Identity Theft Checklist: Essential Steps to Protect and Recover in 2026

If you suspect identity theft or want to protect yourself, start with these core actions drawn from FTC recommendations. First, secure your credit by placing a credit freeze or fraud alert through Equifax, Experian, or TransUnion--anyone who suspects they may be affected by identity theft can do this. Contact one bureau for a freeze, which propagates to the others, or one for an initial fraud alert. Next, report the theft to the FTC at IdentityTheft.gov to get a personalized recovery plan. Call companies where fraud occurred to stop unauthorized activity. For long-term protection, enable two-factor authentication (2FA) on banking, email, and social media accounts.

This checklist equips everyday consumers with FTC-supported steps to block new fraud, repair damage, and prevent future risks.

Immediate Protection Steps: Place a Credit Freeze and Fraud Alert

When you spot suspicious activity like unfamiliar charges or accounts, act fast to secure your credit reports. A credit freeze blocks access to your credit file, preventing thieves from opening new accounts in your name. Anyone who is or suspects they may be affected by identity theft can place one.

To place a freeze, contact one of the three major credit bureaus--Equifax, Experian, or TransUnion. Each bureau must implement the freeze within 24 hours and provide a PIN to lift it later. Contacting one bureau triggers the freeze across all three. You'll need the PIN when applying for credit, loans, or rentals, so keep it safe; simply contact the bureau to lift the freeze temporarily or permanently as needed.

A fraud alert requires creditors to verify your identity before issuing new credit. Place it by contacting one bureau, which notifies the others. This serves as an initial step if you're not ready for a full freeze. Anyone who is or suspects they may be affected by identity theft can place a fraud alert.

These measures stop fraud in its tracks while you investigate further.

Report the Theft and Get a Personalized Recovery Plan

Discovery of fraud demands quick reporting for legal and practical support. Begin by calling the companies where you know fraud occurred, such as banks or retailers with unauthorized accounts or charges. This halts ongoing damage and creates a record.

Then, report the identity theft to the FTC at IdentityTheft.gov. Provide details about the incident, and the system generates a personalized recovery plan outlining next steps to repair the harm. This free tool connects your report to actionable guidance, including disputes with creditors and monitoring steps.

Official reports like this FTC plan or a police report also qualify you for enhanced protections, such as extended fraud alerts.

Recovery Workflow: Follow These Proven Steps After Reporting

With your FTC recovery plan in hand, proceed methodically to undo the theft's impact. The plan builds on your initial report, tying directly into credit protections.

1. Review your recovery plan: Use the personalized steps from IdentityTheft.gov to identify affected areas, such as credit cards, loans, or tax filings.

2. Maintain credit protections: Keep your credit freeze or fraud alert active. A fraud alert lasts one year and is renewable. Reference it when disputing fraudulent items on your credit reports.

3. Dispute inaccuracies: Send your FTC report to credit bureaus and companies to remove fraudulent information. Follow up with any police report if filed.

4. Monitor accounts closely: Check statements and credit reports regularly, using the freeze or alert to block new threats.

These steps, rooted in FTC guidance, ensure systematic repair while your protections remain in place.

Credit Freeze vs. Fraud Alert: Which to Choose First?

Both tools safeguard your credit but differ in strength, duration, and effort. Choose based on your urgency and needs.

Opt for a credit freeze if you want a robust barrier against new fraudulent accounts--it's free and effective until lifted. Start with a fraud alert if you anticipate frequent credit checks, like for rentals, as it requires less management. Many use both for layered protection.

Ongoing Prevention: Lock Down Your Accounts

Protection extends beyond one-time fixes. Integrate these habits into your routine to minimize risks.

Enable two-factor authentication (2FA) on banking, email, and social media platforms whenever possible, as recommended in Fraud Prevention Month: A Practical Checklist. 2FA adds a second verification step, like a code sent to your phone, thwarting unauthorized logins even if passwords are compromised.

Combine this with your credit freeze or alert: Review the PIN periodically and update it if needed. Regularly check accounts for anomalies, and report any new suspicions promptly via IdentityTheft.gov.

These practices create a fortified defense, reducing vulnerability over time.

FAQ

How do I place a credit freeze on my reports?
Contact one of the three credit bureaus--Equifax, Experian, or TransUnion--by phone, online, or mail. The freeze propagates to all three and takes effect within 24 hours; you'll receive a PIN to manage it.

Who can request a credit freeze or fraud alert?
Anyone who is or suspects they may be affected by identity theft qualifies for either.

How long does a fraud alert last, and can I renew it?
An initial fraud alert lasts one year, but you can renew it.

What’s the first step if I discover identity theft?
Call the companies where you know fraud occurred to stop unauthorized activity.

Do I need to contact all three credit bureaus for a freeze?
No--contact one, and it propagates to Equifax, Experian, and TransUnion.

How does reporting to IdentityTheft.gov help with recovery?
It creates a personalized recovery plan based on your details, guiding you through repairs.

To stay secure, revisit your credit protections annually and enable 2FA on all key accounts today.