Identity Theft Recovery: 12 Steps to Reclaim Your Life and Credit

Discovering that someone has stolen your identity is one of the most violating experiences you can face. A stranger is using your name, your Social Security number, your financial accounts — and the damage can cascade for months or even years before you fully recover.

You are not alone. 1 in 15 Americans experienced identity theft in the past year, according to the Federal Trade Commission. In 2024 alone, identity theft reports reached 1.1 million, with total losses exceeding $52 billion — an all-time high that has doubled since 2020.

The emotional toll is just as severe. Victims report feeling violated, anxious, and helpless. Many describe the recovery process as a "second victimization" — this time by the bureaucracy required to prove you are who you say you are.

This guide cuts through the noise. Below are the 12 essential steps to take when your identity is stolen, starting with what to do in the first 24 hours. Follow them in order, and you will begin reclaiming your life immediately.

Understanding Identity Theft: The Scale of the Problem

Identity theft occurs when someone uses your personal information — your name, Social Security number, date of birth, or financial account details — without your permission to commit fraud or other crimes. Unlike a stolen wallet, the damage is often invisible until it is severe.

The FTC receives identity theft reports through IdentityTheft.gov, and the trends are alarming:

Payment fraud (unauthorized credit card or bank account use) remains the most common form, accounting for roughly 30% of all reports.
Government document or benefit fraud has surged, with tax identity theft alone costing the IRS an estimated $5.2 billion annually.
Employment-related identity theft — when someone uses your SSN to get a job — has increased 40% since 2020.
Synthetic identity theft is the fastest-growing category, combining real and fake information to create entirely new fraudulent identities.

The average victim spends more than 200 hours and $1,400 out-of-pocket recovering from identity theft. But the cost of inaction is far higher. Unresolved identity theft can destroy your credit score, prevent you from getting loans or housing, and even result in criminal charges filed in your name.

Time is critical

The faster you act, the less damage occurs. Victims who begin recovery within 24 hours resolve their cases 60% faster than those who wait. Do not delay — start with Step 1 below.

The 12 Steps to Recover from Identity Theft

1Place a Fraud Alert on Your Credit Report

The single fastest protective action you can take is placing a fraud alert on your credit file. This is free, takes about 10 minutes, and lasts for one year (renewable).

When a fraud alert is active, any lender or creditor who receives a credit application in your name must take extra steps to verify your identity before extending credit. This prevents thieves from opening new accounts in your name while you sort out the damage.

You only need to contact one of the three credit bureaus. By law, the bureau you contact must notify the other two automatically:

Equifax: equifax.com/personal/credit-report-services or 1-800-685-1111
Experian: experian.com/fraud/center.html or 1-888-397-3742
TransUnion: transunion.com/credit-fraud-alert or 1-800-680-7289

You will need to provide your name, Social Security number, date of birth, and address. The process is straightforward and can be completed online in most cases.

Extended fraud alert

If you have filed an FTC Identity Theft Report (Step 3), you can request an extended fraud alert that lasts 7 years instead of 1 year. This is especially important for serious cases.

2Get Your Credit Reports

Once your fraud alert is placed, immediately obtain copies of your credit reports from all three bureaus. This is your baseline — you need to see exactly what the thief has done.

You are entitled to free credit reports from each bureau at AnnualCreditReport.com. During certain periods, the bureaus also offer free weekly reports online. When you have a fraud alert in place, you can request additional free reports beyond the standard entitlement.

Review each report carefully for:

Accounts you don't recognize — credit cards, loans, or lines of credit you never opened
Hard inquiries you didn't authorize — each one represents someone attempting to open credit in your name
Address changes you didn't make — thieves often change your address to redirect mail
Delinquent accounts you weren't aware of — these could be fraudulent accounts the thief has already defaulted on
Collection accounts you don't recognize — fraudulent debts that have gone to collections

Print or save a copy of each report. These documents will be essential for filing disputes, police reports, and insurance claims. For a detailed walkthrough on interpreting your credit reports, see our guide on how to read your credit report.

What to look for

Pay special attention to the "accounts" section and the "inquiries" section. New accounts you didn't open and credit checks you didn't authorize are the clearest signs of identity theft on your credit report.

3File an FTC Identity Theft Report

Visit IdentityTheft.gov — the official FTC website for identity theft victims — and complete their online reporting form. This creates your official FTC Identity Theft Report, which serves as your foundational legal document for all subsequent recovery actions.

The FTC report is critical because:

It is required to place an extended 7-year fraud alert on your credit
Creditors and credit bureaus are legally required to accept it as proof of identity theft
You need it to block fraudulent information from appearing on your credit report
It is required for filing an insurance claim (if your credit card includes identity theft coverage)
It serves as evidence for police reports and court proceedings

After you file, the FTC generates a personalized recovery plan based on the type of identity theft you reported. This plan includes pre-filled letters, checklists, and step-by-step instructions tailored to your specific situation. Save and print everything.

The entire process typically takes 15-20 minutes. You will need your Social Security number, a description of the identity theft, and any documentation you have gathered so far.

4File a Police Report

While the FTC report is your federal document, a local police report adds an additional layer of official documentation. Many creditors, credit bureaus, and insurance companies require or strongly prefer a police report when processing identity theft claims.

How to file:

Visit your local police department or file online if your jurisdiction allows it
Bring your FTC Identity Theft Report (printed from IdentityTheft.gov)
Bring government-issued photo ID (driver's license, passport)
Bring proof of your current address (utility bill, lease agreement)
Bring any evidence you have: fraudulent bills, collection notices, credit reports showing unauthorized accounts

Some police departments may be reluctant to file a report for identity theft, particularly if the crime occurred outside their jurisdiction. If this happens:

Request to file a "report of information" or "incident report" instead of a formal police report
Ask for a written statement that they cannot file a report and the reason why
Your FTC report still carries significant legal weight even without a police report
Some states have specific laws requiring police departments to accept identity theft reports

Keep a copy of the police report and the report number. You will reference it throughout your recovery process.

5Close Compromised Accounts

Now it is time to shut down the damage. Contact every company where fraud occurred and close or secure the affected accounts. This includes banks, credit card companies, utility companies, and any other business where the thief may have gained access.

For each compromised account:

Call the fraud department (not regular customer service)
Explain that the account was opened or accessed fraudulently
Request immediate closure or freezing of the account
Ask for written confirmation that the account was closed due to fraud
Request that the fraud notation be added to the account file

For accounts the thief opened in your name, provide your FTC Identity Theft Report and request that the company close the account and remove any associated charges. Under the Fair Credit Billing Act (FCBA), your liability for unauthorized credit card charges is limited to $50, and many issuers offer zero-liability protection.

Keep records of everything

Document every phone call: date, time, the name of the representative you spoke with, and what was discussed. Save all written correspondence. These records are essential for disputes and legal proceedings.

6Dispute Fraudulent Charges and Accounts

Fraudulent accounts that appear on your credit report need to be disputed with each credit bureau. This is a formal process that triggers an investigation.

How to dispute:

Write a dispute letter to each credit bureau (Equifax, Experian, TransUnion) identifying each fraudulent account or charge
Include your FTC Identity Theft Report and police report as supporting documentation
Send via certified mail with return receipt requested
The bureau has 30 days to investigate and respond

Under the Fair Credit Reporting Act (FCRA), when you provide an FTC Identity Theft Report, credit bureaus must block the fraudulent information within four business days of receiving your report. This is faster than the standard dispute process.

If the creditor continues to report the fraudulent information after being notified, they may be in violation of the FCRA, and you may have grounds for legal action. Our guide on how to remove collections from your credit report provides additional detail on the dispute process for collection accounts specifically.

For fraudulent debts that have gone to collections, also send a debt validation letter to each collection agency. Use our free Debt Validation Letter Generator to create a customized letter. The collection agency must validate the debt within 30 days, and if they cannot, they must cease collection activity.

7Consider a Credit Freeze

While a fraud alert adds a verification step, a credit freeze (also called a security freeze) goes further — it completely blocks access to your credit report. This means no one, including you, can open new credit accounts until you lift the freeze.

Key differences between a fraud alert and a credit freeze:

	Fraud Alert	Credit Freeze
Cost	Free	Free
Duration	1 year (renewable) or 7 years (extended)	Until you lift it
Contact needed	One bureau (notifies the other two)	All three bureaus separately
Protection level	Moderate — adds verification	Strongest — blocks access entirely
Convenience	No action needed to apply for credit	Must lift before applying for credit

When to choose a credit freeze:

You are confident you will not need to apply for new credit in the near future
The identity theft was severe (multiple fraudulent accounts opened)
You want the strongest possible protection against new account fraud

Freezing your credit with all three bureaus is free by federal law. For more details on the freeze process, see our guide on fraud alerts and credit freezes.

8Contact the IRS If Tax-Related Identity Theft

If someone used your Social Security number to file a tax return and claim a refund, you are a victim of tax-related identity theft. This is one of the most damaging forms of identity theft because it directly impacts your tax filing ability and refund.

Signs of tax identity theft:

The IRS rejects your tax return because one has already been filed with your SSN
You receive an IRS notice about wages from an employer you never worked for
You receive a notice that you owe additional tax or had a refund offset
You are unable to e-file your return

What to do:

Complete IRS Form 14039 (Identity Theft Affidavit) — available at irs.gov/individuals/identity-protection
Mail the form to the IRS with your paper tax return (e-filing will not work)
Call the IRS Identity Protection Specialized Unit at 1-800-908-4490
Request an IP PIN (Identity Protection Personal Identification Number) for future tax filing

The IRS will issue you an IP PIN each year — a six-digit number that prevents anyone else from filing a tax return using your SSN. This is one of the most effective protections against tax identity theft going forward.

IP PIN program

Starting in 2021, the IRS expanded the IP PIN program so that any taxpayer can opt in, regardless of whether they were a victim of identity theft. Consider enrolling proactively to prevent future tax fraud.

9Monitor Your Accounts Ongoing

Identity theft recovery is not a one-day event — it is an ongoing process that requires vigilance for months or years. Set up a monitoring routine to catch any new fraudulent activity immediately.

Your monitoring checklist:

Check bank and credit card statements every week for unauthorized transactions
Review your credit reports every 4 months (rotate between the three bureaus)
Set up account alerts — most banks and credit cards offer transaction notifications via text or email
Monitor your mail — watch for missing statements or unexpected new account cards
Check your Social Security statement annually at ssa.gov/myaccount to verify earnings history
Review medical Explanation of Benefits (EOB) statements for services you didn't receive

Consistent monitoring is your best defense against recurring identity theft. Studies show that victims who monitor their accounts closely catch new fraudulent activity within an average of 30 days, compared to 6+ months for those who do not.

10Update Passwords and Security

If your identity was compromised, the thief likely had access to some of your accounts — which means they may have your passwords or security answers. A comprehensive security update is essential.

Immediate actions:

Change all passwords — especially for banking, email, and government accounts
Enable two-factor authentication (2FA) on every account that offers it
Use a password manager — tools like Bitwarden, 1Password, or KeePass generate and store unique passwords for every account
Update security questions — avoid easily researched answers like your mother's maiden name or pet's name
Review account recovery options — ensure backup email addresses and phone numbers are yours, not the thief's
Check for data breaches — visit haveibeenpwned.com to see if your email appears in known data breaches

Password best practices

Use passphrases (random word combinations like "correct-horse-battery-staple") rather than complex passwords. They are easier to remember, harder to crack, and work well with password managers.

11Report to Relevant Agencies

Depending on the type of identity theft you experienced, additional reporting may be necessary. Here is a guide to the relevant agencies:

Type of Theft	Agency to Report To	Contact
Medical identity theft	Dept. of Health & Human Services (HHS) Office for Civil Rights	1-800-368-1019
Employment-related theft	Social Security Administration	1-800-772-1213
Tax identity theft	Internal Revenue Service (IRS)	1-800-908-4490
Criminal identity theft	Local police + FBI Identity Theft Clearinghouse	ic3.gov
Child identity theft	FTC + all three credit bureaus (create child credit file)	identitytheft.gov
Mail fraud	U.S. Postal Inspection Service	1-877-876-2455

Each agency has its own process and may require specific documentation. Always include copies (not originals) of your FTC Identity Theft Report and police report with any submission.

12Get Identity Theft Protection Going Forward

Once you have completed the immediate recovery steps, consider putting ongoing identity theft protection in place. You have several options ranging from free DIY approaches to paid monitoring services.

Free protections you can set up today:

Free fraud alerts (renew annually)
Free credit freezes at all three bureaus
Free credit monitoring through your bank or credit card
Free IRS IP PIN for tax protection
Free transaction alerts from your financial institutions

Paid identity theft protection services typically cost $10-$30 per month and offer features like:

24/7 credit monitoring across all three bureaus
Dark web monitoring for your personal information
Social Security number monitoring
Identity theft insurance (up to $1 million)
Restoration specialists who handle the paperwork for you
Court record monitoring
Address change monitoring

We discuss the value of paid services in detail below in the "Identity Theft Protection Services — Worth It?" section. For many people, the free options combined with diligent personal monitoring provide adequate protection.

Types of Identity Theft You Should Know

Identity theft is not a single crime — it is a category that includes several distinct types of fraud. Understanding which type you are dealing with helps you take the right action.

Financial Identity Theft

The most common type. Someone uses your identity to gain financial benefit — opening credit cards, taking out loans, draining bank accounts, or making purchases. This is the type that most directly impacts your credit score and financial health.

Financial identity theft accounts for roughly 65% of all identity theft cases. The 12 steps outlined above are primarily designed for this type of identity theft.

Medical Identity Theft

When someone uses your identity to obtain medical services, prescription drugs, or submit fraudulent insurance claims. This type is particularly dangerous because it can introduce false medical information into your health records, potentially leading to misdiagnosis or incorrect treatment.

Red flags include:

Bills for medical services you didn't receive
Insurance notices for claims you didn't file
Denial of insurance coverage because records show you've reached a benefit limit
A collection notice for a medical debt you don't recognize

Criminal Identity Theft

This occurs when someone gives your name and personal information to law enforcement during an arrest or criminal investigation. The result: a criminal record in your name for crimes you didn't commit. This is arguably the most serious form of identity theft.

If this has happened to you, contact your local police department immediately, file a report, and request that they clear your name. You may also need to contact the court where the case was filed and the FBI.

Synthetic Identity Theft

The fastest-growing type of identity theft. Thieves combine real information (like your Social Security number) with fabricated details (a fake name or date of birth) to create an entirely new, synthetic identity. They then build credit under this synthetic identity, max out the credit, and disappear.

Synthetic identity theft is particularly hard to detect because the fraudulent identity doesn't match any one real person completely. You might only discover it when you receive collection notices for debts associated with a name that is close to yours but not quite right.

If you suspect synthetic identity theft involving your SSN, contact the Social Security Administration and request a review of your earnings history.

How to Prevent Identity Theft in the Future

Recovery is exhausting. Prevention is far easier. Here are the most effective steps to protect yourself from future identity theft:

Protect Your Social Security Number

Never carry your Social Security card in your wallet
Do not give out your SSN unless absolutely necessary — ask why it is needed and how it will be protected
Shred documents containing your SSN before disposing of them
Store Social Security documents in a secure location (safe or locked file cabinet)

Secure Your Mail and Documents

Use a locked mailbox or PO Box for sensitive mail
Shred financial documents, pre-approved credit offers, and medical records before discarding
Opt out of pre-screened credit card offers at OptOutPrescreen.com
Pick up mail promptly — do not let it sit in an unsecured mailbox

Guard Your Digital Life

Use unique, strong passwords for every account
Enable two-factor authentication everywhere possible
Do not click on suspicious email links — especially those claiming to be from your bank or the IRS
Keep your devices and software updated with the latest security patches
Use a reputable antivirus program
Be cautious about what you share on social media — thieves use personal details to answer security questions

Monitor Your Finances Regularly

Review bank and credit card statements monthly
Check your credit reports at least once per year from each bureau
Set up transaction alerts on your financial accounts
Watch for mail you stopped receiving (thieves may have redirected it)

Be Skeptical of Unsolicited Contact

Legitimate organizations will not call, email, or text asking for personal information
Hang up on suspicious callers and call the organization back using a verified number
Be especially wary during tax season — IRS phishing scams spike every year from January through April
Never provide personal information to someone who contacts you first

Annual checkup

Set a calendar reminder to review your credit reports and financial statements every quarter. Consistency is the best defense against identity theft.

Identity Theft Protection Services — Are They Worth It?

The identity theft protection market is worth over $4 billion annually, with major providers like LifeLock, Identity Guard, Experian IdentityWorks, and Aura competing for customers. But do you really need a paid service?

What These Services Offer

Paid identity theft services bundle several features into a monthly subscription, typically $10-$30/month:

Credit monitoring — continuous monitoring of your credit reports across all three bureaus
Dark web scanning — alerts when your personal information appears on dark web marketplaces
Social Security number monitoring — alerts if your SSN is used in suspicious ways
Identity theft insurance — covers expenses related to recovery (not stolen funds)
Restoration specialists — dedicated staff who handle the paperwork and phone calls for you

What You Can Do for Free

Many of the core protections are available at no cost:

Free credit reports from AnnualCreditReport.com (free from all three bureaus)
Free credit freezes at all three bureaus by federal law
Free fraud alerts that last one year (renewable)
Free bank and credit card alerts through your financial institutions
Free IRS IP PIN for tax identity theft prevention

The Verdict

Paid services make sense if:

You have already been a victim and want professional help managing recovery
You have been through a major data breach and want comprehensive monitoring
You are elderly or otherwise unable to manage DIY monitoring
You want the convenience of having a dedicated restoration specialist

You can likely skip paid services if:

You are comfortable monitoring your own accounts and credit reports
You have placed credit freezes at all three bureaus
You use a password manager and practice good digital security habits
You are willing to spend a few hours per quarter on monitoring

For most people who practice basic security hygiene and freeze their credit, paid identity theft protection services offer limited additional value. The money may be better spent on a good password manager and credit freeze.

Frequently Asked Questions

What should I do first if my identity is stolen?

Place a fraud alert on your credit report by contacting one of the three credit bureaus (Equifax, Experian, or TransUnion). The bureau you contact is required by law to notify the other two. After placing the fraud alert, immediately obtain your credit reports, file an FTC identity theft report at IdentityTheft.gov, and file a police report. These four steps form the foundation of your recovery.

How long does it take to recover from identity theft?

On average, identity theft recovery takes 200+ hours and 6-12 months. Complex cases involving tax fraud or criminal identity theft can take years to fully resolve. The faster you begin the recovery process, the quicker you will reach resolution. Victims who start within 24 hours resolve their cases significantly faster than those who delay.

Am I financially responsible for fraudulent charges?

Under federal law, your liability for unauthorized credit card charges is limited to $50, and most card issuers offer zero-liability protection. For debit cards, your liability depends on how quickly you report the fraud: $0 if reported before any unauthorized charges, up to $50 if reported within 2 business days, and up to $500 if reported within 60 days. After 60 days, you could be responsible for all losses.

Can identity theft be prevented completely?

No system is 100% foolproof. Even with credit freezes, strong passwords, and vigilant monitoring, data breaches at major companies can expose your information. However, the preventive steps outlined in this guide dramatically reduce your risk and ensure that if identity theft does occur, you catch it early and minimize damage.

Should I pay for an identity theft protection service?

For most people, free options (credit freezes, fraud alerts, regular credit report reviews, and account monitoring through your bank) provide adequate protection. Paid services ($10-$30/month) are most valuable for identity theft victims who want professional restoration assistance or for those who lack the time or ability to manage their own monitoring.

What if the identity thief filed taxes in my name?

Contact the IRS immediately at 1-800-908-4490 and complete IRS Form 14039 (Identity Theft Affidavit). The IRS has a specialized unit that handles tax identity theft cases. You will need to file your tax return on paper rather than electronically, and the IRS will issue you an IP PIN for future filings to prevent recurrence.

How do I know if my child is a victim of identity theft?

Check if your child has a credit file by contacting each of the three credit bureaus. Children should not have credit files. If one exists, it is a sign of identity theft. Contact the FTC, file a police report, and work with the credit bureaus to purge the fraudulent file. Child identity theft often goes undetected for years, so an annual check is recommended.

Does a credit freeze affect my existing accounts?

No. A credit freeze only blocks new creditors from accessing your credit report. Your existing accounts are unaffected — you can still use your credit cards, make payments, and access your accounts normally. You will need to temporarily lift the freeze if you apply for new credit, but the process is quick and free.

Dealing With Fraudulent Debt From Identity Theft?

If identity theft resulted in debt collectors coming after you for debts you didn't create, send a debt validation letter. Force collectors to prove the debt is yours — they often can't. Free tool, no signup required.

Generate Free Debt Validation Letter →