If Your Information Was Just Stolen — Start Here
Go to IdentityTheft.gov (official FTC site) right now. File a report and follow their personalized recovery plan. Then return to this guide for the full context on each step.
File an FTC Identity Theft Report at IdentityTheft.gov
The FTC's IdentityTheft.gov creates an official report of the theft, generates a personalized recovery plan, and creates pre-filled dispute letters you can send to creditors and credit bureaus. This report is legally equivalent to a police report for most creditor dispute purposes. Do this first — it gives you a foundation for every other step.
The FTC report gives you the right to: place a free extended fraud alert on your credit files, get free copies of your credit reports, dispute fraudulent accounts, and block fraudulent information from your credit report under the Fair Credit Reporting Act.
Go to IdentityTheft.gov →Place a Fraud Alert or Credit Freeze at All Three Bureaus
Fraud Alert: Free, lasts 1 year (7 years with an FTC report). Requires creditors to take extra steps to verify your identity before opening new credit. Filing at one bureau requires them to notify the others automatically.
Credit Freeze (Security Freeze): Stronger protection — completely blocks new credit from being opened in your name until you temporarily lift the freeze. Free under federal law since 2018. Must be placed at each bureau separately. Highly recommended if you believe someone is actively trying to open accounts in your name.
The difference: A fraud alert is a warning. A credit freeze is a lock. Use the freeze if you're concerned about new account fraud; use the alert if you primarily want to dispute existing fraudulent accounts.
Get Your Free Credit Reports from All Three Bureaus
Go to AnnualCreditReport.com (the only official free credit report site — not to be confused with commercial credit monitoring services with similar names). Download your reports from Experian, TransUnion, and Equifax. Review every account for:
- Accounts you don't recognize
- Inquiries (hard pulls) you didn't authorize
- Addresses you never lived at
- Employers you never worked for
- Incorrect personal information
Tip: Identity theft victims are entitled to free reports every 12 months from each bureau regardless of whether you've already used your annual free report.
Contact Each Affected Creditor's Fraud Department
For every fraudulent account you found, call the creditor's fraud department (not their general customer service line — ask for fraud specifically). You'll need your FTC report and government-issued ID. Tell them the account was opened fraudulently, ask them to close the account, and request a fraud investigation. Get a reference number for every call.
Under the Fair Credit Billing Act, you are not responsible for fraudulent charges on accounts you didn't open. Get confirmation in writing that the fraudulent debt will not be collected against you.
Change All Passwords — Starting with Email
Your email account is the master key to your identity. Password resets from every other service go to your email. If your email is compromised, everything reachable from it is compromised. Change it first, enable two-factor authentication, then change passwords for:
- Banks and credit card accounts
- Investment and retirement accounts
- Social Security account (ssa.gov)
- IRS account (irs.gov) — prevent fraudulent tax returns
- Government accounts (DMV, voter registration, benefits)
- Healthcare portals and insurance accounts
- Any account linked to a stolen payment method
Use a password manager to generate unique, strong passwords for each. See our 1Password vs Bitwarden comparison for recommendations.
File a Police Report (for Certain Types of Fraud)
A police report is not always required, but it's useful if: your physical documents were stolen (wallet, ID, Social Security card), you have a specific perpetrator, or a creditor requires it for dispute resolution (some do, especially for larger fraudulent accounts). File with your local police department and get the report number. Some creditors require an actual police report number rather than just the FTC report.
Dispute Fraudulent Items on Your Credit Reports
File disputes with each credit bureau that shows the fraudulent account or inquiry. You can dispute online (faster), by phone, or by certified mail. Include copies of your FTC report and ID. Under FCRA, bureaus must investigate and respond within 30 days. If the creditor cannot verify the account is legitimate, it must be removed. Track every dispute with the reference number and a copy of what you sent.
Report to the IRS if Tax-Related Fraud is Suspected
Tax identity theft — when someone files a fraudulent tax return using your SSN — is increasingly common. Signs: an IRS notice that multiple returns were filed under your SSN, unexpected refund, or inability to file because a return has already been accepted. If you suspect tax fraud, file IRS Form 14039 (Identity Theft Affidavit). The IRS will assign you an IP PIN (identity protection personal identification number) for future filing.
Contact the IRS Identity Protection Specialized Unit: 800-908-4490.
Monitor Your Credit and Accounts Monthly
Identity theft recovery is not a one-time event. Thieves who have your information may use it weeks or months after the initial theft. For at least 12 months after an incident:
- Check your credit reports monthly (free via AnnualCreditReport.com)
- Review all financial account statements weekly
- Watch for new collection notices or unexpected bills
- Check for unauthorized medical claims if your insurance information was stolen
- Review your Social Security earnings record annually at ssa.gov
Consider an identity monitoring service during the recovery period. See our Aura vs LifeLock comparison for options — many offer SSN monitoring, dark web scanning, and $1M insurance that covers recovery costs.
Credit Bureau Fraud Departments
Equifax
equifax.com/personal/credit-report-services/free-credit-freeze
Experian
experian.com/freeze/center.html
TransUnion
transunion.com/credit-freeze
If Your Social Security Number Was Stolen
Contact the Social Security Administration (SSA) at 1-800-772-1213. In rare cases of extreme misuse, the SSA can issue a new SSN — but this is genuinely a last resort because it doesn't erase your old SSN's history and can create new complications with employment verification, credit history, and government records. The more effective approach is placing a credit freeze and fraud alert, which blocks misuse of the SSN even without replacing it.
Preventing the Next Incident
Once you've recovered, these four actions dramatically reduce future risk:
- Leave your credit frozen permanently. You only need to temporarily lift the freeze when applying for new credit — a 5-minute process. Being frozen by default eliminates new account fraud risk entirely.
- Use a password manager with unique passwords everywhere. The majority of identity theft stems from reused passwords exposed in data breaches. See our 1Password vs Bitwarden comparison.
- Enable two-factor authentication on all financial accounts. Ideally with an authenticator app (Google Authenticator, Authy) rather than SMS.
- Monitor with an identity protection service. Services like Aura scan the dark web, monitor your SSN across credit applications, and alert you immediately when your information appears where it shouldn't.
Official FTC resource: IdentityTheft.gov has a step-by-step personalized recovery plan that generates pre-filled dispute letters and tracks your recovery progress. It's free and maintained by the FTC.
Frequently Asked Questions
How do I know if my identity has been stolen?
Early warning signs: unexplained charges on bank/credit card statements, bills for services you didn't sign up for, calls from debt collectors about unknown debts, being denied credit unexpectedly, or tax filing rejections (someone filed using your SSN). Check your free credit reports at AnnualCreditReport.com — you're entitled to one free report from each of the three bureaus annually. A credit monitoring service like Aura or Credit Karma will alert you in near-real-time when new accounts are opened in your name.
What's the first thing to do after identity theft is discovered?
Immediately freeze your credit at all three major bureaus (Equifax, Experian, TransUnion) — this prevents new accounts from being opened. File an identity theft report at IdentityTheft.gov, which generates a personalized recovery plan and official FTC report you'll need for disputes. Report to local police if you know the thief or need an official report for creditors. Then work through the FTC's recovery plan to dispute fraudulent accounts and correct your credit file.
How long does identity theft recovery take?
Simple cases (one unauthorized account) can be resolved in a few weeks. Complex cases involving tax fraud, medical identity theft, or criminal identity theft (someone used your identity during arrest) can take 6 months to several years. The FTC estimates the average identity theft victim spends 200 hours over 6 months resolving the problem. Identity theft protection services like Aura or LifeLock with restoration assistance can dramatically cut this time by handling disputes and paperwork on your behalf.
Will a credit freeze hurt my credit score?
No — a credit freeze has zero impact on your credit score. It only prevents new creditors from accessing your credit report to open new accounts. Your existing accounts are unaffected. You can temporarily lift a freeze (thaw) when applying for new credit, which takes minutes online. Freezes are free to place and lift under federal law (Economic Growth Act, 2018). You must freeze separately at Equifax, Experian, and TransUnion — and optionally at Innovis and ChexSystems if you're concerned about bank account fraud.
Is identity theft protection insurance worth it?
The insurance component (typically $1M in coverage) sounds impressive but covers mostly legal fees and lost wages — not direct financial losses from theft, which banks and credit card companies typically cover anyway under zero-liability policies. The real value of paid services like Aura ($12/mo) or LifeLock ($11–$25/mo) is the monitoring (dark web, court records, address changes) and restoration assistance (someone else handles the dispute calls and paperwork). If you value your time, the $15/month for full-service monitoring is reasonable. Free credit freezes plus AnnualCreditReport.com checks are the budget alternative.
Don't let it happen again — Aura monitors your identity 24/7
SSN monitoring, dark web alerts, credit freeze support, and $1M identity theft insurance. If your info surfaces anywhere online, you'll know in minutes. Rated 9.2/10.