Identity Theft: What to Do When Your Identity Is Stolen

Identity theft is when someone uses your personal information, such as your Social Security number, card details, or account logins, to open accounts, borrow money, claim benefits, or commit fraud in your name. Recovering means stopping the thief’s access, freezing your credit, and proving to creditors which accounts were never yours. The official starting point in the US is IdentityTheft.gov, and the faster you move, the less damage a thief can do.

How to tell your identity has been stolen

The earliest signs of identity theft are usually small things that do not add up. You might see a charge or an account you never opened, get turned down for credit you expected to qualify for, or notice post going missing (a classic sign someone has redirected your mail). Debt collectors may chase you for debts you do not recognise, or a tax return may be rejected because one was already filed under your number.

When I was scammed, the money was gone within an hour, but the identity damage surfaced for months afterward in exactly these small ways: a card application I had not made, an alert about a login from a city I have never visited. Treat any one of these as a prompt to check all three of your credit reports straight away. For the wider pattern that scams follow, see how scammers find and target you.

What to do first: IdentityTheft.gov

Your single most useful first move is IdentityTheft.gov, the US Federal Trade Commission’s official recovery service. It is free, it asks what happened, and it builds a personalised, step-by-step recovery plan for your exact situation. Critically, it generates an FTC Identity Theft Report: the document that gives you the legal right to have fraudulent accounts blocked and removed, and that creditors and credit bureaus must honour.

This matters because identity theft is one of the most reported fraud categories the FTC tracks each year, and the same agency that records those complaints runs the recovery tool. Print or save your report and reference number; you will use it in every dispute that follows. If money was taken as part of the theft, also report it through ReportFraud.ftc.gov and, for internet crime, the FBI Internet Crime Complaint Center.

Freeze your credit at all three bureaus

A credit freeze is the strongest single thing you can do to stop further damage, and it is free. A freeze blocks new lenders from seeing your credit file, so a thief cannot open new accounts in your name, and federal law guarantees it has no effect on your credit score. You must place it separately with each of the three nationwide bureaus: Equifax, Experian, and TransUnion.

When you apply for credit yourself, you lift the freeze temporarily (also free) and refreeze afterward. A freeze is more protective than a fraud alert, which only asks lenders to take extra steps to verify your identity. For the full walkthrough, see how to freeze your credit. While you are securing your accounts, change passwords on anything affected and turn on two-factor authentication.

Dispute the fraudulent accounts and charges

Once your file is frozen, dispute everything the thief touched. Contact the fraud department of each company where a fraudulent account was opened, in writing, and include a copy of your FTC Identity Theft Report. That report gives you the right to have the fraudulent accounts and debts removed, and to stop the company reporting them. Separately, dispute the same fraudulent entries with each credit bureau so they are deleted from your reports.

For fraud on your existing bank or card accounts, contact the provider immediately: speed is your best chance of reversing a payment, and reporting quickly limits your liability under federal protections. Do not pay any debt that is not yours to make it go away; with your report on file, the lawful path is to have it removed, not settled.

Document everything as you go

Keep a single, dated log of your entire recovery: every call, who you spoke to, every reference number, and a copy of every letter you send and receive. Identity theft can take days for a single charge or months for tangled cases involving loans, tax fraud, or benefits fraud, and the same fraudulent debt can resurface a year later when sold to a new collector.

This is the part I underestimated. The first time a “resolved” account reappeared, my dated notes and FTC report number ended a dispute in one phone call that would otherwise have eaten a week. Send anything important by a method you can prove was delivered, and keep copies of your credit reports before and after so you can show what changed.

Avoid the second hit: recovery scams

Be very wary of anyone who contacts you offering to restore your identity or recover your losses for a fee, because that is frequently a second scam aimed at people already shaken by the first. Legitimate recovery through IdentityTheft.gov and the credit bureaus costs nothing, and no real authority asks you to pay up front to undo fraud.

Scammers buy and trade lists of recent victims precisely because a fresh victim is more likely to grasp at help. If someone pressures you to pay, demands gift cards or crypto, or insists on secrecy, those are the same red flags as the original fraud. See recovery scams: the second wave and the broader what to do if you have been scammed guide.

This is general information, not individual legal, financial, or security advice. If your identity has been stolen, start at IdentityTheft.gov and report the fraud to the proper authorities.