What to Do If Your Identity Is Stolen

Identity theft is the kind of situation that feels like a personal, financial, and legal attack – all at once. And it basically is. One day, everything looks normal. The next day, there is a bank charge you didn’t make, a credit card you never opened, a debt collector calling about an account you don’t recognize, or a credit score that suddenly makes no sense.

If you’re thinking, “I am a victim of identity theft. What do I do now?,” the answer is not wait and see if it clears up. You need to protect your money and your credit with some urgency.

What to do if your identity is stolen: contact your bank and card issuers, place a fraud alert, get your credit reports, file an FTC report, file a police report when needed, dispute fraudulent accounts, freeze your credit, and save every document as part of your identity theft recovery plan. Read all 8 steps on reacting to identity theft below.

What to Do If Your Identity Is Stolen: Step by Step

The right order matters. Some steps protect your money today and some protect your credit file and legal rights later.

1. Contact your banks and card issuers immediately

Start with the accounts where money can move right now: checking accounts, debit cards, credit cards, payment apps, and any account tied to automatic payments. Tell the bank or card issuer which transactions or accounts are fraudulent, ask them to close or lock affected cards, and request written confirmation of the fraud claim.

This step is especially time-sensitive for debit cards and electronic transfers. Under the Electronic Fund Transfer Act (EFTA), timing can affect how much liability a consumer may have for unauthorized electronic transfers.

• If you report a lost or stolen card (or unauthorized transfer) within two business days, liability is generally capped at $50.
• Waiting longer can increase your exposure to $500 if reported between 2 to 60 days.
• Waiting longer than 60 days from the moment the statement has been transmitted triggers unlimited liability (in other words, you may not be eligible for reimbursement of stolen money if you wait too long to report)

Credit card disputes have their own rules under the Fair Credit Billing Act (FCBA). A billing error notice usually must be received within 60 days after the first statement showing the disputed charge. The creditor must acknowledge the notice within 30 days unless it resolves the issue sooner, and it must resolve the dispute within two complete billing cycles, with a 90-day maximum.

2. Place a fraud alert with one credit bureau

If you suspect identity theft, place an initial fraud alert with Equifax, Experian, or TransUnion. You only need to contact one of the three bureaus. The bureau you contact must tell the other two to place the alert as well.

A fraud alert tells businesses to take extra steps to verify your identity before opening new credit in your name. An initial fraud alert lasts one year and is free. If you have an FTC Identity Theft Report or police report, you may qualify for an extended fraud alert, which lasts seven years.

This is one of the fastest and most important steps to take if you suspect identity theft but do not yet know the full damage.

3. Get your credit reports

Next, pull your credit reports and look for accounts, inquiries, addresses, names, balances, collections, and payment history you do not recognize. You can get free weekly online credit reports from Equifax, Experian, and TransUnion through AnnualCreditReport.com.

Don’t only check your credit score; it will tell you that something changed, but won’t tell you what changed. To fully understand what happened, you’ll need to check your actual report.

Save copies of all reports. If a fraudulent account later disappears and then comes back, or if a credit bureau says it “verified” information that was obviously fraudulent, the reports you save become part of your proof.

4. File an FTC Identity Theft Report

Go to IdentityTheft.gov and file an identity theft report with the Federal Trade Commission (FTC). The FTC report helps create a formal record of what happened and gives you a personalized identity theft recovery plan.

This report matters because many creditors, debt collectors, and credit bureaus will ask for documentation before they block or remove fraudulent information. The FTC report helps show that you’re not simply saying, “This is not mine.” You are formally reporting identity theft.

For a more detailed walkthrough, read our guide on how to file an FTC identity theft report.

5. File a police report when you need more documentation

A police report is not always the first document a consumer thinks to get, but it can be useful in many cases, including:

• when the fraud is serious,
• when a creditor asks for it,
• when a credit bureau will not cooperate,
• when your Social Security number was misused, or
• when the identity theft caused a denial, collection account, or legal problem.

Bring your FTC Identity Theft Report, government ID, proof of address, and any documents showing the fraud. Ask for a copy of the police report or at least the report number.

For more information, read our guide on why and how to report identity theft to the police.

6. Dispute fraudulent accounts and request removal

If a fraudulent account, collection, inquiry, address, or balance appears on your credit report, dispute it in writing with the credit bureaus and the company reporting the information. Include copies of your FTC report, police report if you have one, proof of identity, proof of address, and any documents showing why the account is fraudulent.

Under the Fair Credit Reporting Act (FCRA), credit bureaus generally have 30 days to conduct a reasonable reinvestigation after receiving a dispute. Identity theft also has a separate tool under the FCRA for when a consumer sends the required identity theft documentation and identifies information that resulted from identity theft- the credit bureau must block that information from the report within four business days, unless an exception applies.

This is where many identity theft cases become legal cases. If a credit bureau or furnisher keeps verifying fraudulent accounts as accurate after you submit proper documentation, the problem is no longer just identity theft. It may also be a credit reporting violation.

7. Freeze your credit

A credit freeze restricts access to your credit report, which makes it harder for someone to open new accounts in your name. A freeze is free to place and free to lift. Unlike a fraud alert, you must place a freeze separately with each of the three credit bureaus.

A credit freeze doesn’t fix existing fraud, but it helps stop new fraud. If your Social Security number, date of birth, or other sensitive information has been exposed, a freeze is often the strongest protection you can ask for at this point.

8. Keep a recovery file and document everything

Don’t rely on phone calls alone. Keep copies of credit reports, dispute letters, FTC reports, police reports, bank letters, emails, certified mail receipts, screenshots, denial letters, collection notices, and notes from calls.

Your identity theft recovery plan should include dates, names, phone numbers, confirmation numbers, and what each company told you. If the fraud is corrected quickly, this file helps you stay organized. If the credit bureaus or banks refuse to fix it, this file may become evidence.

So if questions like “What do I do if I suspect identity theft?” or “What should I do in case of identity theft?” are on your mind, these 8 steps are your go-to guide.  The sooner you act, the easier it may be to limit the damage.

How Long Does It Take to Recover from Identity Theft?

If you are trying to understand how to recover from identity theft, the honest answer is that recovery depends on the type of fraud, how quickly you find it and act on it, and how the banks, credit bureaus, creditors, and collectors respond.

• A simple credit card fraud issue may be resolved in a few weeks if the issuer reverses the charge quickly, closes the card, and no fraudulent credit reporting follows.
• A more involved case, such as a bank account takeover, unauthorized electronic transfer, or payment app fraud, can take longer because the bank has to investigate and decide whether to credit the account.
• Credit report identity theft often takes longer. If a fraudulent account appears on your credit report, the credit bureau generally has 30 days to investigate a dispute. If you submit a proper identity theft block request under the FCRA, the bureau has a much shorter timeline to block the fraudulent information. But in practice, some victims still deal with accounts that are verified, reinserted, transferred to collections, or sold to another debt collector.

So, can you recover from identity theft? Yes. But how challenging that recovery is depends on whether the companies involved follow the law. If the fraudulent activity is removed after the first round of disputes, recovery may take 2 to 6 weeks. If the bureaus, banks, furnishers, or debt collectors refuse to correct the record, recovery can take months and may require legal action – this usually helps precipitate procedures.

A lawyer cannot guarantee speed. But when a case is properly documented, an attorney can help identify legal violations, push past broken dispute loops, and pursue correction and compensation when the facts support it.

What Identity Thieves Can Do with Your Information

The damage from identity theft depends on what information was stolen and how it was used. A thief with a name and email address may use that information for phishing. A thief with a Social Security number, date of birth, address, and credit history can do far more.

Identity thieves may open credit cards, personal loans, auto loans, phone accounts, bank accounts, or utility accounts. They may use your information to make purchases, move money, file tax documents, obtain medical services, apply for benefits, rent housing, or pass background checks.

The credit damage can be severe. Fraudulent accounts can create missed payments, collections, charge-offs, hard inquiries, and high balances. A consumer may then be denied a mortgage, car loan, apartment, job, insurance policy, or credit card because someone else’s fraud is sitting in their file.

There is also the time and emotional cost. Identity theft victims often spend weeks or months calling banks, credit bureaus, creditors, police departments, and government agencies. The practical burden falls on the victim even though the victim did not create the problem.

How to Fix Your Credit After Identity Theft

Many victims ask how to fix identity theft or how to fix a credit score after identity theft. The first step is not a generic credit repair tactic. It is proving which accounts, inquiries, debts, addresses, or personal details came from fraud and forcing those records to be corrected or removed.

The answer is usually not as simple as filing one form or making one phone call. To fix credit after identity theft, you need to identify the fraudulent information, dispute it with the right parties, support the dispute with documents, and follow up when the response is wrong.

Start with all three credit reports. A fraudulent account may appear on one report but not the others. Mark every item that is not yours. This includes accounts, collections, inquiries, addresses, employers, phone numbers, or personal information connected to the fraud.

Then send written disputes to the credit bureaus and the furnishers reporting the information. A furnisher is the bank, lender, debt collector, credit card company, or other business that supplied the data to the credit bureau. Include copies of your FTC Identity Theft Report, police report if available, proof of identity, proof of address, and a clear list of what should be removed or corrected.

If the credit bureau removes the information, save the updated report. If the bureau verifies the account as accurate, sends a vague response, refuses to investigate, or lets the account come back later, speak with an identity theft lawyer. This may be the point where the dispute process has stopped working, and your legal rights under the FCRA need to be enforced.

A free credit report after identity theft is not enough by itself. The report shows the problem. The dispute and block request are what trigger the correction process. If the correction process fails, legal action may be necessary.

Credit Freeze, Credit Lock, or Fraud Alert?

When protecting your credit from identity theft, you have a few options: a credit freeze, a credit lock, and a fraud alert. Each serves a different purpose, and each offers varying levels of protection.

• A credit freeze, also known as a security freeze, is a tool that restricts access to your credit report, making it more difficult for identity thieves to open new accounts in your name. Most creditors need to see your credit report before opening a new account; they may not extend the credit if they can't see your file. A credit freeze doesn’t affect your credit score, and you can lift it temporarily or permanently using a PIN or password. Freezing your credit is free by law.
• A credit lock, like a credit freeze, restricts access to your credit report. Unlike a freeze, which requires a PIN or password to lift, a credit lock can be unlocked instantly, often through a mobile app. Credit locks might be part of a subscription service with credit reporting agencies.
• A fraud alert is less drastic than a freeze or lock. It tells businesses and creditors to take extra steps when verifying your identity before opening new accounts. This process might involve contacting you to ensure you're the person trying to take out new credit. A fraud alert is free to place and lasts for one year (or seven years if you've been a victim of identity theft and have a police report). Unlike freezes or locks, a fraud alert allows creditors to get your credit report as long as they take steps to verify your identity.

While all three options aim to protect against identity theft, freezes and locks directly block access to your credit report, with different levels of user convenience. At the same time, fraud alerts encourage additional verification steps by creditors. A consumer protection attorney can help you determine which is best for you.

When to Get a Lawyer After Identity Theft

Many identity theft problems start with self-help. If your bank reverses the charge, the creditor closes the fraudulent account, and the credit bureaus remove the false information after your first dispute, you may not need a lawyer.

But some cases don’t resolve that cleanly. You should consider talking to an attorney for identity theft victims if:

• The credit bureaus verify fraudulent accounts as accurate after you submit an FTC report, police report, or other proof.
• The same fraudulent account keeps coming back after it was removed.
• You are denied credit, housing, employment, insurance, or another opportunity because of identity theft information on your report.
• A bank, card issuer, payment app, debt collector, or lender refuses to correct the problem or sends you in circles.

An attorney can help review your credit reports, dispute history, bank responses, denial letters, and supporting documents. If the facts show that a credit bureau, furnisher, bank, or creditor violated federal law, an attorney can pursue claims for correction, compensation, and attorney’s fees where available.

Consumer Attorneys handles identity theft and credit reporting cases nationwide. If the dispute process fails or the fraud is still damaging your life, a free consultation can help you understand whether you have a legal claim.