Identity theft recovery is a sequence, not a single report. Stop new misuse first. Then create a record that lets each bank, credit bureau, creditor, or agency see the same facts.
This information is for U.S. consumers and is general consumer guidance, not legal advice. The FTC's recovery service is free, and credit freezes are free too. You don't need to buy a recovery kit to begin.
Stop fresh loss in the first hour
Use contact details from a statement, the official app, or a website you typed yourself. Don't call a number from an unexpected text, email, or pop-up. If password-reset messages go to your email, protect that account right away.
-
Contact the affected bank, card issuer, or payment provider. Tell it you believe activity is unauthorized, ask it to stop further use where possible, and request a fraud case number.
-
Secure email and online access. Change the email password, sign out unfamiliar sessions, and turn on two-factor authentication. Then change passwords for financial, shopping, and payment accounts that use that email address.
-
Save what you found. Keep statements, transaction notices, emails, texts, screenshots, and suspicious phone numbers. Note when you first noticed each problem.
-
Create an FTC identity theft report. The FTC identity theft reporting page leads to IdentityTheft.gov, where you can report the theft and get a recovery plan.
-
Freeze your credit files. Contact Equifax, Experian, and TransUnion to place a freeze with each bureau.
You may have to repeat the same facts, then repeat them to a different department. One rough note with the date, time, number called, representative's name or ID, and case number is better than trying to reconstruct the call later.
Keep writing things down.
Put the evidence in one file
Your file does not need legal language. It needs dates, account names, reference numbers, and copies of what you sent.
Use a protected digital folder, a paper file, or both. Send copies unless the recipient specifically tells you otherwise. Original documents can be hard to replace.
| Record | Save this information | Why it matters |
|---|---|---|
| FTC identity theft report | Confirmation number, filing date, and reported facts | Keeps your description of the theft consistent |
| Police report | Agency, report number, officer contact, and a copy if available | A business or investigator may request it |
| Bank or card fraud case | Date reported, disputed transaction, representative, and case number | Makes later calls easier to track |
| Credit dispute | Bureau, account or inquiry, date submitted, documents sent, and outcome | Separates each disputed item |
| Tax matter | IRS notices, forms, and delivery confirmations | Keeps tax steps apart from credit disputes |
An FTC Identity Theft Report is not a police report. A company may ask for one, the other, or both. The FTC says its report can help businesses address identity-theft problems, so keep the confirmation and recovery plan with your other records.
Decide between a credit freeze and a fraud alert
A freeze is usually the stronger barrier against someone opening new credit in your name. It does not repair damage already on a report.
Turns out, these tools solve different problems.
Credit freeze. A freeze restricts access to your credit file. Place one with all three nationwide credit bureaus: Equifax, Experian, and TransUnion. It remains in place until you ask the bureaus to remove it, and you may need to lift it before applying for credit.
Fraud alert. A fraud alert tells businesses using your report to take reasonable steps to verify your identity. Your file remains available. An initial fraud alert generally lasts one year.
Neither option. A freeze or alert does not secure an existing email, bank, medical, tax, shopping, or payment account. Contact the organization holding that account.
Use the FTC's credit freeze and fraud alert guidance for current bureau instructions and free-report information. A freeze is free, but it will not remove a fraudulent account, inquiry, or address already listed on your report.
Review your reports and dispute each false item
After freezing your files, get and read all three credit reports. Use the free-report route in FTC guidance, not a link in an unexpected message.
Check accounts, inquiries, addresses, and personal details. An unfamiliar creditor name is not always fraud, so compare it with your own records before disputing it.
Write down the item exactly as it appears. Include the account number or inquiry reference when available, along with the bureau that shows it.
Send a clear dispute to the credit bureau reporting the item. Send a copy to the creditor or other business that supplied the information. Attach the FTC report, any police report requested, and supporting records that fit that specific item.
Don't put ten unrelated accounts into one vague complaint. A bureau or creditor needs to know what it is reviewing.
Use this wording as a starting point:
I believe this information resulted from identity theft. I am disputing [account or inquiry], shown on [credit bureau report or statement], with reference [number or last four digits]. Please investigate it and tell me in writing what additional documents you need. I have included copies of my identity theft report and supporting records. Please send the result to [mailing address or secure contact method].
Follow the recipient's submission instructions. Save the dispute, every attachment, delivery or submission confirmation, and the written result.
Report unauthorized money movement promptly
Payment claims can follow different procedures. A debit-account transfer, prepaid-account transfer, credit card purchase, check, wire, and account takeover should not be treated as the same type of case.
Thing is, the payment rail affects the provider's process. 12 CFR Part 1005 contains federal rules for many consumer electronic fund transfers. If money left a consumer bank or prepaid account electronically, report it promptly, say that it was unauthorized, and ask the provider what written notice or supporting documents it requires.
| Situation | Ask the provider to do |
|---|---|
| Unauthorized electronic transfer from a bank or prepaid account | Open an unauthorized-transfer case, help stop further access if needed, and provide a case number |
| Debit card or ATM access may be compromised | Replace the card or access device and explain whether the account should also be changed |
| Unauthorized credit card purchase | Direct you to the issuer's credit card fraud or dispute process and provide written instructions |
| Email or online-banking takeover | Reset credentials, remove unfamiliar devices, and review linked payment methods |
Record when you discovered the transaction and when you reported it. Ask whether the company opened a fraud claim, an account-security case, or both.
Keep tax identity theft separate
Form 14039 is not needed for every identity-theft event. It is used when personal information may have been used to file a fraudulent federal tax return or when the IRS tells a taxpayer to submit an identity theft affidavit.
The IRS guidance on when to file Form 14039 describes online and paper filing options. It also explains steps tied to certain IRS identity-verification letters. Follow the instructions on any IRS notice you receive.
An Identity Protection PIN, or IP PIN, is a separate tax safeguard. Under the IRS IP PIN guidance, it is used on eligible federal income tax returns and must be entered on electronic or paper filings to avoid rejections or delays.
Only you and the IRS should know your IP PIN. It will not remove a false credit account or fix a compromised email account.
Give non-credit problems their own trail
A credit freeze mainly limits new-credit access. It will not correct a medical record, replace a state ID, fix false employment information, or resolve a criminal record associated with the wrong person.
| Type of misuse | First contact | Records to gather |
|---|---|---|
| Medical identity theft | The provider's privacy, records, or fraud team | Incorrect bills or records, care dates, and your identity theft report |
| State ID or driver's license misuse | The motor vehicle agency that issued the ID | Identification, notices, and any FTC or police report requested |
| Employment or benefits misuse | The employer or agency named in the record | Pay records, notices, dates, and case numbers |
| Criminal identity theft | The law enforcement agency or court handling the matter | Police documents, court notices, and proof of identity |
Ask for the correction process in writing before sending sensitive documents. Procedures can vary by state and agency.
Synthetic identity cases can leave several confusing records across creditors and bureaus. Handle each account separately, and clearly identify which details belong to you and which do not.
Copy-and-use identity theft recovery tracker
Paste this into a private document or print it for your file.
| Date | Organization | Contact method | Case or confirmation number | Documents sent | Next follow-up |
|---|---|---|---|---|---|
Recovery checklist
- [ ] Secure email access and turn on two-factor authentication
- [ ] Contact each affected bank, card issuer, or payment provider
- [ ] Save statements, messages, screenshots, and notices
- [ ] File an FTC identity theft report
- [ ] Request a police report if a business or investigator needs one
- [ ] Freeze files with Equifax, Experian, and TransUnion
- [ ] Review all three credit reports
- [ ] Dispute false information with the bureau and reporting business
- [ ] Follow IRS instructions if a tax return or IRS notice is involved
- [ ] Handle medical, ID, employment, benefits, or criminal-record problems separately
- [ ] Record every case number and response
- [ ] Follow up in writing on unresolved items
If a company leaves the record unresolved
Ask for its decision in writing. A phone call can end without giving you the details needed for the next step.
Keep the follow-up brief and specific. Identify the original case, name the item still at issue, list the records already provided, and ask what happens next.
On [date], I reported [specific account, transaction, or record] under case number [number]. The item is still unresolved. I am attaching the prior confirmation and copies of the documents already provided. Please confirm the next review step and send your response in writing.
Ask for the company's fraud supervisor or internal escalation process if the response does not address the record. For an IRS issue, use the contact and response directions on the notice. For a credit-report dispute, keep the report, submission confirmation, and written outcome together.
Open the tracker now and enter the affected company, the date you noticed the problem, and the first case number you receive.