If your identity has been stolen, take three actions right away: report the theft to the Federal Trade Commission (FTC) at IdentityTheft.gov to create your official recovery plan and Identity Theft Report, place a free fraud alert or credit freeze with the three nationwide credit bureaus, and contact any business where fraud happened to shut down or correct the account. These first moves lock down your credit and create the paper trail you will need to clear your name. Identity theft is stressful, but federal law gives you strong, specific rights to fix it, and most of these steps are free.
What Counts as Identity Theft
Identity theft means someone uses your personal information, such as your name, Social Security number, date of birth, or account numbers, without permission to commit fraud. Common examples include opening new credit cards or loans in your name, taking over an existing bank or credit account, filing a tax return to steal your refund, using your insurance to get medical care, or giving your name to police during an arrest. The recovery steps overlap, but some types (like tax or medical identity theft) have extra agencies to notify.
The good news: you are generally not legally responsible for debts that result from identity theft. The Fair Credit Reporting Act (FCRA) and the Fair Credit Billing Act and Electronic Fund Transfer Act limit your liability and give you the right to block fraudulent information from your credit reports. The challenge is documentation, so being organized from day one matters.
Step 1: Report to the FTC at IdentityTheft.gov
This is the single most important first step. The FTC, the federal agency that handles identity theft, runs a free site called IdentityTheft.gov. When you report there, the site walks you through your specific situation and generates two things you will use repeatedly:
- An FTC Identity Theft Report, which is your official statement that you are a victim. Businesses and credit bureaus must honor it.
- A personal recovery plan with pre-filled letters and to-do lists tailored to what was stolen.
Print or save your Identity Theft Report as a PDF and keep several copies. You will attach it when you dispute accounts, request blocks, and write to creditors. This report, combined with the law, is what forces companies to take you seriously.
Should you also file a police report?
An FTC Identity Theft Report is enough for most situations and is recognized nationwide. However, file a report with your local police if a creditor or bank specifically requires one, if you know the thief, or if the theft involved a stolen wallet, mail, or property. Bring your FTC report, a government ID, proof of address, and any evidence of the fraud. Get the report number and a copy. Whether local police actively investigate varies by department, but the report itself is still useful documentation.
Step 2: Lock Down Your Credit (Fraud Alert vs. Freeze)
You have two free tools under the FCRA to stop new accounts from being opened in your name. You only need to contact one bureau for a fraud alert (it must notify the others), but for a freeze you must contact all three: Equifax, Experian, and TransUnion.
- Fraud alert: A free flag that tells lenders to take extra steps to verify your identity before extending credit. An initial fraud alert lasts one year and is easy to set up. Victims with an Identity Theft Report can request an extended alert that lasts longer. You can still use your own credit normally.
- Credit freeze (security freeze): A stronger step that blocks anyone, including you, from opening new credit until you lift it. By federal law, placing and lifting a freeze is free at all three bureaus. You can temporarily lift it when you need to apply for credit, then put it back. A freeze does not hurt your credit score.
For active identity theft, a freeze is usually the safer choice because it stops new accounts cold. Some states add their own protections, such as freezes for minor children's credit files, so the exact options can vary by state.
Step 3: Get Your Credit Reports and Find the Fraud
You are entitled to free credit reports from all three bureaus at AnnualCreditReport.com, the only federally authorized source. Pull all three, because a fraudulent account may appear on one but not the others. As you review, write down every item you do not recognize: new accounts, inquiries from lenders you never contacted, addresses that are not yours, and unfamiliar balances. This list becomes your dispute roadmap.
Identity theft victims also have the right to free copies of business records relating to the fraudulent transactions. You can send the company a request along with your Identity Theft Report and ID, and they must provide the documents, which can help you and any investigators see how the fraud happened.
Step 4: Contact Each Business Where Fraud Occurred
For every fraudulent account or charge, contact the company's fraud department directly (look for a fraud or security number, not general customer service). Tell them the account is fraudulent, ask them to close or freeze it, and ask that they remove your liability. Follow up in writing and keep copies. Provide your FTC Identity Theft Report when they ask for proof.