring authenticator apps over SMS
- Review account recovery options and remove any phone numbers or email addresses you do not recognize
- Monitor your credit reports monthly for at least the next year
Step 9: Consider an Extended Fraud Alert or Identity Theft Protection
Victims of confirmed identity theft are entitled to an extended fraud alert lasting seven years. Submit your FTC Identity Theft Report to the credit bureaus to activate this.
Some victims benefit from identity theft protection services that provide ongoing credit monitoring, dark web surveillance, and insurance coverage for recovery expenses.
How Long Does Recovery Take?
Simple cases where the theft is caught early may be resolved in a few weeks. Complex cases involving multiple fraudulent accounts, tax fraud, or criminal identity theft can take six months to a year or longer. Persistence and documentation are your best allies.
Preventing Future Theft
Once you have recovered, maintain a credit freeze, use a password manager, monitor your accounts regularly, and stay informed about breaches that expose your personal data.
Check LeakedSource regularly to monitor for new breaches involving your email or personal information, so you can act before stolen data leads to identity theft.