Instructions for stealing another person’s identity would enable fraud, so they don’t belong in consumer guidance. If your personal information has been exposed or misused, act quickly: secure your accounts, report the theft, freeze your credit, and dispute each affected account.

This guide is for U.S. consumers. Agencies, deadlines, and legal protections can differ in other countries.

Do these things first

1. Contact the affected company

Call your bank, credit union, card issuer, lender, or online account provider using the number in its official app, on a statement, or on the back of your card. Don’t use a phone number or link from a suspicious message.

Ask the company to:

• Lock or replace a compromised card
• Secure or close an account opened without your permission
• Start a fraud investigation
• Explain how to dispute unauthorized transactions
• Give you a case number and written confirmation

If an email, payment app, or shopping account was taken over, change its password from a trusted device. Use a unique password and turn on multifactor authentication where available.

2. Preserve evidence

Keep copies of:

• Fraudulent bills, account notices, and credit-report entries
• Suspicious emails, text messages, caller details, and transaction records
• Letters from the IRS, lenders, or credit bureaus
• Dispute letters, upload confirmations, and case numbers
• Notes showing when you called and who handled the claim

Send copies rather than original identity documents unless an agency specifically requires otherwise.

Report the identity theft

The FTC’s identity theft reporting and recovery page directs consumers to IdentityTheft.gov, the federal reporting and recovery resource. It provides step-by-step guidance, checklists, and sample letters.

An FTC identity theft report can help organize your case and support requests to companies, but it doesn’t automatically close accounts, remove credit-report information, or reverse charges. You still need to contact each affected business.

For a scam or deceptive business practice, use the FTC’s ReportFraud.gov route. For internet-enabled crime, you can also submit information to the FBI’s Internet Crime Complaint Center. Keep the confirmation for your records.

Freeze your credit and review your reports

A credit freeze can help prevent new creditors from opening accounts in your name. The freeze is free, and it remains in place until you ask the credit bureaus to remove it.

Contact all three nationwide credit bureaus:

• Equifax
• Experian
• TransUnion

The FTC’s credit freezes and fraud alerts guide explains how to place a freeze, temporarily lift it when you apply for credit, and use a fraud alert instead.

A fraud alert is different from a freeze. It asks businesses to take additional steps to verify an applicant’s identity, but it doesn’t lock your credit file in the same way. Read the FTC instructions to determine which option fits your situation.

After placing the freeze, check your credit reports for:

• Accounts or loans you don’t recognize
• Hard inquiries you didn’t authorize
• Incorrect addresses or employers
• Collection accounts tied to fraudulent debts
• Changes to existing accounts

An unfamiliar account can be a sign of identity theft. Record the creditor, account number, date opened, balance, and bureau showing the information before starting disputes.

Dispute fraudulent accounts and charges

Notify both the company involved and any credit bureau reporting the fraudulent account. State clearly that you didn’t open or authorize the account and ask how to submit supporting documents.

Use a separate record for every account. Combining several unrelated disputes in one message can make it harder to track responses.

When sending identity documents, use the company’s verified upload portal or address. Don’t email sensitive documents to an address supplied by an unsolicited caller.

Know the difference between credit-card and debit disputes

The payment method controls the process. A credit-card billing dispute isn’t handled the same way as a debit-card, electronic-fund-transfer, wire, or peer-to-peer payment claim.

For a U.S. credit-card billing error, the FTC says your written dispute must reach the issuer within 60 days after the first statement showing the error was sent. Send it to the billing-dispute address listed by the issuer, not necessarily the address used for payments, and keep a copy.

The issuer must generally acknowledge the complaint within 30 days unless it has already resolved the issue. The investigation and resolution must generally be completed within 90 days. See the FTC’s credit-card dispute guidance for the required process and sample letter.

For a debit-card or electronic-transfer problem, notify the bank immediately and ask for its fraud-claim procedure and deadline. Don’t assume the credit-card 60-day process applies. For wires or peer-to-peer payments, contact the bank or provider at once and ask whether any recall or recovery process is available.

Respond to tax-related identity theft

If you believe someone used your information to file a fraudulent federal tax return, the IRS says you should consider filing Form 14039, Identity Theft Affidavit. The form can be completed online or on paper, depending on the circumstances.

If the IRS sends a verification letter, follow the instructions in that letter. Keep a copy of anything you submit.

Don’t send duplicate Form 14039 filings to check on the status of a case. The IRS says duplicate submissions can cause delays. Its identity theft victim assistance page explains what may happen during the review, including possible identity verification at a Taxpayer Assistance Center.

A data breach by itself doesn’t always mean you should file the tax affidavit. The IRS form is directed at situations involving suspected tax-related identity theft, such as a fraudulent return filed using your information.

Protect an exposed Social Security number

If your Social Security number was exposed but you haven’t found fraudulent activity:

1. Place a credit freeze with all three bureaus.
2. Review your credit reports periodically.
3. Secure your email and financial accounts with unique passwords and multifactor authentication.
4. Sign in to your my Social Security account and review your Social Security Statement.
5. Watch for unfamiliar tax notices, employment records, medical bills, or collection letters.
6. Use only official agency websites when responding to identity-verification requests.

A freeze helps with new-credit applications, but it doesn’t replace account monitoring or disputes involving existing accounts.

If a company rejects your claim

Ask for the decision in writing and request the exact reason for the denial. Confirm whether the company needs:

• An FTC identity theft report
• A police report
• Proof of identity or address
• A transaction record or account statement
• A completed company fraud affidavit
• A written dispute sent to a specific address

If a creditor or insurer asks for a police report, file one with the appropriate local law-enforcement agency and request a copy. Send only the documents requested, through a verified channel.

For credit-report problems, follow up with the bureau that displayed the information and the creditor that supplied it. Keep the original dispute, the response, and evidence of delivery. If the company’s response is incomplete, ask for its next-level complaint process in writing.

What controls the outcome

• A credit freeze helps restrict access for new credit applications. It doesn’t investigate an existing charge or erase a fraudulent account by itself.
• A fraud alert asks creditors to use additional identity checks. It isn’t the same as blocking access to your credit file.
• An FTC identity theft report documents the incident and provides recovery tools. It doesn’t replace direct notices to banks, creditors, or payment providers.
• Credit-card billing rules apply to credit-card disputes. They don’t automatically govern debit cards, wires, electronic transfers, or peer-to-peer payments.
• Form 14039 is for suspected tax-related identity theft. It isn’t required for every data breach.
• A police report may support a creditor’s investigation, but it doesn’t substitute for reporting the problem to the affected company.

Start with the institution holding the money or account, then create the FTC report and place the credit freezes. Record every deadline and confirmation number as you work through the remaining disputes.