Possible Identity Theft? What to Do Next (Recovery Checklist)

If you think your identity may have been stolen, the fastest, most reliable first move is to report it at the FTC's official site, IdentityTheft.gov, and place a free fraud alert with one of the three nationwide credit bureaus. That single report becomes your federal Identity Theft Report, which unlocks important rights under federal law, and the fraud alert makes it harder for a thief to open more accounts in your name. Everything else flows from those two steps, and you can do both for free in under an hour.

Below is the same checklist many people on Reddit and in consumer-protection forums end up piecing together the hard way, organized so you can move quickly and calmly. None of this is legal advice; it is general information to help you understand your options.

First, Is This Actually Identity Theft?

Not every weird charge or strange letter is full-blown identity theft, and knowing what you're dealing with shapes your response. A few common scenarios:

• One fraudulent charge on an existing card or account. This is usually account fraud, not identity theft in the legal sense. Call the number on the back of your card, dispute the charge, and ask for a new card number. Under the Truth in Lending Act (TILA), your maximum liability for unauthorized credit card charges is capped at $50 federally, and most issuers waive even that.
• A new account, loan, or credit card you never opened. This is classic identity theft. Someone used your personal information to open credit in your name. This is where the full checklist below applies.
• A debt collector or court notice for a debt that isn't yours. This can be identity theft surfacing months later. Do not ignore it, especially a lawsuit, because strict deadlines apply (more on that below).
• A data breach notice. A breach means your data was exposed, not necessarily misused. Treat it as a strong reason to monitor and freeze your credit, but it is not yet identity theft on its own.

If you see accounts, inquiries, or addresses you don't recognize on your credit report, treat it as identity theft and keep going.

Step 1: Report It and Create Your Official Record

Go to IdentityTheft.gov, the Federal Trade Commission's (FTC) official recovery site. Filing there does two things: it generates an FTC Identity Theft Report and gives you a personalized recovery plan with pre-filled letters. Under the Fair Credit Reporting Act (FCRA), an Identity Theft Report gives you the legal leverage to block fraudulent information from your credit reports and to stop collectors from re-reporting it.

Keep a copy of the report and note the date. From this point on, document everything: every call (date, time, who you spoke with), every letter, every confirmation number. Send important letters by certified mail with return receipt when you can, and never send your only copy of a document.

Step 2: Place a Fraud Alert or Freeze Your Credit

You have two tools here, and they do different jobs. Both are free under federal law.

• Fraud alert. Contact any one of the three nationwide bureaus (Equifax, Experian, or TransUnion) and that bureau must tell the other two. A fraud alert tells lenders to take extra steps to verify your identity before extending credit. An initial alert lasts one year; an extended alert (which requires an Identity Theft Report) lasts seven years.
• Credit freeze (security freeze). A freeze locks your credit file so no one can open new credit in your name until you lift it. You must place it with each of the three bureaus separately. Federal law makes freezing and unfreezing free. A freeze is stronger than an alert, and you can temporarily lift it when you need to apply for credit.

For most identity theft victims, freezing all three credit files is the single most protective step you can take.

Step 3: Get and Read Your Credit Reports

You're entitled to free credit reports from all three bureaus at AnnualCreditReport.com, the only federally authorized source. Identity theft victims are also entitled to additional free copies. Read each report line by line and flag anything you don't recognize: accounts, hard inquiries, addresses, and employers.

Under the FCRA, once you provide an Identity Theft Report, you can ask the bureaus to block fraudulent information so it stops appearing and stops dragging down your score. You can also ask creditors not to report the fraudulent account going forward.

Step 4: Contact Each Affected Company

For every fraudulent account or charge, contact that company's fraud department directly (ask for it by name). Tell them the account resulted from identity theft, ask them to close or freeze the account, and request that they send you copies of the application and transaction records. The FCRA gives you the right to request business records relating to the fraudulent transactions; you generally provide a copy of your Identity Theft Report and proof of identity, and the company must respond within 30 days.

Get the name of a fraud-department contact and a reference number for each conversation. Follow up in writing to create a paper trail.

Step 5: Handle Debt Collectors the Right Way

If a debt collector contacts you about a fraudulent debt, the Fair Debt Collection Practices Act (FDCPA) protects you. You have the right to dispute the debt in writing and to request validation. When you tell a collector in writing that the debt resulted from identity theft and provide an Identity Theft Report, they generally must stop collection and cannot sell or transfer that debt for ordinary collection.

Send your dispute in writing, keep a copy, and use certified mail. The Consumer Financial Protection Bureau (CFPB) enforces the FDCPA and the FCRA and accepts complaints if a company won't cooperate.

Step 6: File a Police Report If You Need One

A police report is not always required, but some companies will ask for one before they'll reverse charges or restore your credit. Bring your FTC Identity Theft Report, a government ID, proof of address, and any evidence of the fraud. Together, an FTC report plus a police report make up what's sometimes called an "Identity Theft Report" in its fullest form, and it carries more weight with stubborn creditors.

Step 7: Protect the Other Doors

Identity thieves often go beyond credit cards. Depending on your situation, also consider:

• Tax fraud. If someone files a tax return in your name, contact the IRS and request an Identity Protection PIN.
• Social Security. Report misuse of your Social Security number to the Social Security Administration and review your earnings record.
• Government benefits and unemployment. Report fraudulent claims to your state agency.
• Medical identity theft. Request copies of your medical records and review insurance Explanation of Benefits statements for care you never received.
• Passwords and devices. Change passwords on key accounts (email first, since it controls password resets), turn on two-factor authentication, and check for unfamiliar logins.

Where State Law Adds Stronger Protections

The steps above are your federal baseline. Many states layer on additional rights, and these vary by state. Some states give victims expanded rights to police reports, longer or different fraud-alert options, stronger data-breach notification rules, or the ability to obtain a court order or "identity theft passport" declaring you a victim. Your state Attorney General's office is the place to check what your state offers, and many maintain dedicated identity theft or consumer-protection help pages. Because the specifics differ, confirm your state's rules rather than assuming a particular deadline or dollar figure applies.

When to Talk to a Lawyer

You can handle most identity theft recovery yourself with the free tools above. But it's worth talking to a consumer-protection or debt lawyer when the stakes rise, for example when:

• You've been sued over a debt that isn't yours. This is the big one. A lawsuit comes with a strict deadline to file a written answer (often just a few weeks, and it varies by state and court). Missing it can lead to a default judgment against you even though the debt is fraudulent. If you've been served, treat the deadline as urgent.
• A creditor or bureau keeps reporting fraudulent information after you've sent an Identity Theft Report. The FCRA and FDCPA allow consumers to sue for violations, and prevailing consumers may recover damages and attorney's fees.
• The fraud is large, tangled across many accounts, or tied to tax, medical, or criminal records.

Many consumer-protection attorneys offer free consultations and work on contingency or fee-shifting cases, meaning they may collect their fees from the other side rather than from you. A short consultation can tell you whether you have a claim and what deadlines you're facing.

The Short Version

Report at IdentityTheft.gov, freeze your credit, read all three reports, contact each affected company in writing, and keep meticulous records. Lean on your FCRA and FDCPA rights, escalate to the CFPB or your state Attorney General if a company won't cooperate, and get a lawyer involved fast if you're sued. None of this is legal advice, but it's a road that thousands of people walk successfully every year. Take it one step at a time.

Know the law

Federal law limits your liability and gives you tools — fraud alerts, freezes, and an official FTC recovery plan at IdentityTheft.gov.

Key federal laws:

• Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.

Where to get help or file a complaint:

• IdentityTheft.gov — official FTC recovery plan

Your state matters too. Federal law is the floor — your state sets the statute of limitations on debt, garnishment and exemption limits, payday and repossession rules, and has its own Attorney General and consumer-protection laws. Always check your state’s rules. This is general legal information, not legal advice.