The panic that comes with discovering unfamiliar accounts, unexplained charges, or a denied application you never submitted is real, but identity theft recovery is a solvable, well-documented process. The order you take these steps in matters — some actions need to happen before others can work properly.
Step 1: Freeze your credit at all three bureaus
A credit freeze blocks new creditors from viewing your credit report, which stops most new fraudulent accounts from being opened in your name. Freezing is free and can be done online directly with Equifax, Experian, and TransUnion individually — freezing with only one bureau leaves the other two open to new fraud.
Do this before anything else
Step 2: Document everything you find
Before disputing anything, pull your credit reports from all three bureaus and write down every unfamiliar account, inquiry, or piece of personal information that's wrong. Note account numbers, dates opened, and creditor names where visible. This record becomes the basis for every dispute and report you file next.
Step 3: File a report with the FTC
A report filed through the FTC's identity theft reporting system generates an official Identity Theft Report and a personalized recovery plan. This report is often required by banks, creditors, and credit bureaus as proof of fraud before they'll remove fraudulent accounts or reverse charges.
Step 4: File a police report if needed
Some creditors and situations, especially larger fraud amounts or cases involving a known suspect, require a local police report in addition to the FTC report. Bring your FTC Identity Theft Report and documentation with you — it speeds up the process significantly.
Step 5: Contact each affected creditor directly
For every fraudulent account or charge, contact the creditor's fraud department specifically, not general customer service. Explain that the account or charge is fraudulent, reference your FTC report number, and ask them to close the account and confirm in writing that you're not liable for the balance.
- Ask for written confirmation that the account is closed and marked as fraudulent, not just "disputed."
- Request that the creditor notify the credit bureaus directly that the account resulted from identity theft.
- Keep a log of every call: date, representative name, and what was confirmed.
Step 6: Dispute fraudulent items with each credit bureau
Submit a formal dispute to each bureau reporting the fraudulent account, including your FTC Identity Theft Report as supporting documentation. An Identity Theft Report generally triggers stronger legal protections than a standard dispute, including the ability to block the fraudulent information from your report more permanently once it's confirmed.
| Where to go | What to bring |
|---|---|
| FTC identity theft report | Details of what happened, dates, and any account numbers you have |
| Local police (if needed) | Your FTC report and any documentation of fraudulent activity |
| Each creditor's fraud department | FTC report number, account details, and your identification |
| Each credit bureau (dispute) | FTC report, list of fraudulent items, and your identification |
Step 7: Change passwords and enable monitoring
Change passwords on your email, banking, and any account that may have been compromised, and enable two-factor authentication wherever it's offered. Consider ongoing credit monitoring, which many banks and credit card issuers offer for free, so new fraudulent activity gets flagged quickly if it happens again.
How long recovery usually takes
Simple cases, like a single fraudulent credit card, can be resolved in a few weeks. Cases involving multiple accounts, tax fraud, or a fraudulent loan can take several months to fully clear from your credit reports. Following the steps above in order and keeping thorough documentation is the biggest factor in how fast the process moves.
Should you lift the freeze once things are resolved?
You can lift a credit freeze temporarily whenever you need to apply for new credit yourself, then re-freeze afterward. Many people choose to leave a freeze in place indefinitely as a standing precaution, only lifting it briefly for legitimate applications.
Different types of identity theft need slightly different steps
Financial identity theft (fraudulent credit cards or loans) generally follows the steps above closely. Tax identity theft, where someone files a tax return using your information, requires a separate report to your national tax authority and typically a specific identity theft affidavit. Medical identity theft, where someone uses your information to receive care, requires contacting the healthcare provider and your insurer directly, since incorrect medical records can also create billing and treatment complications beyond the financial impact.
Setting up ongoing monitoring after the immediate crisis
Once the immediate fraudulent accounts are resolved, ongoing monitoring is what catches a repeat attempt early. Many banks and credit card issuers offer free credit monitoring or account alerts, and reviewing your credit report from each bureau periodically (not just after an incident) helps you catch new activity before it grows into another full recovery process.
A blurry line still causes real damage
Even a small, seemingly minor case of identity theft — a single unauthorized charge or a single fraudulent account — deserves the same documentation discipline as a larger case. Fraud sometimes starts small as a test before a larger attempt, and having a clean paper trail from the very first sign of trouble makes any escalation much easier to resolve.
- Keep a single folder (physical or digital) with every report, letter, and confirmation related to the incident.
- Note the date and outcome of every phone call, including the representative's name if given.
- Follow up in writing on anything promised verbally, so there's a paper trail if a promise isn't kept.
Telling family members if a minor's identity is involved
Identity theft affecting a child is often discovered years later, since a minor typically has no credit file to monitor until they apply for their first credit product as an adult. If you suspect a child's Social Security number has been used fraudulently, you can request a manual credit report check with each bureau, since minors normally shouldn't have a credit file at all — the mere existence of one can itself be the first sign of a problem.
Preventing a repeat incident going forward
Once recovery is complete, review how the original exposure likely happened — a data breach notification you received, a phishing email you may have clicked, or a physical document that was lost or stolen — and address that specific vulnerability directly. Shredding sensitive documents before disposal, using unique passwords across financial accounts, and staying alert to phishing attempts are simple habits that meaningfully reduce the odds of a repeat incident.
