If money is already leaving an account, call the bank before you spend a day reconstructing how the thief got in. Secure the money and the email that resets it.
This is for U.S. consumers. Tax returns, credit cards, bank transfers, and government IDs each take a different path.
Turns out, the basic protections are free. Matching each claim to the payment type is the part that actually takes work.
Where do you start if money is already moving?
Start with containment
Call the bank first if money is leaving the account right now. Finish the rest of the paperwork after that call.
Grab a number you already trust. Pull it from a statement or the institution's official website, not from a link in a suspicious text.
- Protect the active account. Ask whether the bank, card issuer, or payment provider should block the account, issue a new number, stop pending activity, or open a fraud claim.
- Secure your email and devices. From a safe device, change your email password, then the passwords on financial accounts. Turn on multifactor authentication. Remove recovery phone numbers and email addresses you don't recognize.
- Freeze your credit. Contact Equifax, Experian, and TransUnion separately. The FTC says credit freezes are free and remain in place until you tell the bureaus to remove them. See the FTC guidance on credit freezes and fraud alerts.
- Report the theft. File through IdentityTheft.gov and save the report plus the recovery recommendations it produces. Ask local law enforcement about a police report if a company, insurer, or agency requests one.
- Create a case log. Note each institution, date, representative, case number, promised action, and follow-up date.
Banks can tell you what they need. Don't wait for perfect evidence.
Build an official paper trail
Records arrive in a jumble. One statement names a merchant you've never heard of, the next lists an address you never used, and a third account surfaces only after you pull a credit report you hadn't looked at in years. Keep a folder for each account. One mixed pile will bury the dates you need.
| Keep | Record alongside it |
|---|---|
| FTC identity theft report | Completion date and saved copy |
| Police report, if available | Agency name and case number |
| Bank and card statements | Transaction dates, amounts, and reference numbers |
| Emails, letters, and notices | Sender, date, and requested response |
| Dispute submissions | Delivery proof and confirmation number |
Send copies, not originals, unless an agency specifically asks you to mail an original document instead of a photocopy.
Your FTC report can support disputes. It doesn't automatically force every company to erase an account. A business may still request extra identity documents or its own fraud form.
Match the dispute to the payment rail
A credit card charge, a debit transaction, and a wire transfer can look alike on a statement. The process is not the same.
| Where the fraud happened | What to do | Timing or limit to remember |
|---|---|---|
| Credit card charge | Call the issuer, block or replace the card, and send a written billing-error notice | Under the FTC billing-error process, the issuer must receive the written notice within 60 days after the first bill showing the error |
| Debit card or bank-account transfer | Notify the bank immediately and ask how to submit an unauthorized electronic-transfer claim | Credit-card deadlines do not automatically apply; prompt notice can affect the available protections |
| Wire or peer-to-peer transfer | Contact the provider and sending bank immediately, then ask whether a recall or fraud review is possible | Recovery depends on the transfer type, authorization, and how quickly you report it |
| Fraudulent loan, utility account, or collection account | Write to the company that opened or reported the account and state that you did not authorize it | Keep the response in writing and follow any deadline in the notice |
A phone call can stop more charges. Written notice is a separate requirement. Thing is, that written clock can run out while you're still on hold.
The FTC's credit card dispute guidance says the issuer generally must acknowledge a written billing-error complaint within 30 days unless it already resolved the issue. It must resolve the dispute within 90 days.
Mail the letter to the billing-dispute address on the statement, which is not always the payment address, and keep a copy plus proof of receipt. Name the transaction in plain language, say why it was unauthorized, and attach only the records that help, without extra personal details.
Ask the provider for its exact claim process if the problem is a bank transfer, debit transaction, wire, or peer-to-peer payment. Don't borrow the credit-card 60-day rule for a different payment type.
Freeze, alert, and review your credit
A freeze won't close an existing account, reverse a transfer, or fix a wrong entry. You still have to dispute fraudulent information.
It can restrict access to your credit report for many new-credit applications. That's what it's for.
| Tool | When it helps | What to remember |
|---|---|---|
| Credit freeze | You want a strong barrier against new credit opened in your name | Place it with all three bureaus; it remains until you request removal |
| Fraud alert | You want businesses to take additional identity-check steps before extending credit | The FTC says you can contact one of the three bureaus to place an alert |
| Credit monitoring | You want notices about changes or new activity | Alerts do not replace a freeze, a dispute, or a fraud claim |
If you aren't applying for credit soon, a freeze is usually the stronger choice. Follow the bureau's instructions for a temporary lift when you need a new loan or card, then restore the freeze afterward.
The FTC says a fraud alert can be renewed, but renewal may require you to resubmit an FTC identity theft report or police report. Check the bureau's current instructions before relying on an alert alone.
Pull all three reports through AnnualCreditReport.com. Scan them for unfamiliar accounts, hard inquiries, addresses, employers, and collection entries you never authorized. Accounts in your name that you don't recognize can be a sign of identity theft.
Dispute an inaccurate entry with the bureau that shows it and with the business that supplied the information, and include the account details plus a clear explanation. Attach copies of records and your FTC report when asked. Keep the submission and the response.
Tax identity theft follows a separate route
Stay on the IRS path if someone used your Social Security number on a fake federal return. Don't treat it like a card dispute. Review the IRS guidance on when to file Form 14039.
The IRS says taxpayers may complete Form 14039 online or use the paper form and submit it by mail or fax, following the instructions for their situation. You can't treat Form 14039 as a fix for every stolen Social Security number. It's tied to tax-related identity theft and certain IRS instructions.
An IRS notice may direct you to verify your identity, sometimes at a Taxpayer Assistance Center. Follow the notice instead of sending duplicate forms. The IRS identity theft assistance page warns that duplicate Forms 14039 and repeated status inquiries can cause delays.
The IRS describes a general 120-day resolution timeframe, but also warns that some cases take longer. Treat that figure as general guidance, not a guaranteed completion date.
Contact the state tax agency separately if a state tax return is affected, because a federal Form 14039 doesn't replace a state process.
Replace government IDs carefully
Replacing a document may reduce the chance that someone reuses it. It doesn't repair fraudulent accounts by itself.
| Document | Where to start | Important limit |
|---|---|---|
| Social Security card | Social Security Administration replacement process | A replacement card normally keeps the same SSN; a new number is considered only in limited circumstances involving ongoing problems |
| Driver license or state ID | The issuing state's DMV | Required documents, fees, and processing times vary by state |
| U.S. passport | U.S. Department of State lost or stolen passport process | Report and replacement instructions depend on the document and your travel needs |
A stolen Social Security card does not automatically qualify you for a new number. Focus first on correcting accounts, securing your credit, and reporting any misuse to SSA.
Ask the DMV if it can flag or replace a compromised license. Use the State Department's current instructions for a passport, especially if travel is coming soon. Save every confirmation or receipt from the issuing agency.
Don't rely on old estimates such as a fixed number of days for every replacement. Agency schedules change. State requirements are not uniform.
Know which timelines actually matter
Recovery rarely moves in one clean line, because one account may be handled while an IRS case or mixed credit file remains open. Plan around each clock on its own.
| Task | Timeline you can plan around |
|---|---|
| FTC identity theft report | Complete it as soon as possible and save the report when available |
| Credit freeze | No expiration; it stays until you ask the bureau to remove it |
| Written credit card billing-error dispute | Notice must reach the issuer within 60 days; acknowledgment is generally due within 30 days and resolution within 90 days |
| IRS identity theft case | The IRS describes 120 days as a general timeframe, but longer cases are possible |
| Government document replacement | Use the issuing agency's current estimate; state and federal schedules differ |
| Credit-report disputes | Track each bureau and furnisher separately; keep delivery proof and every response |
No single average covers every identity theft case. The number of accounts, type of misuse, tax involvement, missing documents, and response from each company can all change the schedule.
Set calendar reminders after every submission. Follow up with the case number and your delivery proof if a promised response does not arrive.
Check insurance before paying for help
Look at homeowners or renters insurance, employer benefits, and any coverage sitting on a card or bank account before you pay for a recovery plan. Some of that help may already be there.
You'll want the deductible, the limits, the exclusions, the claim deadline, and the documents they expect, because an insurer may request an FTC report, a police report, statements, or receipts, and you'll need the claim number later.
Paid identity monitoring is optional. Alerts, restoration support, or insurance can come with a plan. An alert still doesn't freeze your reports, reverse a transfer, or prove a crime.
Check the monthly or annual price, automatic renewal, cancellation steps, insurance terms, data-sharing practices, and family coverage before you enroll. You don't need a paid service to file an FTC report, place credit freezes, or send basic disputes.
To be honest, a recovery company may organize paperwork for you, but no legitimate service can guarantee a faster investigation, a higher credit score, or removal of accurate information.
When a company refuses to fix the problem
Get the refusal in writing.
Name the fraudulent account or transaction in the follow-up letter, repeat the earlier case number, state the correction you want, and list every record you attached. Use the company's documented dispute channel. Save the delivery confirmation.
File through its formal complaint process if the company still reports the account or ignores the claim, then contact the relevant regulator or state consumer-protection office. That complaint becomes another record. It doesn't guarantee a refund or a correction.
A consumer-law attorney or legal-aid organization may help you assess repeated reporting, collection activity, or substantial documented losses you already have. Don't assume every identity theft dispute turns into a lawsuit.
Questions people often ask
Should I use a freeze or a fraud alert?
Use a freeze if you can wait on new credit. An alert leaves applications more open while asking businesses to take extra identity-check steps.
Do I need a police report?
Not for every step, so ask the company or insurer what it requires and save the case number if you do file. Many steps don't need one.
Should I file Form 14039 because my SSN was exposed?
No. The IRS describes Form 14039 for tax-related identity theft and certain notices or instructions, not for a leaked number by itself. Follow the IRS path that matches the facts.
How long does identity theft recovery take?
Card billing disputes, document replacement, and tax cases run on different clocks, and tax work can outlast the IRS's general timeframe, so there isn't one schedule you can circle on a calendar and trust.
Do I need a paid recovery service?
You can file an FTC report, freeze credit, and send disputes without buying a plan. Pay only after you check the exact coverage and the cancellation terms.
Open a note now. Write down the first fraudulent transaction, the institution, the FTC report details, and the next follow-up date. Place freezes with all three credit bureaus through their official sites.