Your Identity Was Stolen: The First Seven Steps

Before the steps, one reassurance worth holding onto: you are almost certainly not on the hook for most of the fraud. Federal law caps your liability for unauthorized credit card charges at $50, and if you report the card before it’s used, you owe nothing. Under most state laws you aren’t responsible for debts run up on brand-new accounts a thief opened in your name without your permission. Identity theft is also one of the most common crimes in the country — millions of people go through this every year and come out the other side with their credit and finances restored. The damage feels enormous on day one, but it is recoverable. Your real enemies now are delay and disorganization, not the thief. So let’s get organized and move.

First, Breathe — Then Move Fast

Speed genuinely matters in the first hours and days, because the sooner you act, the less a thief can do and the easier each problem is to unwind. But fast doesn’t mean frantic. As you work through the steps below, do one thing above all else: keep records of everything. Start a simple document or notebook and log every call (the date, the company, who you spoke to, what they said), save every letter and email, and keep copies of every report and dispute you file. This paper trail is what turns a chaotic emergency into a manageable checklist, and you’ll lean on it repeatedly as you prove to banks and bureaus that the fraud wasn’t yours.

Step 1: Call the Companies Where the Fraud Happened

Start where you can see the damage. Call the fraud department of any company where you know fraud occurred — the bank with the strange withdrawal, the card issuer with charges you didn’t make, the store where an account was opened in your name. Tell them plainly that you’re a victim of identity theft, and ask them to close or freeze the affected accounts so no new charges can be added without your approval. While you have them on the line, change the login, password, and PIN on those accounts. The FTC notes you may need to contact some of these companies again later, once you have an official Identity Theft Report (that’s Step 3) — but stopping the active bleeding comes first.

Step 2: Place a Fraud Alert and Pull Your Credit Reports

Next, slow the thief down across the whole credit system. Contact just one of the three credit bureaus — Equifax, Experian, or TransUnion — and place a fraud alert. By law, the bureau you contact must notify the other two, so one call covers all three. A fraud alert is free, lasts one year, and forces any business to verify your identity before opening new credit in your name, which makes it much harder for the thief to keep going.

Then get your free credit reports from all three bureaus at AnnualCreditReport.com — the only official free source — and read them carefully. You’re hunting for anything that isn’t yours: accounts you never opened, inquiries from lenders you never approached, addresses you’ve never lived at. Note every item that doesn’t belong, because you’ll need that list in the next step. You can now check these reports for free every week, which is worth doing repeatedly as you recover.

Step 3: Report It at IdentityTheft.gov

This is the keystone step, and the single most valuable thing you can do. Go to IdentityTheft.gov, the FTC’s dedicated recovery site, and report what happened. You’ll answer questions about the theft and the fraudulent items you found on your credit reports, and in return the site generates three things that make everything else possible: an official FTC Identity Theft Report (your legal proof that someone stole your identity), a personalized recovery plan with step-by-step guidance for your specific situation, and prefilled letters you can send to creditors and bureaus to dispute the fraud.

That Identity Theft Report is your master key for the rest of the process. It’s what lets you compel businesses to remove fraudulent charges, close accounts opened in your name, and block the bad debts from your credit file. Create a free account on the site so you can save your progress, update your plan as you complete tasks, and return to your documents whenever a creditor asks for proof. If you do nothing else on this list today, do this.

Step 4: Decide on a Credit Freeze

A fraud alert slows new credit down; a credit freeze stops it cold. A freeze locks your credit reports so that no one — not a thief, and not even you — can open new credit until you lift it. It’s free to place with each of the three bureaus and free to lift temporarily whenever you legitimately need to apply for credit yourself. Because it’s the stronger protection, many experts recommend a freeze for anyone actively dealing with identity theft. The one trade-off is a small amount of friction: you’ll need to remember to thaw it (briefly and for free) before applying for a loan, a card, or sometimes a new utility or phone plan. For most victims, that minor inconvenience is well worth the much tighter lock on their credit.

Step 5: Close Fraudulent Accounts and Dispute the Charges

Now you do the cleanup, armed with your Identity Theft Report and the sample letters from IdentityTheft.gov. Work through every fraudulent item you found. Close any new accounts the thief opened in your name by calling each company’s fraud department and sending them your Identity Theft Report. Remove fraudulent charges on your existing accounts the same way. And dispute the bad entries with the three credit bureaus so the fraudulent accounts and debts are blocked from your credit file. Your recovery plan walks you through each of these with the right letter for each situation.

Keep that liability reassurance in mind as you go: you generally are not legally responsible for debts a thief racked up on accounts they opened without your permission, and your exposure on misused credit cards is sharply limited by law. This step can take patience — some companies move slowly, and you may have to follow up more than once — but every fraudulent item you knock out is a permanent repair. Log each call and keep every confirmation.

Step 6: Lock Down the Specific Systems That Were Hit

Some kinds of identity theft reach beyond your credit cards and need their own targeted response. Handle whichever apply to you.

Tax identity theft. If someone used your Social Security number to file a tax return and grab your refund — often discovered when your own e-filed return is rejected as a duplicate — respond to the IRS. You can file IRS Form 14039, the Identity Theft Affidavit (you can even do it through IdentityTheft.gov, which forwards it to the IRS), and your case goes to the IRS’s Identity Theft Victim Assistance team. Just as importantly, get an Identity Protection PIN (IP PIN) at irs.gov/ippin — a six-digit code, refreshed each year, that blocks anyone from e-filing a return under your SSN without it. Any taxpayer can request one, and it’s one of the strongest defenses against tax fraud.

A misused Social Security number. If your SSN is being used fraudulently, report it through IdentityTheft.gov and review your earnings record with the Social Security Administration for income that isn’t yours. A police report. You may want or need to file one with local law enforcement — especially if you know the thief, or if a particular creditor requires it. Bring your FTC Identity Theft Report and a photo ID; together they form what’s called an Identity Theft Report that carries extra weight with companies.

Step 7: Secure Your Accounts and Keep Watching

The thief got in once; your final step is to make sure they can’t again. Change your passwords — starting with your email, since it’s the reset key to everything else — and make each one long and unique, ideally with the help of a password manager so you’re not reusing a single password anywhere. Turn on multi-factor authentication on every account that offers it, so a stolen password alone is no longer enough to log in. Then settle into a habit of vigilance: keep checking your free credit reports weekly for a while, watch your bank and card statements closely, and stay alert for a second wave — identity-theft victims are frequently targeted again, sometimes by “recovery” scammers who promise to retrieve your money for a fee. Treat any such offer as a fresh scam.

Match the Theft to the Right Place to Report

You’re Not Liable for Most of It — and It’s Fixable

It’s worth repeating, because in the thick of it the fear can convince you otherwise: the money a thief stole or borrowed in your name is, in the great majority of cases, not a debt you’ll be left holding. The legal protections exist precisely because identity theft is so common, and the recovery system — from IdentityTheft.gov’s reports and letters to the bureaus’ dispute processes — is built to put the burden back where it belongs. What you’re really doing over these seven steps is documentation and persistence: proving the fraud wasn’t you, item by item, until your records are clean again.

It can take weeks or occasionally months to fully untangle, and that’s normal — don’t be discouraged if a single bad account takes a few rounds to clear. Hold onto your call log and your paperwork the entire time, follow your IdentityTheft.gov recovery plan task by task, and check items off as you go. The mountain shrinks faster than it feels like it will on day one.

This article is for general guidance and isn’t legal advice; your situation may need additional steps. For official, personalized recovery help, use the FTC’s IdentityTheft.gov, and for tax-related identity theft see the IRS. Get free credit reports only at AnnualCreditReport.com.