Maybe it started with a data breach letter, a charge you didn't make, or a call about a debt that isn't yours.
Identity theft is stressful.
The good news is that you can recover from identity theft. There are some steps you can take to clean things up, most are free, and many take only a few minutes.
This guide walks you through what to do if you're a victim of identity theft, starting with the steps that matter most.
How Do You Know If Your Identity Has Been Stolen?
Sometimes it's obvious. You find a credit card you never opened, or your tax return is rejected because someone already filed one with your Social Security number.
Other times, the signs are easier to miss. You might notice:
- Charges or withdrawals you don't recognize
- Bills or collection calls for accounts that aren't yours
- Medical bills or insurance statements for care you never received
- Mail that stops arriving
- A notice that your information was part of a data breach
You don't need proof that someone has used your information before you take action. If you think it may have been compromised, it's much easier to act early than to clean up later.
What Should You Do First After Identity Theft?
Start by cutting off the two things a thief needs most: access to your accounts and access to your credit. Once both are secure, move on to your tax records and other statements.
Before you begin, open a notebook or a simple document to track each step. You'll be glad you did.
Download the checklist: Want a one-page checklist you can print and check off? Download our 2026 Identity Theft Recovery Checklist (PDF).
How Do You Strengthen Your Online Security?
Your email account is the master key to your financial life. If a thief controls it, they can reset the passwords on almost everything else.
Which Passwords and Settings Should You Change First?
Change your email password first. Then change the passwords for your bank, credit card, retirement, and investment accounts. Use a strong, unique password for each one. A password manager makes this much easier.
Next, turn on two-factor authentication (2FA) wherever it's offered. If you have a choice, use an authenticator app or a security key. Codes sent by text message are better than nothing, but criminals can intercept them more easily.
How Do You Make Sure a Thief Is Out of Your Email?
A new password keeps a thief from signing in again. But if someone is already signed in to your email, they may still have access. After you change your password:
- Sign out of all sessions and devices, and remove any connected apps you don't recognize.
- Check your forwarding and filter rules. Thieves often set up rules that quietly forward your email to them, or that send bank and credit bureau alerts straight to the trash.
- Confirm your recovery information. Make sure the backup phone number and email address are yours.
How Should You Review Your Financial Accounts?
Check the recent activity in your bank, credit card, retirement, and investment accounts. Look for any transactions you didn't make, even small ones. Thieves often test a card with a tiny purchase first.
Also look for changes to your mailing address, phone number, email, or linked bank accounts. These can be signs that someone has taken over the account.
While you're in each account, turn on alerts for unusual transactions and new login attempts. That way, you'll hear about fraud within minutes instead of spotting it weeks later on a statement.
What Should You Do If Your Mail Stops Arriving?
A thief may have filed a change of address with the U.S. Postal Service so they can collect your statements, new cards, and tax forms.
Contact your local post office and ask whether anyone filed a change of address or mail hold in your name. If they did, ask the post office to cancel it. You can also sign up for free USPS Informed Delivery, which emails you a preview of your incoming mail so you'll notice if something goes missing.
Can Someone Open a Bank Account in Your Name?
Yes. New checking and savings accounts often don't appear on your credit report. Banks usually screen these accounts using reports from ChexSystems or Early Warning Services (EWS). Many large banks use EWS.
Request your free report from both companies. ChexSystems also offers a free security freeze. Contact EWS to review your file and ask what protections it can add.
How Do You Secure Your Credit After Identity Theft?
Of all the steps, this one does the most to prevent new fraud. If a thief can't open new credit in your name, they can do far less damage.
What Is a Credit Freeze and How Do You Place One?
A credit freeze, also called a security freeze, restricts access to your credit report. Most lenders won't approve new credit if they can't see your report.
You need to place a freeze separately with each of the three major credit bureaus: Equifax, Experian, and TransUnion. It's also smart to freeze your file with Innovis, a smaller national bureau that some lenders use.
Federal law makes freezes free. If you request a freeze online or by phone, the bureau must place it within one business day. When you need to lift it, the bureau must do so within one hour of your online or phone request. A freeze doesn't affect your credit score, doesn't stop you from using your current accounts, and doesn't expire.
Is a Credit Lock the Same as a Credit Freeze?
No. Bureau websites often advertise a "credit lock" alongside the free freeze. A lock is a product the bureau offers under its own terms, and many locks are part of a paid subscription.
A security freeze is your right under federal law, and it's always free. On the bureau's website, look for the option labeled "security freeze" or "credit freeze."
What Is the Difference Between a Credit Freeze and a Fraud Alert?
A fraud alert asks lenders to take extra steps to verify your identity. To place one, you only need to contact one bureau, and it notifies the other two. An initial fraud alert lasts one year. If you have an FTC Identity Theft Report, you can place an extended alert that lasts seven years.
A freeze offers stronger protection because it blocks access to your report. Many people use both, but if you're unsure, start with the freeze.
Should You Freeze Your Credit With NCTUE?
It's worth considering. Phone, cable, internet, and utility companies use the National Consumer Telecom and Utilities Exchange (NCTUE). A free NCTUE freeze helps stop thieves from opening a cell phone or utility account in your name.
You can request a freeze at nctue.com or by phone. Save the PIN you receive, because you'll need it to lift the freeze later.
How Often Should You Check Your Credit Reports?
You can get free credit reports from all three major bureaus every week at AnnualCreditReport.com, the official site authorized by federal law.
Look for accounts, addresses, and hard inquiries you don't recognize. If you find fraud, wait until you have your FTC Identity Theft Report before you dispute it. The next section explains why.
How Do You Report Identity Theft?
What Is IdentityTheft.gov?
IdentityTheft.gov is the Federal Trade Commission's official website for identity theft victims. You describe what happened, and the site creates an FTC Identity Theft Report and a personal recovery plan. If you create an account, it also tracks your progress and fills in letters for you.
In many cases, this report is all you need. You may still want to file a police report if you know who stole your identity or if a creditor asks for one.
How Do You Remove Fraudulent Accounts From Your Credit Report?
When you dispute a fraudulent account, include your FTC Identity Theft Report and send it to each credit bureau that lists the account. With the report, federal law requires the bureau to block the fraudulent information within four business days. Without it, your dispute goes through a slower, standard review.
Also send the report to the fraud department of each company where a fraudulent account was opened. Disputing with the credit bureaus alone won't stop the company from trying to collect the debt or reporting the account again.
How Quickly Do You Need to Report Fraud to Protect Your Money?
As soon as you find suspicious activity, contact your bank or card issuer. Use the phone number on your card or on the company's official website. Ask them to close the affected account, reverse any unauthorized charges, and issue new account or card numbers.
Speed matters. Under federal law, how much you can lose depends on how quickly you report the problem:
- Debit cards and bank accounts: If you report a lost or stolen debit card within two business days, your liability is limited to $50. After that, it can rise to $500. If you don't report unauthorized transfers within 60 days after your statement is sent, you could lose all the money taken after that point, with no upper limit.
- Credit cards: Your liability is limited to $50, and many issuers offer zero liability. To dispute a billing error under federal law, you generally need to send written notice within 60 days of the statement date.
Because the rules for debit cards are stricter, contact your bank first. After each call, follow up in writing or through the company's dispute portal.
How Do You Protect Your Government and Tax Records?
Why Should You Create a "my Social Security" Account?
If you don't have a "my Social Security" account at ssa.gov, a thief could create one in your name, then redirect your benefits or change your information. Creating your own account first helps prevent this, whatever your age.
What Is an IRS Identity Protection PIN?
An Identity Protection PIN (IP PIN) is a six-digit number known only to you and the IRS. Once you have one, any federal return filed with your Social Security number must include it, or the IRS will reject the return.
If you have a Social Security number or ITIN and can verify your identity, you can get an IP PIN through the "Get an IP PIN" tool on IRS.gov. A few things to know:
- Your IP PIN changes every year, so you'll get a new one each January.
- If you file jointly, each spouse needs their own.
- The IRS will never call, email, or text you to ask for your IP PIN.
What Should You Do If Your Tax Return Was Rejected?
An IP PIN protects future returns. It doesn't fix a fraudulent return that someone has already filed.
If your e-filed return is rejected because someone already used your Social Security number, file a paper return and attach IRS Form 14039, the Identity Theft Affidavit. Pay any tax you owe by the normal due date. If you received an IRS notice, follow its instructions, and tell your tax preparer right away.
Why Should You Review Medical Bills and Insurance Statements?
A thief may use your health insurance to get medical care or prescriptions. This can cost you money and put false information in your medical records.
Check your Explanation of Benefits (EOB) statements for visits or prescriptions you don't recognize. If something looks wrong, contact your insurer and the provider listed on the statement.
Who Should You Keep Informed During Recovery?
You don't have to handle this alone. Consider sharing your account alerts with a trusted family member or your financial advisor. Many banks and brokerage firms also let you name a trusted contact person they can reach if they notice suspicious activity.
If you own a business, check your business accounts and business credit reports too. If you think your Employer Identification Number (EIN) was exposed, talk with your accountant.
Why Is Record-Keeping So Important?
Recovery can take weeks or months, and you may deal with many different companies and agencies. Each time you contact one, write down the date, the company, the person you spoke with, any confirmation or case numbers, and the next steps.
Keep copies of all letters, reports, and emails in one secure folder. If you ever need to dispute a debt or prove when you reported the fraud, these records will save you time.
How Long Does It Take to Recover From Identity Theft?
It depends on how your information was used. A few charges on an existing card may take only days to fix. New accounts or a fraudulent tax return can take many months.
That's why it pays to act quickly. The steps above help you recover, and they also help keep the problem from getting worse.
How Does Identity Protection Fit Into Your Financial Plan?
Many of these recovery steps also work well as prevention. Keep your credit frozen when you're not applying for credit, get a new IP PIN each year, use a password manager and 2FA, and keep your alerts turned on.
Protecting what you've built is part of a good financial plan.
Frequently Asked Questions About Identity Theft Recovery
What is the first thing to do if your identity is stolen?
Secure your email and financial accounts with new passwords and 2FA. Then freeze your credit with Equifax, Experian, and TransUnion, and file a report at IdentityTheft.gov.
Does a credit freeze hurt your credit score?
No. A freeze doesn't affect your score. You can still use your current accounts and check your own credit reports.
Is a credit lock better than a credit freeze?
Not usually. A freeze is free and protected by federal law. A lock is a bureau product with its own terms, and many locks come with a monthly fee.
Should I pay for an identity theft protection service?
It depends. The most effective protections, such as credit freezes, weekly credit reports, and IP PINs, are free. Some paid services add monitoring or recovery help, so compare what's included before you buy.
Can a thief open a bank account in my name if my credit is frozen?
It's possible, because many banks check ChexSystems or Early Warning Services instead of the major credit bureaus. Review your reports from both companies and place a freeze with ChexSystems.
What should I do if someone filed a tax return in my name?
File a paper return and attach IRS Form 14039, the Identity Theft Affidavit. If you received an IRS notice, follow its instructions.
How do I know if my child's identity has been stolen?
Most children don't have a credit report, so having one can be a warning sign. If you receive credit offers, bills, or collection notices in your child's name, contact each of the three credit bureaus to check. You can also freeze your child's credit file.
This article is for informational and educational purposes only and isn't intended as legal, tax, or financial advice. Your situation is unique, so please consult a qualified professional before making decisions. Elevation Financial LLC is a registered investment advisor. Registration doesn't imply a certain level of skill or training.
