What to Do If Identity is Stolen

The first 72 hours after discovering identity theft are the most critical. Acting quickly limits the damage and establishes the documentation you'll need throughout recovery. Here's exactly what to do.

Step 1: Freeze Your Credit Immediately

Before anything else: freeze your credit at all three bureaus online. This prevents any new accounts from being opened in your name — even while you're still figuring out what happened. Each bureau has a free online freeze portal that activates within minutes:

• Equifax: equifax.com → Security Freeze
• Experian: experian.com/freeze
• TransUnion: transunion.com/credit-freeze

Do this first. Everything else can wait an hour. A freeze costs nothing, takes 5 minutes per bureau, and can be reversed instantly when needed.

Step 2: File Your FTC Report

Go to IdentityTheft.gov and create an Identity Theft Report. This is a free service run by the FTC that creates official documentation of the theft and gives you a personalized recovery plan. Keep the report number — you'll need it for every creditor and bureau you contact.

Step 3: Identify What Was Compromised

Determine what was stolen or misused:

• New accounts opened in your name (pull all three credit reports)
• Existing accounts accessed or drained (review bank and card statements)
• Email or social media accounts hacked
• Tax return filed fraudulently (check IRS.gov transcript)
• Benefits or employment records accessed (Social Security, unemployment)

Each type requires different remediation steps. Your FTC report recovery plan will guide you through the specific steps for each type.

Step 4: Secure Your Existing Accounts

Change passwords and enable two-factor authentication on all financial accounts, email, and any account with access to financial information. Use a different, strong password for each account. A password manager (1Password, Bitwarden, Dashlane) makes this manageable.

Step 5: Contact Each Affected Institution

For each fraudulent account: contact the creditor's fraud department (not general customer service), provide your FTC report number and police report number, request account closure, request removal of any balance in your name, and ask for written confirmation.

Keep a log of every call: date, time, name of representative, what was said, and any reference numbers provided.

Step 6: Place Extended Fraud Alert

With your FTC report, you qualify for a 7-year extended fraud alert (vs. 1-year standard). Place this at each bureau. Extended alerts require lenders to verify your identity before approving new credit — significantly harder for thieves to bypass than a standard alert.

See the complete multi-week recovery plan at: Identity Theft Recovery Checklist