Identity Theft Recovery Steps: What to Do First

Last updated: October 13, 2026

Finding out that someone has used your name, Social Security number or account details is stressful, and it is tempting either to freeze or to try to fix everything at once. A calmer approach works better. Identity theft recovery is a sequence of fairly small tasks, done in the right order, and the first few hours matter most.

This guide follows the order recommended by the Federal Trade Commission (FTC), which runs the official reporting site IdentityTheft.gov, and adds the federal rights that help you clean up your credit reports afterward. It is written for people in the United States and is general information, not legal advice.

Signs Your Identity May Have Been Stolen

The FTC lists several ways to tell whether someone is misusing your information:

• Charges for things you did not buy, or withdrawals you did not make.
• A bill you stopped receiving, which could mean someone changed your billing address.
• A new bill you did not expect.
• Accounts on your credit report that you do not recognize.
• Collection calls or letters about debts that are not yours.
• Notices about a tax return, benefits or medical care you did not use.
• Password-reset emails or login alerts you did not request.

Any one of these is reason to look further. You do not need certainty before you start protecting yourself.

The Recovery Plan at a Glance

When	Action	Where	Cost
Right away	Call the fraud department of each affected company	Number on your card, statement or official website	Free
Right away	Place a one-year fraud alert	Any one of Equifax, Experian or TransUnion	Free
Same day	Freeze your credit at all three bureaus	Each bureau separately	Free to place and lift
Same day	Report and get a recovery plan	IdentityTheft.gov	Free
Same week	Get and review your credit reports	AnnualCreditReport.com	Free, weekly
Same week	Secure email and other accounts	Each provider's official site	Free
Following weeks	Dispute and block fraudulent information	Credit bureaus and businesses involved	Free
Ongoing	Monitor and keep records	Your own log	Free

Step 1: Call the Companies Where Fraud Happened

The FTC's first step is to contact the fraud department of each company where you know fraud occurred. Explain that someone stole your identity and ask them to close or freeze the affected accounts, so that no new charges can be added unless you agree. Then change the logins, passwords and PINs for those accounts.

Use a phone number from your card, your statement or the company's official website, never one from a message or caller who contacted you. Ask what the company needs from you in writing, and note who you spoke to and when.

Step 2: Place a Fraud Alert and Freeze Your Credit

According to the FTC, you can place a free, one-year fraud alert by contacting any one of the three credit bureaus, and that bureau must tell the other two. An initial fraud alert tells businesses to check with you, usually by contacting you, before opening a new account in your name. The FTC says you can place one even if you already have a credit freeze.

A credit freeze goes further. The FTC explains that while a freeze is in place, nobody can open a new credit account using your report, and freezes are free to place and lift. Unlike a fraud alert, you must contact each bureau separately. Our guide to credit freezes vs fraud alerts walks through both.

Step 3: Report Identity Theft at IdentityTheft.gov

Go to IdentityTheft.gov and tell the FTC what happened. You will get a free, personal recovery plan, and the FTC says the site also lets you update your plan, track your progress and print pre-filled letters and forms to send to credit bureaus, businesses and debt collectors. The FTC says the site covers more than 30 types of identity theft, plus what to do after a data breach.

• To report in English, go to IdentityTheft.gov.
• To report in Spanish, go to RobodeIdentidad.gov.
• To report in another language, call 877-438-4338 and press 3. The FTC says interpreters are available from 9:00 a.m. to 5:00 p.m. Eastern time.

Completing the report gives you an FTC Identity Theft Report. Save and print it. Under the federal Fair Credit Reporting Act, an identity theft report is what unlocks the stronger rights described in Step 5, including the extended fraud alert, which lasts seven years.

Step 4: Get and Review Your Credit Reports

You can get free credit reports from all three bureaus at AnnualCreditReport.com, the only site authorized by federal law for this. The FTC says you can now check them every week for free. Read each report and list anything you do not recognize: accounts, addresses, employers, hard inquiries or collections.

Be careful with lookalike sites that ask for payment or push paid monitoring. The official site does not require a credit card.

Step 5: Remove Fraudulent Information

This is the step most guides skip, and it is where your credit actually gets repaired. The Fair Credit Reporting Act gives identity theft victims specific rights, summarized by the Consumer Financial Protection Bureau (CFPB) and the FTC:

• Blocking. If you send a credit bureau a copy of your identity theft report, proof of identity and a list of the fraudulent items, the bureau must generally block that information from your report within four business days of accepting your request.
• Disputes. You can dispute errors with each bureau and with the business that reported the information. The bureaus generally must investigate within 30 days.
• Documents from businesses. You have the right to get copies of applications and records for accounts opened in your name, if you provide proof of identity and your identity theft report.
• Debt collectors. You can tell a collector that the debt resulted from identity theft. IdentityTheft.gov provides sample letters for this.
• Extended fraud alert. With an identity theft report, you can place a seven-year fraud alert, and the bureaus must remove you from prescreened credit offers for five years unless you ask otherwise.

Send disputes and blocking requests in a way you can track, keep copies of everything and note the dates.

Step 6: Secure Your Accounts

While you work through the plan, tighten your own accounts so the thief cannot come back:

• Start with your main email account. Change the password to a long, unique one and review the recovery phone number and email. Whoever controls your email can reset most other accounts.
• Turn on two-factor authentication for email, banking, your mobile carrier and social media. The FTC notes this makes it harder for scammers to log in even if they have your password. An authenticator app or security key is stronger than text messages; see two-factor authentication explained.
• Use unique passwords everywhere, ideally with a password manager. Change any password you reused.
• Protect your phone number. Add a PIN and SIM lock with your carrier; our guide to SIM swap attacks explains why.
• Review devices and apps signed in to your accounts and remove anything unfamiliar. See how to check which devices have access to your account.

Step 7: Handle Special Situations

Tax-related identity theft

If someone used your Social Security number to file a tax return, or your e-filed return is rejected because one was already filed, follow the IRS identity theft guide. The IRS says most people do not need to file Form 14039, the Identity Theft Affidavit; for example, do not file it if the IRS already sent you a letter about the issue or if you already filed it through IdentityTheft.gov. Follow any IRS letter that arrives by mail. To help prevent repeat attempts, the IRS offers an Identity Protection PIN, a six-digit number that prevents someone else from filing a return with your Social Security number. Anyone who can verify their identity can get one, and a new PIN is issued each year.

Social Security

The Social Security Administration recommends creating your own my Social Security account at ssa.gov, which helps stop someone else from opening one in your name.

Money lost to a scam

Contact your bank, card issuer or payment app immediately and ask whether the payment can be reversed. If the fraud involved your Google account, see how to recover a hacked Gmail account.

Medical and government benefits

The FTC notes that most monitoring services will not alert you if someone uses your information for Medicare, Medicaid, Social Security or unemployment benefits, or to file a tax return. Read every benefits statement and explanation of benefits from your insurer, and report anything unfamiliar to the agency or insurer involved.

Do You Need to Pay for Monitoring or Recovery Services?

The FTC says companies sell credit monitoring, identity monitoring, recovery services and identity theft insurance, and that you may be able to do some of what recovery services offer on your own for little or no cost. It also says identity theft insurance generally will not reimburse money stolen by scammers. Before paying, remember that free weekly credit reports and a free freeze cover much of what monitoring offers. Watch out for follow-up scams too: callers who promise to recover your losses for an upfront fee are a known trick.

Keep a Recovery Log

Keep a simple record of dates, company names, people you spoke with, reference numbers and copies of letters and emails. Keep your FTC Identity Theft Report with it. If a bill or collection notice arrives months later, compare it with your log before responding. Our guide on what to do after a data breach covers the steps if your information was exposed but not yet misused.

Frequently Asked Questions

Do I need a police report?

Often not. The FTC Identity Theft Report from IdentityTheft.gov is accepted for most purposes, including an extended fraud alert. Some companies or situations may still require a police report, and your recovery plan will tell you when.

Does reporting at IdentityTheft.gov cost anything?

No. It is the FTC's free government site, and the recovery plan is free.

Should I place a freeze or a fraud alert?

The FTC says you can place both. A fraud alert asks businesses to verify it is you; a freeze stops new credit accounts entirely until you lift it.

How long does recovery take?

It varies with the type of fraud. Closing accounts and placing alerts can be done in a day; disputes and corrections can take weeks. Bureaus generally have 30 days to investigate a dispute.

Will fraudulent debts hurt my credit?

They can until they are blocked or removed. Use your identity theft report to request a block and dispute each item.

How do I avoid fake recovery sites?

Type the address yourself. The official FTC site is IdentityTheft.gov, a .gov address, and the only official free credit report site is AnnualCreditReport.com.

Conclusion

When your identity is stolen, work through the list in order: call the fraud departments, place a fraud alert and freeze your credit, report at IdentityTheft.gov, read your credit reports, then use your identity theft report to block and dispute fraudulent information. Lock down your email, phone number and other accounts, keep a log and stay alert for follow-up scams. Every official step is free, and starting early gives you the best chance of limiting the damage.

By Safe Sign In Editorial Team