The average identity theft victim spends 200 hours over 6 months resolving the damage. The financial loss averages $5,000 out of pocket. The difference between a manageable incident and a multi-year nightmare is almost entirely determined by how fast you act and how systematically you document.
Step 1: Freeze your credit immediately (all three bureaus)
A credit freeze (also called a security freeze) prevents any new lender from accessing your credit file, which means no new accounts can be opened in your name. This is the most powerful single action you can take. It is free, reversible, and does not affect your existing accounts or credit score.
You must do this with each bureau separately — freezing with one does not freeze the others:
- Equifax — equifax.com/personal/credit-report-services or 1-800-685-1111
- Experian — experian.com/freeze/center or 1-888-397-3742
- TransUnion — transunion.com/credit-freeze or 1-888-909-8872
You will receive a PIN or access code for each bureau — store these somewhere secure. You need them to temporarily lift the freeze when you apply for legitimate credit.
Step 2: File an Identity Theft Report with the FTC
Go to IdentityTheft.gov — this is the FTC's official resource. The report generator walks you through your specific situation (tax fraud, fraudulent accounts, medical fraud, etc.) and generates a personalized recovery plan along with an official FTC Identity Theft Report. This report has legal weight — it helps you dispute fraudulent accounts with creditors and provides documentation for law enforcement. Print and save it.
Step 3: File a police report
Contact your local police department to file a report. Many identity theft incidents are not local crimes and police resources are limited, but the report number is useful documentation when disputing fraudulent accounts. Some creditors require it. Bring your FTC report, a government ID, proof of address, and any evidence of the theft.
Step 4: Contact affected financial institutions
Call every bank, credit card company, and lender involved in fraudulent activity. Use the number on the back of your card or the official website — not a number in a suspicious email. Report the fraud, request new account numbers, and ask about their fraud resolution process. Most institutions have dedicated fraud departments that can initiate chargebacks and close fraudulent accounts.
Step 5: Dispute fraudulent accounts on your credit report
Get your free credit reports from annualcreditreport.com (the FTC-mandated free report site — not to be confused with paid services). Review all three bureaus for accounts you do not recognize. Dispute fraudulent accounts in writing — include your FTC Identity Theft Report, police report number, and a copy of your ID. Bureaus are required to investigate disputes within 30 days.
Step 6: Secure your accounts
- Change passwords on all financial, email, and government accounts — starting with email (which controls password resets everywhere else).
- Enable two-factor authentication on every important account. Use an authenticator app (not SMS where avoidable — SIM swap attacks can intercept SMS codes).
- Check for unauthorized password reset emails or account change notifications in your email history.
- Verify your email has not been set to forward messages to an unknown address (a common persistence technique).
Step 7: Set up ongoing monitoring
Identity theft is rarely a single incident. Once your data is in the ecosystem, it continues to be sold and used. After the immediate recovery, set up credit monitoring to watch for any new fraudulent activity going forward.
Special cases
Tax identity theft — If someone filed taxes using your SSN, file an IRS Identity Theft Affidavit (Form 14039) immediately. The IRS will flag your account and issue an IP PIN for future returns. Response times are slow (6-12 months) but the process is well-established.
Medical identity theft — Request copies of your medical records from providers and your insurance company's Explanation of Benefits statements. Dispute any treatment you did not receive — fraudulent medical records can affect your actual care and insurance coverage.
Social Security fraud — Create an account at ssa.gov/myaccount and review your earnings record. If unauthorized earnings appear, contact the SSA's fraud reporting line.