You check your bank account and see charges you didn’t make. Or a debt collector calls about a credit card you never opened. Or the IRS says your tax return was already filed. Your stomach drops. This is really happening.
The actions you take in the next 24 hours will determine how much damage an identity thief can do and how quickly you recover. Here’s exactly what to do, in order, starting right now.
Hour 1: Stop the Bleeding
Call your bank and credit card companies. Every financial institution you have a relationship with needs to know immediately. Report the fraudulent charges, lock or freeze your debit and credit cards, and request new account numbers. Most banks have 24/7 fraud hotlines, and the number is usually on the back of your card or in your banking app.
Don’t just lock the cards with the fraudulent charges. If a thief has your information, assume they may target other accounts too. Alert every bank, credit union, and credit card company where you hold an account. Ask each one to flag your account for potential fraud and enable enhanced verification for any changes.
Change your passwords immediately. Start with your email, because email is the gateway to resetting passwords on everything else. Then move to banking, investment, and credit card account passwords. Use a different, strong password for each one. If you don’t use a password manager, now is the time to start. Bitwarden is free and takes minutes to set up.
Hours 2-4: Lock Down Your Credit
Freeze your credit at all three bureaus. If you haven’t already done this, do it now. This prevents the thief from opening any new accounts in your name.
- Equifax: equifax.com/personal/credit-report-services or call 1-800-685-1111
- Experian: experian.com/freeze or call 1-888-397-3742
- TransUnion: transunion.com/credit-freeze or call 1-888-909-8872
You’ll receive a PIN from each bureau. Write these down and store them somewhere secure. You’ll need them whenever you want to temporarily lift the freeze.
Place a fraud alert. This is different from a freeze. A fraud alert tells creditors to take extra steps to verify identity before approving new credit. You only need to contact one bureau; they’re required to notify the other two. An initial fraud alert lasts one year and is free.
While you’re at it, request your credit reports from all three bureaus at AnnualCreditReport.com. Review them carefully for accounts you don’t recognize, addresses you’ve never lived at, and inquiries you didn’t authorize. Make a list of everything that looks wrong. You’ll need this for your reports.
Hours 4-6: File Official Reports
File a report at IdentityTheft.gov. This is the FTC’s official identity theft reporting site. Walk through their questionnaire about what happened, and the site will generate a personalized recovery plan with specific steps for your situation. It will also create an FTC Identity Theft Report, which is an official document you’ll need when disputing fraudulent accounts and dealing with creditors.
Save and print this report. You’ll reference it repeatedly over the coming weeks.
File a police report. Go to your local police department and file a report about the identity theft. Bring your FTC Identity Theft Report, a government-issued ID, and any evidence you have (fraudulent charges, collection letters, etc.).
Some police departments will take identity theft more seriously than others. Regardless of how they respond, getting a police report on file is important because many creditors and bureaus require a police report number before they’ll remove fraudulent accounts.
Hours 6-12: Secure Everything Else
Contact the IRS. If you suspect tax-related identity theft (or even if you don’t), request an Identity Protection PIN at irs.gov/ippin. This prevents anyone from filing a tax return using your Social Security number without the PIN. If a fraudulent return has already been filed, submit IRS Form 14039 (Identity Theft Affidavit).
Call your mobile carrier. Set up a PIN or account passcode that must be provided before any changes can be made to your account. This prevents SIM swapping, where a thief transfers your phone number to their device and intercepts your two-factor authentication codes.
Check your health insurance. Call your insurer and request an accounting of all claims filed under your identity. If a thief has your insurance information, they may have used it for medical services. Fraudulent medical claims can affect your coverage limits and, worse, contaminate your medical records with someone else’s health information.
Enable two-factor authentication everywhere. If you haven’t already, turn on 2FA for every account that offers it. Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) instead of SMS text codes. Text-based codes can be intercepted through SIM swapping.
Hours 12-24: Document and Dispute
Dispute fraudulent accounts in writing. For every fraudulent account or charge on your credit reports, send a written dispute to the credit bureau reporting it. Include your FTC Identity Theft Report and police report. The bureaus are required to investigate and respond within 30 days.
Send disputes by certified mail with return receipt. Keep copies of everything you send.
Contact creditors directly. For each fraudulent account, call the company’s fraud department. Inform them the account was opened through identity theft and provide your FTC report and police report numbers. Request that they close the fraudulent account and send you written confirmation that you’re not responsible for the debt.
Create a recovery folder. Start a physical or digital folder where you keep everything related to this incident. Every letter you send, every response you receive, every phone call (log the date, time, person you spoke with, and what was discussed). Identity theft resolution can take months, and organized records make the process significantly smoother.
The Week After
Set up ongoing monitoring. Check your credit reports weekly for the next several months. Set up transaction alerts on all financial accounts. Consider enrolling in a free credit monitoring service, but understand that monitoring only notifies you of problems after they occur. Your credit freeze is doing the actual prevention.
Check your Social Security record. Log into SSA.gov and review your earnings record. If there’s income from an employer you never worked for, someone may be using your SSN for employment.
Scan data broker sites. Search your name on sites like Spokeo, WhitePages, and BeenVerified. If detailed personal information is publicly available, remove it to make it harder for the thief (or others) to continue exploiting your identity.
One Thing To Remember
Identity theft recovery is a process, not a single event. The first 24 hours are about containment: stopping active fraud, locking down accounts, and filing reports. The weeks that follow are about cleanup: disputing accounts, correcting records, and monitoring for new activity.
It’s stressful and frustrating. But every step you take in that first day dramatically reduces the total damage and accelerates your recovery. You’ve got this. Start at the top of this list and work your way down.
