Identity theft starts as a paperwork problem. Then it turns into a money problem. A stolen Social Security number, a card number skimmed at a gas pump, or one reused password is enough. The thief opens accounts, files a tax return, or drains a bank account. You can't fix this with one phone call. The work follows a sequence: freeze, report, dispute, document.
What identity theft looks like in 2026
The Federal Trade Commission runs IdentityTheft.gov. It's the official U.S. starting point for reporting and recovery. Answer a few questions about what happened. The site builds a personalized recovery plan and an Identity Theft Report. That report can help you dispute fraudulent accounts and debts. Keep a copy. Most cases still begin with a leaked password, a stolen SSN, or a card number skimmed at a gas pump. The trigger changes. The cleanup steps don't.
First moves if you suspect identity theft
Do these in order. You can overlap a few, but don't skip the paper trail.
- Place a fraud alert or security freeze. Experian's fraud alert page says a fraud alert with one bureau is shared with the other two. An initial alert lasts one year.
- Pull your credit reports. Look for accounts or inquiries you don't recognize. Write down dates, balances, and account numbers.
- Report the theft at IdentityTheft.gov. Save the Identity Theft Report.
- Call your banks and creditors. Ask for the fraud department. Close or freeze compromised accounts. Keep notes with names, dates, and reference numbers.
- File a police report if the recovery plan or a creditor asks for one. Get the report number.
- Keep a simple log. Every call, letter, and upload can matter later.
Freeze vs. fraud alert
| Freezes and alerts do different jobs. Here's the split. | Tool | What it does | How long | Best for |
|---|---|---|---|---|
| Security freeze | Limits access to your Experian credit report, which makes it harder for lenders to open new accounts. Experian's freeze page says you can manage it with a free account. | Until you lift it | Long-term protection when you aren't applying for credit | |
| Fraud alert | Warns lenders to verify your identity before extending credit. A request with one bureau is shared with the other two. | One year for an initial alert | A quick first step if you suspect fraud | |
| Minor freeze | Parents and guardians can freeze a child's credit file under age 16. | Until lifted | Families protecting a child's SSN |
Disputing errors that show up on your reports
A fraud alert does not remove fraudulent accounts. You still have to dispute them. Start with the credit bureau or the company that reported the account. Write a short letter or use the online portal. Be specific. The difference between "this account is wrong" and "Account #1234 was paid in full on March 15, 2025" is huge. fedlaws.org's FCRA dispute guide explains why. Attach the Identity Theft Report, a police report if you have one, and any statements. Thing is, a bureau may verify the account and keep it. That's when you escalate. File a complaint with the Consumer Financial Protection Bureau. The CFPB says companies generally respond in 15 days. You can review the response and send feedback for 60 days. The CFPB accepts complaints about credit cards, credit reports, debt collection, bank accounts, and other listed financial products.
After a data breach: what to do with the alert
Data breach letters are common. Fake ones are common too. Check the real source. HaveIBeenPwned is a well-known breach notification service. Its FAQ says email lookups use SHA-1 hashing, so the raw address isn't sent for lookup. If your email appears, change that password. Then change it anywhere you reused it. Turn on two-factor authentication. Watch for phishing that mentions the breached company. Clean Email's post-breach checklist recommends prioritizing banking, payment, Apple, Google, Microsoft, cloud storage, and social media accounts. Turns out, the first breach email is often bait. The real attack comes later, when someone tries the same password on your bank.
Protecting your SSN and accounts before fraud happens
A few habits do most of the work.
- Freeze your credit if you aren't opening new accounts soon.
- Use a unique password for every financial account and email.
- Turn on two-factor authentication, ideally with an app or hardware key.
- Don't give your SSN by phone, email, or text unless you initiated the contact and trust the recipient.
- Check your credit reports and bank statements on a regular schedule. The boring steps stop more fraud than paid monitoring services.
Common mistakes that slow recovery
To be honest, waiting is the big one. Fraudulent accounts can grow, and dispute windows can close. Don't dispute by phone and then forget to keep proof. Use the portal or mail, and save the confirmation. Closing every account in a panic can backfire. You may lose access to records you need for disputes. And don't skip the Identity Theft Report. Creditors and bureaus take it more seriously than a phone call.
What to do next
Start with one action today: place a fraud alert or a freeze. Then pull your credit reports and open IdentityTheft.gov. You don't have to fix everything in an hour. You do need a paper trail.