Identity theft recovery starts with stopping further access—not with repairing your credit. For U.S. consumers, secure compromised accounts, report the theft, place a credit freeze, and document every dispute. Then work through credit, bank, tax, medical, or benefit records one at a time.
Identity Theft Recovery Checklist
Take these steps as soon as you notice suspicious activity:
- Secure the affected account. Call the bank, card issuer, lender, or service provider using a trusted number from a statement or official website. Ask it to lock the account, replace compromised cards, and review recent activity.
- Secure your email first. Change the password from a trusted device, sign out other sessions, check recovery details and forwarding rules, remove unfamiliar connected apps, and turn on multifactor authentication.
- File an FTC report. Use IdentityTheft.gov to report the theft and receive a recovery plan. The FTC report can help support disputes, but it doesn't remove accounts or reverse transactions for you.
- Consider a police report. It may be useful if an ID was stolen, someone you know is involved, a creditor requests it, or you need records for an investigation.
- Freeze all three credit reports. A freeze is free and must be placed separately with Equifax, Experian, and TransUnion.
- Add a fraud alert if appropriate. An initial alert is free for one year and tells businesses to take extra steps to verify applications.
- Review your credit reports and financial statements. Look for unfamiliar accounts, inquiries, addresses, phone numbers, collections, and balances.
- Notify the IRS if tax identity theft is involved. Follow any verification letter or other instructions from the IRS.
- Preserve evidence. Save statements, emails, letters, screenshots, case numbers, and copies of everything you send.
- Keep monitoring after the immediate problem is closed. Identity thieves sometimes use information months after the first incident.
What to Do in the First 24 Hours
Protect bank and payment accounts
Contact every institution connected to the suspicious activity. Ask for a fraud case number and written confirmation of the report, a new card or account number when necessary, a review of recent transfers and withdrawals, removal of unfamiliar phone numbers or email addresses, and instructions for submitting a written dispute.
Don't use a phone number from a suspicious email or text. Type the institution's address into your browser or use a number from a statement.
Change reused passwords on financial, email, shopping, health, and government accounts. Use a different password for each service, and turn on multifactor authentication wherever it's available.
Report the theft
IdentityTheft.gov is the FTC's official starting point for a U.S. identity theft report and recovery plan. Describe what happened accurately and download or save the resulting records.
An FTC report isn't the same as a police report, and neither document guarantees a refund or credit-report removal. A creditor may request one or both, depending on the account and its investigation.
Be careful with downloadable forms advertised as a special "2026 identity theft affidavit." Use the official FTC site or the exact form identified by the creditor, credit bureau, IRS, or other agency. Don't pay a third party for an FTC report.
Credit Freeze or Fraud Alert?
A freeze and a fraud alert do different jobs. The FTC's credit freeze and fraud alert guidance explains how to contact the three nationwide credit bureaus.
| Protection | What it does | Best use |
|---|---|---|
| Credit freeze | Restricts access to your credit file for most new-account applications | Confirmed identity theft or a stolen Social Security number |
| Initial fraud alert | Asks businesses to take reasonable steps to verify your identity before extending credit | Suspected theft or an added layer of caution |
| Extended fraud alert | Provides a longer alert for eligible identity theft victims who meet documentation requirements | Continuing protection after a documented theft |
A freeze is free and stays in place until you ask the bureaus to lift or remove it. You must place it with all three bureaus, and you'll need to temporarily lift it if a legitimate lender needs access to your report.
An initial fraud alert lasts one year. You can renew it, but you'll need to resubmit an FTC identity theft report or police report. A fraud alert doesn't block every application, and a freeze doesn't stop someone from taking over an existing account. You may use both.
Create a Recovery File
Keep one folder—physical or digital—for the entire case. Record the date you noticed the problem, the account or agency involved, transaction dates and reference numbers, names of representatives and case numbers, dates you sent letters and identity documents, delivery confirmations and response deadlines, and copies of credit reports before and after disputes.
Send copies rather than original identity documents. Use secure upload portals when available. If you mail a dispute, use a trackable method and keep the receipt.
A clear file prevents repeated explanations and gives you evidence if an institution says it never received your report.
Remove Fraudulent Information From Your Credit Reports
Get reports from all three bureaus through AnnualCreditReport.com. A report from one bureau won't show everything reported by the others.
Check these sections carefully:
- New accounts and collections
- Hard inquiries you don't recognize
- Current and former addresses
- Phone numbers and employers
- Account balances and payment history
- Names or variations that don't belong to you
For every fraudulent item, identify which bureau is reporting it, dispute the item with that bureau using its dispute process, contact the creditor or collection agency that supplied the information, explain that the account or transaction resulted from identity theft, include your FTC report and proof of identity when requested, and keep copies of the submission. Wait for the written result.
Ask the bureau about its identity-theft blocking process. A credit freeze prevents or limits some new applications, but it doesn't delete an account that's already on your report.
Credit-report investigations often use a 30-day window, although the timing can change when additional information is submitted. Read the bureau's acknowledgment and results letter. If the item remains, review the reason, provide missing documents, and dispute inaccurate information directly with the creditor again.
Don't pay a debt you don't recognize simply to make the problem disappear. At the same time, continue handling accounts and bills you know are legitimate.
Dispute Fraudulent Bank, Card, and Transfer Activity
The payment method matters. Rules and investigation procedures differ between credit cards, debit cards, electronic transfers, wires, and peer-to-peer payments.
Debit cards and bank accounts
Notify the bank immediately about unauthorized withdrawals, debit transactions, account access, or changed payment instructions. Ask how to submit the dispute in writing and whether the account needs to be closed and replaced.
Timing can affect your protections under electronic-transfer rules. Don't wait for the next statement if you already know the transaction is unauthorized.
Credit cards
Call the issuer to block the card and request a replacement. Follow up through the issuer's billing-error or unauthorized-charge process, especially if it tells you to send a written notice.
Federal billing-error rules generally use a 60-day period from the statement containing the error, so check the statement and act promptly. The issuer's investigation may take longer than the initial phone call. Keep paying undisputed charges while the investigation is pending.
Wires and peer-to-peer payments
Contact the provider and your bank immediately and request a recall or fraud review. A transfer that you authorized after being deceived may be treated differently from a transaction made without your permission, so a refund isn't automatic.
Give the provider the recipient information, time, amount, screenshots, messages, and any report number. Ask for the case number and written instructions.
Fraudulent loans and collection accounts
Notify the lender or collector that you didn't open the account. Request that it investigate, stop treating the account as yours while it reviews the claim, and tell you what documents it needs.
Don't ignore collection letters. Send a written identity theft dispute and keep proof of delivery. If the collector continues contacting you, save each notice and call record.
Tax, Social Security, Employment, and Driver's License Misuse
Federal tax identity theft
If you believe someone used your information to file a federal tax return, start with the IRS's identity theft victim assistance guidance.
If the IRS sends a verification letter, follow the method and deadline in that letter. In other situations, IRS guidance on when to file an identity theft affidavit explains when Form 14039 may apply.
Don't send duplicate Forms 14039 or repeatedly contact the IRS for a status update. The IRS says duplicate submissions and unnecessary status contacts can cause delays. Processing times vary, so keep every IRS letter and response.
An IRS Identity Protection PIN can help prevent future federal tax returns from being filed using your information. Review eligibility and enrollment details directly with the IRS.
Social Security number misuse
Create a verified Social Security account and review your earnings record for work you didn't perform. Report errors to the Social Security Administration and keep documentation of the response.
A new Social Security number isn't a routine fix. It won't automatically erase credit records, tax records, or debts, and the Social Security Administration considers replacement numbers only in limited circumstances.
Employment benefits and driver's licenses
If someone used your information for unemployment benefits, payroll records, or another public benefit, notify the employer, payroll department, or relevant state agency. Ask what fraud report or identity documents it requires.
For a stolen or misused driver's license, contact your state's department of motor vehicles. Procedures for replacement licenses and driving-record reviews vary by state. A police report may help, but follow the DMV's own document list.
Medical Identity Theft
Medical identity theft can affect bills, insurance claims, and the accuracy of your health records.
Review insurance Explanation of Benefits statements and medical bills. Request an itemized record from the provider for treatment you didn't receive. Contact the provider's billing, privacy, or medical-records office and report the error. Notify your health insurer's fraud department. Ask the provider to correct inaccurate records and flag the account for possible identity theft. Check later statements to confirm that the fraudulent service or claim doesn't reappear.
Medical information can affect future care, so don't treat an incorrect claim as only a credit problem. Keep copies of corrected records and written confirmations.
Child Identity Theft
A child may have a credit file even if they've never applied for credit. Parents and legal guardians can use the child-freeze process described in the FTC's credit freeze guidance.
Contact each bureau separately and ask for its requirements. You may need proof of the child's identity, your own identity, and parental or guardianship authority.
Also report the theft through IdentityTheft.gov, contact the creditor that used the child's information, and check whether tax, medical, school, or benefit records were affected. Don't send a child's Social Security card or birth certificate through an unverified website.
Helping an Older Adult
An older adult may need help coordinating banks, credit bureaus, medical providers, and government agencies. With the person's permission or valid power of attorney, create a shared case log and keep original documents safe, add a credit freeze and review reports together, ask the bank about a trusted contact or elder-fraud specialist, change account access and remove unfamiliar authorized users, and never share one-time security codes with a caller. Report suspected financial exploitation to local law enforcement or Adult Protective Services when appropriate.
If there's immediate danger, coercion, or an active financial transfer, contact the financial institution and local authorities immediately.
If an Email or Online Account Was Hacked
Secure the email account before changing other accounts, because email can be used to reset passwords elsewhere. From a trusted device, change the password and any security questions, sign out of all sessions and remove unfamiliar devices, check forwarding rules and recovery addresses, revoke unknown app connections, turn on multifactor authentication, change passwords on financial and shopping accounts that used the same credentials, and warn contacts if messages were sent from the compromised account.
Don't reuse the compromised password, even with a small variation.
Timelines and Follow-Up
Identity theft recovery rarely follows one fixed schedule.
| Stage | Practical goal |
|---|---|
| Same day | Lock accounts, change credentials, report unauthorized activity, and place freezes |
| Next few days | File the FTC report, collect documents, notify creditors, and submit urgent disputes |
| Following weeks | Review investigation results, correct credit reports, and handle tax or medical records |
| Following months | Recheck reports and statements, renew alerts when needed, and watch for related fraud |
Bank and card investigations have different deadlines. Credit bureaus send their own dispute notices and results. IRS cases can take substantially longer than ordinary card disputes, so don't rely on an informal promise such as "it will be fixed in eight weeks."
Paid Recovery Services and Monitoring
You can complete the core recovery steps without paying a company. Credit monitoring may alert you to changes, but it doesn't freeze your reports, remove fraudulent accounts, or secure a hacked email account.
Before paying for a recovery or monitoring service, check monthly and annual fees, automatic renewal terms, cancellation instructions, what the service actually handles, insurance limits and exclusions, and whether a representative promises a result that the company can't control.
Avoid anyone who claims to be from the FTC, IRS, or a bank and demands gift cards, cryptocurrency, wire transfers, or remote access to "protect" your money. Government agencies don't require payment to file an identity theft report.
When to Escalate
Escalate in writing when an institution doesn't record your dispute, misses its stated response time, or continues reporting information after receiving evidence.
Ask for a supervisor, written decision, and the documents needed for another review. For unresolved credit-reporting or financial-service problems, a complaint to the appropriate regulator may create another record. Legal aid or a consumer attorney may be useful when the losses are substantial, an employer or medical record remains wrong, or a creditor refuses to address documented identity theft.
Start today by securing the most exposed account, placing freezes with all three credit bureaus, and saving the confirmation numbers.