🔒 Identity Theft Recovery: What to Do First

By Muhammad Imran · Reviewed for accuracy against Federal Trade Commission, Internal Revenue Service, Social Security Administration, and Consumer Financial Protection Bureau guidance · Last updated November 3, 2026.

Someone used your name, your Social Security number, or your accounts, and now you are the one left to clean it up. It feels unfair, because it is. But there is a fixed, official path through this, and it works. The Federal Trade Commission received more than 1.1 million identity theft reports in 2024, and credit card fraud was the most common type, with 449,032 reports. You are not the only person going through this, and you are not starting from zero. This page walks through the recovery in the order that matters: stop the bleeding first, then get your official report, then close the fake accounts, then clear your credit reports, then deal with taxes and Social Security if the thief touched those. Every step below comes from the FTC, the IRS, the Social Security Administration, or the Consumer Financial Protection Bureau. If you would rather have someone walk you through it on the phone, the FTC takes identity theft reports at 1-877-438-4338.

How to tell your identity was stolen

Sometimes the theft is obvious. Sometimes it shows up as a small surprise that does not make sense. Any one of these is a reason to act now, not later.

• You get a bill, a statement, or a collection letter for an account you never opened, or for charges you never made.
• A credit card, loan, or store account application is denied, even though you pay your bills, or you get a call about a debt that is not yours.
• Your tax return is rejected because someone already filed one with your Social Security number, or you get an IRS notice about income from a job you never had.
• Bills stop arriving, or you stop getting mail you expect. A thief may have changed your address.
• You see withdrawals, new accounts, or unfamiliar charges when you check your bank or card statements.
• You get a notice that your information was in a data breach, and then strange accounts start appearing.
• A debt collector calls about a medical bill for care you never received, or your health plan says you reached your benefit limit when you did not.

If even one of these fits, treat it as identity theft until you prove otherwise. Waiting gives the thief more time to open more accounts in your name.

The first 24 hours: do these in order

Speed matters most on day one. The thief can only open new accounts while your credit is open, and every fraudulent account gets harder to remove the longer it sits. Do these four things in order, and write down who you talked to and when.

1. Call the fraud department of every company where you see fraud. Tell them someone stole your identity. Ask them to close or freeze the account so no new charges can be added. Change the passwords and PINs on those accounts, and on any account that shares a password with them.
2. Freeze your credit at all three bureaus. A freeze is free, it does not hurt your credit score, and it stops most lenders from opening new accounts in your name. You must place it with each bureau separately: Equifax at 800-685-1111, Experian at 888-397-3742, and TransUnion at 888-909-8872. You can also do it online at each bureau's website. The freeze stays in place until you lift it.
3. Report it at IdentityTheft.gov. This is the FTC's official site, and it is free. Answer the questions about what happened, and the site builds a personal recovery plan for your exact situation, plus an FTC Identity Theft Report. That report is the document that proves to businesses and credit bureaus that someone stole your identity. If you do not have a computer, call the FTC at 1-877-438-4338 and they will take the report by phone.
4. Check your credit reports. Go to AnnualCreditReport.com, the only federally authorized site for free credit reports, or call 1-877-322-8228. You can check each of your three reports every week for free. Look for accounts, addresses, and employers you do not recognize, and write them all down. That list is what you will dispute in the next steps.

If the thief opened a checking account in your name, order a free ChexSystems report at 1-800-428-9623. If they opened phone, electric, or other utility accounts, ask for your NCTUE report at 1-866-349-5185. If a federal student loan was taken out in your name, call the Department of Education's Inspector General at 1-800-647-8733.

Freeze or fraud alert: which one, and what is the difference

Both tools are free, and both are backed by federal law. They do different jobs, and after identity theft you usually want the freeze. Here is the difference in plain words.

There is also an extended fraud alert, which lasts seven years. It is only for confirmed identity theft victims, and you need your FTC Identity Theft Report to get it. Like a regular alert, you place it with one bureau and that bureau tells the other two. An extended alert also takes you off marketing lists for unsolicited credit and insurance offers for five years.

If your identity was stolen, place the freeze. You can add a fraud alert on top of it. The two work together, and neither one costs you anything.

Your FTC Identity Theft Report and recovery plan

IdentityTheft.gov is the single most useful step in the whole recovery. It is run by the Federal Trade Commission, it is free, and it does three things no other site does.

First, it asks you what happened and builds a personal recovery plan for your exact situation, with the steps in order and the letters already filled in for you. If you create an account, the site walks you through each step, updates the plan as you go, and tracks your progress. If you do not create an account, print and save your report and your plan right away. Once you leave the page, you cannot get them back.

Second, it creates your FTC Identity Theft Report. This is the official document that proves to businesses and credit bureaus that someone stole your identity. It guarantees you certain rights under the law. When you send a copy of it with a dispute, the credit bureaus must block the fraudulent information from your file. Without it, you can still dispute, but there is no guarantee the bureau will remove the item.

Third, it gives you the letters. The site pre-fills dispute letters to the credit bureaus, letters to the businesses where accounts were opened, and letters to debt collectors. You print them, sign them, and mail them. That is the whole system, and it is free.

Close the accounts the thief opened

Now that you have your FTC Identity Theft Report, call the fraud department of each business where an account was opened in your name. Use the number on the back of your own card or on the company's real website, never a number from a suspicious message.

• Explain that someone stole your identity. Say it plainly, then tell them which account and which charges are fraudulent.
• Ask them to close the account so no new charges can be added.
• Ask for a letter confirming that the fraudulent account is not yours, that you are not liable for it, and that it was removed from your credit report. Keep that letter. If the account shows up on your credit report later, that letter is your proof.
• Send them your report if they ask. The business may require a copy of your FTC Identity Theft Report or ask you to fill out their own dispute form. IdentityTheft.gov gives you a sample letter for this.
• Write down who you contacted and when. Names, dates, and reference numbers go in one notebook or folder, and stay there.

Do the same for accounts the thief used but did not open: a credit card they charged on, a bank account they drained, a store account they ran up. Tell the company which charges are fraudulent and ask them to remove the charges and send you a confirmation letter.

Get the fraud off your credit reports

Closing the accounts is half the job. The other half is getting the fraudulent information off your credit reports, because that is what lenders, landlords, and employers see.

If a debt collector contacts you about a debt from identity theft, write to the collector within 30 days of getting the collection letter. Tell them someone stole your identity and you do not owe the debt, and send copies of your Identity Theft Report and any other documents that show the theft. Then contact the business where the account was opened and tell them to stop reporting the debt to the credit bureaus.

Write to each of the three credit bureaus. Include a copy of your FTC Identity Theft Report and proof of your identity, like your name, address, and Social Security number. Explain which information on your report came from identity theft, and ask them to block that information. IdentityTheft.gov gives you a sample letter for this. The bureaus' fraud departments are: TransUnion Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19016, 1-800-680-7289; Equifax, P.O. Box 105069, Atlanta, GA 30348-5069, 1-800-525-6285; Experian, P.O. Box 9554, Allen, TX 75013, 1-888-397-3742.

When you include your FTC Identity Theft Report, the bureaus must honor your request to block the fraudulent information. Once information is blocked, it will not show up on your credit report, and companies cannot try to collect the debt from you.

If you do not have an FTC report yet, you can still dispute incorrect information. The Consumer Financial Protection Bureau publishes sample dispute letters you can use. Under the Fair Credit Reporting Act, the bureau must investigate your dispute, generally within 30 days. If the company that reported the information cannot prove it is accurate, the bureau must remove it. Send your dispute by mail, keep copies of everything, and never send original documents.

If a bureau denies your dispute or ignores it, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or 1-855-411-2372. Dispute with the bureau first: the CFPB's complaint page says you must first dispute the information directly with the credit reporting company. A CFPB complaint gets a stuck dispute a second look, and it creates an official record.

Check your reports again a month later at AnnualCreditReport.com. Fraudulent accounts sometimes come back, and the confirmation letters you collected are what you use to get them removed a second time.

If your taxes were hit

Tax identity theft has its own path, and it is the slowest part of the whole recovery. A thief files a tax return in your name and takes the refund, or uses your Social Security number to get a job and reports wages you never earned. You usually find out when your own return is rejected, or when the IRS sends you a notice about income you never had.

File IRS Form 14039, the Identity Theft Affidavit, but only if your situation is one of three: someone filed a fraudulent federal return in your name, someone fraudulently claimed you or your dependent, or someone used your Social Security number for employment. If your identity theft did not touch your taxes, do not file this form. Report it to the FTC instead. And do not file a second Form 14039 for the same incident: it slows things down instead of speeding them up.

The IRS's preferred way to file is online at irs.gov/dmaf/form/f14039. The online version does not accept attachments, so if you need to include supporting documents, mail the paper form to Department of the Treasury, Internal Revenue Service, Fresno, CA 93725. If your e-filed return was rejected because a return was already filed under your number, file a paper return and attach Form 14039 to the back of it.

Two warnings that save people months of wasted effort. First, if the IRS sent you a letter asking you to verify your identity, like Letter 5071C, follow the instructions in that letter instead of filing Form 14039. Second, get an Identity Protection PIN, a six-digit number that stops anyone else from filing a return with your Social Security number. It is free, it is a separate opt-in that is not automatic after you file Form 14039, and you get one at IRS.gov/pin. A new PIN is issued every year.

Be honest with yourself about the wait. The National Taxpayer Advocate reported that the IRS took an average of about 21 months to resolve identity theft cases in fiscal year 2025, with about 316,000 cases still open. Your refund stays frozen while the case is open. If you need help during the wait, call the IRS Identity Protection Specialized Unit at 1-800-908-4490, Monday through Friday, 7 a.m. to 7 p.m. local time. You can also check your case in your IRS online account at irs.gov/account.

If your Social Security number was misused

Your Social Security number is the key the thief used, so check what they did with it. Create a my Social Security account at ssa.gov and review your earnings record. If you see wages from an employer you never worked for, someone used your number to get a job. Contact your local Social Security office to correct the record, and file Form 14039 with the IRS for the fraudulent wages.

Report the misuse to the Social Security Administration's Office of Inspector General at 1-800-269-0271 or at oig.ssa.gov. That creates a formal record with the agency that issued your number. Know this plainly: the Social Security Administration says it does not handle identity theft issues. It keeps your earnings record and issues numbers. The FTC is where identity theft gets reported, and the freeze is what stops new accounts.

Many people ask for a new Social Security number. The answer is almost always no. The Social Security Administration will only assign one if you have done everything you can to fix the problems and someone is still using your number, and a new number does not give you a fresh start: other agencies still have records linking you to your old number, and your credit history does not move to the new one. A freeze and disputes fix more than a new number would.

One more lock is worth knowing about. E-Verify, run by the Department of Homeland Security and the Social Security Administration, lets you lock your Social Security number so it cannot be used to get a job. Set it up at e-verify.gov/mye-verify. When someone tries to use a locked number with an employer that uses E-Verify, that employer has to get more information from the person trying to use it.

Medical identity theft

Medical identity theft is when someone uses your name, Social Security number, health insurance number, or Medicare number to get medical care, prescription drugs, or medical devices, or to submit claims with your insurance provider. It is one of the hardest kinds to untangle, because the thief's health information gets mixed into your medical records, and that can affect the care you receive.

Watch for these signs: a bill for medical services you did not receive; a debt collector about medical debt you do not owe; medical collection notices on your credit report you do not recognize; errors on your Explanation of Benefits; being told you reached your benefit limit when you did not; or being denied insurance because your records show a condition you do not have.

If you see any of those, get your medical records from each doctor, clinic, hospital, pharmacy, lab, and insurance company where the thief may have used your information. Review them for visits you did not make and services you did not get. Report each error in writing, by certified mail or another method that lets you confirm someone received it. The provider must respond within 30 days and notify other providers who may have the same mistake in their records.

Also report it to your health plan's fraud department, and to the FTC at IdentityTheft.gov. If the thief used your Medicare number, report it to Medicare at 1-800-633-4227. Then dispute any medical collection on your credit report the same way you dispute any other fraudulent account: in writing, with a copy of your FTC Identity Theft Report.

When the thief is someone you know

Often the thief is not a stranger. It is a relative, a caregiver, or someone who had access to your mail, your wallet, or your home. If a caregiver or aide is the thief, report them to the agency that sent them and to Adult Protective Services in your state. This is the hardest kind to report, and it is also the kind where the official steps matter most, because feelings cannot close an account.

The recovery steps are identical whoever the thief is. The freeze works the same way. The FTC report works the same way. The dispute rights work the same way. No creditor will ask you to prove the thief was a stranger before they close a fraudulent account.

The one step people skip is the police report, because it means naming a family member. Here is what is true: your FTC Identity Theft Report is itself an official report to law enforcement, and it is the document most businesses ask for. A local police report is an extra step that some creditors ask for. If a business asks for one, file it. Bring your FTC report, a photo ID, and proof of your address. You are reporting a crime, not starting a family fight, and the report protects you if the thief opens more accounts later.

When the victim has died

Thieves also steal the identities of people who have died, often by scanning obituaries. Until banks, credit bureaus, and agencies mark the record as deceased, a stranger can open cards, take out loans, or file for benefits in that person's name. Families usually discover it when a final tax return is rejected, or when collection calls start for accounts the person never had.

If you are the executor, you can report it. IdentityTheft.gov has a way to file a report on another person's behalf. Send a copy of the death certificate to each of the three credit bureaus and ask them to mark the file as deceased. Send the same to the person's banks and creditors. Watch for collection calls or bills for accounts opened after the death: those are fraud, not estate debts. A deceased person's real debts are generally paid from the estate, not from relatives' own money. If a collector contacts you about an account the person never had, treat it as fraud and report it.

How long does recovery take

There is no single answer, because it depends on what the thief did. Here are the two timelines you can count on.

Credit report disputes move in weeks. A bureau must investigate your dispute, generally within 30 days, and remove information it cannot verify. Most fraudulent accounts can come off your reports in a month or two if you send the disputes with your FTC Identity Theft Report.

Tax cases move in years. The National Taxpayer Advocate reported the IRS took an average of about 21 months to resolve identity theft cases in fiscal year 2025, with about 316,000 cases still open. The IRS's own target is 90 to 120 days, but the queue is the queue. File early, keep copies of everything, and check your IRS online account for updates instead of waiting for the mail.

Medical identity theft is the slowest to fully clear, because medical records live in many places and each provider has to correct its own files. Keep a folder with every letter you send and receive, every confirmation letter from a closed account, and a log of every call with the date, the name, and the reference number. Recovery is a paper trail, and the folder is what proves the theft is fixed when an account comes back.

What no company can do for you

You will see ads from companies that promise to fix identity theft for a monthly fee. Here is the plain truth: every step in the official process is free. The FTC report and recovery plan are free. The credit freeze is free. Fraud alerts are free. Disputes are free. The IRS affidavit is free. The Identity Protection PIN is free.

No company can make the IRS move faster than its own queue, and no company can get fraudulent information removed sooner than you can with an FTC Identity Theft Report, which forces the bureaus to block it. A company cannot do anything you cannot do yourself with the steps on this page. Anyone charging a fee to fix identity theft, or promising a faster refund, is selling what the government gives away free.

Watch for the second scam too. Days or weeks after the theft, someone may call offering to get your money back for a fee. Real agencies and banks never charge you to recover stolen money. Hang up and report the call to the FTC at ReportFraud.ftc.gov.

Keep it from happening again

Recovery ends with prevention. These are the habits that make a second theft much harder.

• Leave the freeze on. It costs nothing and it is the single strongest protection you have. Lift it only for a real application, and only at the bureau the lender will check, then freeze it again.
• Check your credit reports every week. AnnualCreditReport.com is free, and a weekly check catches new fraud while it is still small.
• Get your Identity Protection PIN from the IRS at IRS.gov/pin, and renew it every year. It stops anyone from filing a return with your Social Security number.
• Lock your Social Security number for employment at e-verify.gov/mye-verify.
• Read every Explanation of Benefits your health plan sends, and compare it with the care you actually received.
• Shred papers with personal information before you throw them away, and take mail out of the box as soon as you can.
• Use a different password for your email, your bank, and your my Social Security account, and turn on every alert those accounts offer.

If anything on this page feels confusing or rushed, show it to someone you trust before you act. Identity theft is not your fault, and the help to fix it is free.

Frequently asked questions

Related: Clicked Only? What to Do Right Now, Step by Step →

Related: Sent Money or Shared Payment Details? What to Do →

Related: Your Social Security Number Is Suspended? It Is a Scam →

Related: IRS Text Scams: The Rules the Real IRS Follows →

Related: Medical Bill Scams: Fake Bills, Real Money →

Related: Debt Validation Letter: Make the Collector Prove It →

Related: Your Medicare Summary Notice, Explained in Plain English →

Sources: Federal Trade Commission, IdentityTheft.gov: Recovery Steps and What To Know About Medical Identity Theft; Social Security Administration, Identity Theft and Your Social Security Number; Internal Revenue Service, Form 14039, Identity Theft Affidavit (Rev. February 2026) and Identity Theft Central; National Taxpayer Advocate, Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds; Consumer Financial Protection Bureau, Submit a Complaint; Federal Trade Commission, Consumer Sentinel Network Data Book 2024. Last updated November 3, 2026.