Identity theft has no meaningful consumer upside. If someone used your information, the useful question is which account or record was touched and what you should do next.
This U.S.-focused checklist starts with the most time-sensitive step: protect access to money. Then report the misuse, place credit protections, and repair each affected record. Different payment types follow different rules.
If money is leaving an account right now, call that financial institution first.
First, identify what was affected
Write down what you know before making calls: the account, transaction, date, amount, message, or notice that alerted you. That pause prevents a common mistake - treating a fraudulent credit account, a stolen debit card, and a fake tax return as one problem.
| Situation | First step | Limit to remember |
|---|---|---|
| Unauthorized debit or electronic transfer | Call the bank or credit union using an official number. | Certain Regulation E protections depend on prompt notice and the type of access device involved. |
| Fraudulent credit account or inquiry | Contact the creditor and credit bureaus. | A fraud alert or freeze helps with new credit; existing entries still need correction. |
| Tax return or refund misuse | Follow the IRS notice or official IRS instructions. | An Identity Protection PIN addresses tax filing risk, not every kind of identity theft. |
| Email, phone, or social account takeover | Secure the account and its recovery methods. | A compromised email account can reset other accounts. |
The CFPB's identity theft guidance directs victims to contact financial institutions, law enforcement, the Department of Justice, or the FTC through official channels. Use the contact details on a statement or official website, not a number in a suspicious message.
Work through the recovery in order
-
Secure your main email first. Change its password from a device you trust, remove unfamiliar recovery methods, sign out other sessions, and turn on multifactor authentication. If money is moving, handle the financial call before this step.
-
Call each affected bank, card issuer, or payment provider. Ask whether it can block access, replace credentials, open a fraud claim, or preserve transaction details. Record the representative's name and case number.
-
Create an official identity theft report. Use IdentityTheft.gov to report the misuse and receive a recovery plan. Keep a copy with your other records.
-
Add credit protection. The CFPB says you can contact any one of the three nationwide credit reporting companies for a fraud alert, and that bureau must notify the other two. A security freeze uses each bureau's separate process. Experian's freeze guidance explains that a freeze blocks most credit inquiries, although exceptions exist.
-
Contact creditors and other affected organizations. Give each company the exact account, inquiry, transaction, or application involved. Ask what documentation it needs and request written confirmation when the matter is closed or corrected.
-
Check records beyond your credit report. Review bank statements, bills, tax notices, health care records, employment records, and government-benefit correspondence. A clean credit report does not prove that every form of identity misuse has ended.
The two-business-day rule is narrower than many people think
When its conditions apply, the CFPB's Regulation E liability rule says that notifying a financial institution within two business days after learning that an access device was lost or stolen can limit liability for unauthorized transfers to the lesser of $50 or the amount transferred before notice.
If notice comes later, the rule can allow up to $500 under its stated calculation. That is not a universal refund promise for every identity theft loss.
The payment rail matters. An unauthorized electronic fund transfer, credit-card billing problem, wire, prepaid transaction, and peer-to-peer payment may follow different procedures. Tell the institution exactly how the money moved and when you noticed it.
A freeze does not clean up existing fraud
A fraud alert and a security freeze do different jobs. A fraud alert tells the credit reporting system that businesses should take extra care with applications in your name; a freeze restricts most new-credit inquiries.
Turns out, neither protection is a cleanup tool. You still need to identify fraudulent accounts or inquiries, follow the bureau's correction process, and notify the creditor that supplied the information.
List each disputed item precisely. Include the creditor, account or inquiry details, date, and any identity theft report or other documents the official process requests. Keep the submission and delivery records.
Tax identity theft has its own lane
A victim may never see fraudulent tax activity on a credit report. Someone can use personal information to file a return or redirect a refund while the credit file looks normal.
For tax-related concerns, use the IRS notice's contact instructions or IRS.gov. An Identity Protection PIN can help prevent someone from filing a federal tax return with your information. The Taxpayer Advocate's IP PIN guidance also explains special handling for dependents.
Do not assume Form 14039 is the right response to every exposed Social Security number. Whether it applies depends on the tax situation and the IRS instructions for that case. Follow those instructions rather than sending tax documents to an unexpected email address or phone number.
If you only suspect your information was exposed
An exposed Social Security number is not proof that someone has opened an account. You can still place a security freeze, replace reused passwords, and protect your email and financial logins with multifactor authentication.
For tax concerns, review the IRS IP PIN option. Keep watching account statements and official notices, because credit monitoring alone will not show every kind of identity misuse.
Build a paper trail
To be honest, the boring details matter. Keep:
- a timeline showing when you noticed the problem and what happened next
- bank, creditor, bureau, and agency names with case numbers
- statements, notices, screenshots, messages, and copies of reports
- letters you sent, delivery records, and written correction or closure notices
Store copies somewhere separate from the affected account. Do not send original identity documents unless an official process specifically requires them.
When the first response fails
Ask the organization to explain its decision in writing. If it says something is missing, ask which document or fact it needs, where to send it, and how to request another review.
The CFPB's victim guidance points consumers toward official contacts for financial institutions, law enforcement, the DOJ, and the FTC. Use the route that matches the problem, and keep your bank, creditor, and credit-bureau records together so you do not have to reconstruct the case later.
Thing is, recovery rarely happens through one phone call. It usually takes separate steps for the money, the credit file, the tax record, and the compromised login.
Start with one page now. Write down the discovery time, affected institution, transaction or account, and case number. If a transfer is still moving, call the institution first; otherwise secure your email and file the identity theft report today.