Identity Theft: What to Do, How to Report It, and How to Recover

What to do in the first hour

Start with the company where the fraud happened, then report the theft to the Federal Trade Commission, then protect your credit file. That order stops the account that is actively losing money first and produces the paperwork every later step asks for.

If you are reading this because a message told you your identity was stolen, do not use any phone number or link in that message. Look up the company yourself. Criminals often follow a real theft with a second contact pretending to help.

1. Call the company where the fraud happened, right now. Use the number on your card, your statement, or the company’s own website. Ask for the fraud department. Ask them to close or freeze the account, stop pending transactions if they still can, and send you written confirmation of what you reported and when.
2. Secure your email first, then your money accounts. Email is the reset channel for almost everything else. Change that password, then bank, card, and payment app passwords. Turn on two-step verification everywhere it is offered. Use a device you trust.
3. Report the theft at IdentityTheft.gov. The Federal Trade Commission runs IdentityTheft.gov, which is free and produces a recovery plan plus an FTC Identity Theft Report.
4. Place a fraud alert or a credit freeze. Both are free. The FTC explains the difference, and our step-by-step guide to freezing your credit walks through each bureau.
5. Pull your credit reports. The three nationwide credit bureaus let you check your report from each once a week for free at AnnualCreditReport.com, according to the FTC. Read every account, address, and inquiry.
6. Write everything down as it happens. Date, time, who you spoke to, the reference number, what they promised. Save every letter and email. This file is what makes the disputes work later.

How to report identity theft to the FTC

You report identity theft to the federal government at IdentityTheft.gov, the Federal Trade Commission site built for this. It costs nothing, and the FTC says it gives you a free personal recovery plan with next steps.

The site asks what happened and what information was used. Based on your answers it builds a checklist, tracks what you have already done, and generates letters you can send to companies and to the credit bureaus. It covers more than thirty types of identity theft, so answer the questions as specifically as you can rather than choosing the closest general option.

What you get at the end matters more than the form itself. The filing produces an FTC Identity Theft Report. That document is what unlocks two rights later on: an extended fraud alert at the credit bureaus, and a request to block fraudulent information from your credit report. Save a copy as a file, print one, and keep the reference number somewhere you will find it in six months.

The FTC does not investigate your individual case or recover money for you. It collects reports, feeds them to law enforcement, and gives you standing with the companies you have to deal with. Knowing that up front prevents the frustration of waiting for a call that is not coming.

When to file a police report

A police report is not always required, but some companies and some creditors ask for one before they will remove a fraudulent account. File one when a company requests it, when you know the person who used your information, or when the theft involved a stolen wallet, mail, or documents.

Bring your FTC Identity Theft Report, a government photo ID, proof of your address, and any evidence you have of the theft: statements, letters from creditors, screenshots. Ask for a copy of the report or the report number before you leave, and ask whether the department files identity theft reports for residents when the crime happened elsewhere.

Some departments will tell you the crime belongs to the jurisdiction where the account was opened. If that happens, ask them to take an informational report anyway and write down who you spoke to. A refusal is worth documenting, because it explains a gap later if a creditor asks why there is no police report.

Someone opened an account in my name

Contact the fraud department of the company that opened the account, in writing, and tell them the account is the result of identity theft. Ask them to close it, stop collection on it, and confirm in writing that you are not responsible for it. Do this even if the account is small or already closed.

Call first to get the case moving, then send a letter so there is a dated record. IdentityTheft.gov generates letters for this, prefilled with your case details, including a request for the records connected to the fraudulent account. Those records, such as the application and the address used, are often how you find out what other information the thief had.

Ask four questions of every company and write down the answers. When was the account opened. What address, phone number, and email are on it. What documents were used to open it. What is the case number for your fraud report. If the company hands the debt to a collector anyway, the Consumer Financial Protection Bureau explains that once fraudulent information is blocked, creditors are notified and cannot turn identity theft related debts over to debt collectors.

If the account is with a bank or a card issuer

Unauthorized transactions on a bank account or a card have their own rules and their own clocks, and the protection often depends on how fast you notify the institution. Report it by phone and in writing, keep the confirmation, and ask the bank to tell you in writing what it decided and why.

How to remove fraudulent accounts from your credit report

There are two separate routes, and identity theft victims can use the stronger one. A block asks the credit bureau to remove information that resulted from identity theft, using your FTC Identity Theft Report. A dispute asks the bureau and the company to investigate whether the information is accurate.

For the block, the CFPB says you send an identity theft report, proof of your identity, and a letter identifying the fraudulent accounts, and that credit reporting companies must block fraudulent information from your credit report within four business days after receiving your request. Send it to each of the three bureaus separately.

For a dispute, the CFPB says to dispute with both the credit reporting company and the furnisher, the company that supplied the information, and that furnishers generally must investigate and respond within thirty days of receiving the dispute. If the information is wrong or cannot be verified, the furnisher must update or remove it and notify the credit reporting companies.

Check all three reports, not one. Bureaus do not carry identical data, and a fraudulent account can sit on one file and not the others. Pull them free each week at AnnualCreditReport.com while the case is open, and read the addresses and employers as carefully as the accounts. An address you have never lived at is often the first sign of where the mail was being sent.

Freeze your credit and decide about alerts

A security freeze restricts access to your credit report, which makes it harder for someone to open a new account in your name. It is free by federal law and you place it at each of the three nationwide credit bureaus separately, as the CFPB explains.

A fraud alert works differently. The FTC says you contact one of the three bureaus and that one tells the other two, an initial alert lasts one year and can be renewed, and an extended alert lasts seven years but requires that you have experienced identity theft and completed an FTC identity theft report. An alert asks businesses to verify your identity first. It does not close the file.

If you already know accounts were opened, a freeze is the stronger move, and the extended alert is available to you because you filed the FTC report. Our guide to freezing your credit covers the exact steps at Equifax, Experian, and TransUnion, and what happens when you need to apply for credit while frozen.

Neither tool is retroactive. A freeze placed today does nothing about an account opened last month, and an alert does not remove anything. Those are the jobs of the block and the dispute described above.

Identity theft a credit report will never show

A credit report covers credit accounts. It does not show a fraudulent tax return, misuse of your Social Security number for work, a medical claim filed under your name, or a benefit claimed in your name. Each of those has its own agency and its own report.

For tax identity theft, the IRS Identity Theft Central page is the starting point. The IRS guide for individuals lists the signs, including a tax return that is rejected because one was already filed, a Form W-2 from an employer you never worked for, or a Social Security account showing wages you did not earn. It also explains when to file Form 14039, the Identity Theft Affidavit, and how to get an Identity Protection PIN.

For a stolen Social Security number, the Social Security Administration directs people to report identity theft to the FTC, and is clear that Social Security does not handle identity theft cases itself. Suspected misuse of a number or of Social Security benefits goes to the SSA Office of the Inspector General. Our guide on a stolen Social Security number covers the tax and benefit side in detail.

Online crime, including account takeover and fraud that came out of a hacked service, can also be reported to the FBI at the Internet Crime Complaint Center. If a bank, card issuer, credit bureau, or debt collector will not resolve your case, you can submit a complaint to the CFPB. If your information was exposed in a company breach rather than already misused, start with what to do after a data breach instead.

What recovery realistically looks like

Recovery is a sequence of letters, calls, and waiting periods, not a single fix. Some cases close in weeks when one account is involved. Cases where a Social Security number was used across several companies can run for months, and information can reappear when a furnisher reports it again.

No agency, service, or lawyer can guarantee that every trace is removed or that money is returned. What you can control is the record: the FTC report, the police report if you have one, the written confirmations from each company, and the dispute letters with dates. When something resurfaces, that file is what makes the second round short.

Plan on checking your three credit reports on a schedule for at least the next year, and reading bank and card statements line by line each month rather than glancing at the balance. Set transaction alerts with your bank so a charge tells you about itself.

Be careful with anyone who contacts you offering to recover your money or clean your record for a fee. Recovery offers target people who were already hit, precisely because the list of victims is known. The federal recovery process is free, and no legitimate agency asks for payment in gift cards, wire transfers, or cryptocurrency.

None of this is a comment on you. Identity theft usually starts with information a company held, not with something you did wrong, and the criminal is the one who broke the law.

Reporting identity theft FAQ