Your Identity Was Stolen. Now What? The Complete Recovery Playbook

There's a moment that people who've experienced identity theft describe almost identically. You check your bank statement and see charges you didn't make. Or you try to file your taxes and they get rejected because someone already filed in your name. Or you apply for a loan and discover accounts you never opened tanking your credit score. Or a debt collector calls about a debt you know nothing about.

The sinking feeling is instant. The panic comes right after. And then the overwhelming question: what do I actually do now?

More than 1.15 million identity theft cases were reported to the FTC in just the first three quarters of 2025, surpassing all of 2024. Credit card fraud led the way, but the damage extends to tax fraud, medical identity theft, employment fraud, utility fraud, and synthetic identity theft where criminals combine your real information with fabricated details to create entirely new personas.

If this has happened to you — or when it happens to you, because the odds are increasingly not in anyone's favor — the actions you take in the first 48 hours significantly determine how much damage you'll face and how long recovery takes.

This is the playbook. Step by step. In order of priority.

Hour 0-2: Immediate Containment

The first goal is to stop the bleeding. Every minute that passes while the thief has active access to your accounts or credit is a minute they can do more damage.

Place a Fraud Alert on Your Credit

Call any one of the three major credit bureaus and request a fraud alert. By law, whichever bureau you contact must notify the other two.

• Equifax: 1-800-525-6285 or equifax.com/personal/credit-report-services/credit-fraud-alerts/
• Experian: 1-888-397-3742 or experian.com/fraud/center.html
• TransUnion: 1-800-680-7289 or transunion.com/fraud-alerts

A fraud alert is free and lasts one year. It tells creditors to take extra steps to verify your identity before approving new credit. This won't stop all fraud — determined criminals can still get around it — but it creates an immediate barrier.

Freeze Your Credit — This Is More Powerful Than an Alert

A credit freeze is stronger than a fraud alert. It completely blocks access to your credit report, which means no one — including you — can open new credit accounts until you unfreeze. This stops credit card fraud, loan fraud, and any other attempt to open accounts in your name.

You need to freeze with all three bureaus separately. It's free by federal law.

When you freeze, each bureau gives you a PIN or password to use when you want to temporarily unfreeze (called a "thaw") for legitimate credit applications. Store these PINs securely — in your password manager, not on a sticky note.

A freeze doesn't affect your existing accounts or your credit score. You can still use your current credit cards and bank accounts normally. It only blocks new credit inquiries.

Secure Your Financial Accounts

Log into every bank account, credit card, and financial service you use. Check for unauthorized transactions. If you find any, report them to the financial institution's fraud department immediately.

Change the passwords on all financial accounts. Use your password manager to generate unique passwords. Enable the strongest available two-factor authentication on each account — passkeys or authenticator apps, not SMS.

If your debit card was compromised, request a new card with a new number immediately. Debit card fraud is particularly dangerous because the money leaves your account directly, and recovery can take weeks.

Hour 2-24: Documentation and Reporting

Once you've contained the immediate damage, you need to build the documentation that will power your recovery.

File an Identity Theft Report with the FTC

Go to IdentityTheft.gov and file a report. This is the federal government's central resource for identity theft victims, and the report you create here is legally significant.

The system walks you through what happened and generates two critical things: your Identity Theft Report (which proves to businesses that someone stole your identity and guarantees you certain legal rights) and a personalized recovery plan with specific steps tailored to your situation.

If you create an account, the system tracks your progress, pre-fills letters and dispute forms for you, and updates your plan as needed. This is not a formality — it's the most useful tool available to identity theft victims, and it's completely free.

Your FTC Identity Theft Report serves as official documentation that you can provide to creditors, collection agencies, and the credit bureaus to support your disputes.

File a Police Report

Contact your local police department and file a report. Some police departments may be unfamiliar with identity theft procedures or reluctant to take a report — persist. Having a police report on file creates an additional official record that some financial institutions and creditors require.

Bring a copy of your FTC Identity Theft Report, a government-issued ID, proof of your address, and any evidence of the fraudulent activity (unauthorized account statements, collection letters, etc.).

Request Your Credit Reports

Go to AnnualCreditReport.com and pull your reports from all three bureaus. In 2026, you can check your reports every week for free — take advantage of this.

Go through each report line by line. Look for accounts you didn't open, inquiries you didn't authorize, addresses you've never lived at, and employers you've never worked for. Mark everything that's fraudulent — you'll need this information for the dispute process.

Day 1-7: Dispute and Recovery

Dispute Fraudulent Accounts With Each Creditor

For every fraudulent account on your credit report, contact the company that issued it directly. Call their fraud department and explain that the account was opened through identity theft.

Ask them to close the fraudulent account immediately, remove all charges, and send you written confirmation that the account is closed and you're not liable for any balance. The FTC Identity Theft Report gives you the legal right to request this.

Send a written follow-up letter (the FTC's system can generate these for you) including a copy of your Identity Theft Report. Send it by certified mail so you have proof of delivery. Keep copies of everything.

Dispute Errors on Your Credit Reports

Write to each credit bureau that's showing fraudulent information. Include your FTC Identity Theft Report, a copy of your ID, and a specific description of which items are fraudulent.

Under the Fair Credit Reporting Act, the bureaus must investigate your dispute within 30 days and remove information they can't verify. With an Identity Theft Report, you can also request that they "block" fraudulent information from appearing on your report, which is a stronger remedy than a standard dispute.

The FTC provides sample letters for these disputes at IdentityTheft.gov, pre-filled with your information if you created an account.

Handle Specific Types of Identity Theft

Identity theft isn't one-size-fits-all. Depending on what the thief did with your information, you may need additional steps:

Tax identity theft: If someone filed a tax return using your Social Security number, file Form 14039 (Identity Theft Affidavit) with the IRS. Request an Identity Protection PIN from the IRS — this is a unique six-digit number that you'll use on future tax returns to verify your identity.

Medical identity theft: If someone used your identity to obtain medical care, request your medical records from any provider where fraudulent treatment was received. This is critical because inaccurate medical records can affect your future care. Contact your health insurer's fraud department to dispute any fraudulent claims.

Criminal identity theft: If someone used your identity during an arrest or committed crimes under your name, you may have warrants or a criminal record you don't know about. Contact the court or law enforcement agency in the jurisdiction where the crime occurred and provide your Identity Theft Report to begin clearing your name. Consider consulting an attorney — this type of identity theft is the most complex to resolve.

Employment identity theft: If someone used your SSN to get a job, you might receive IRS notices about income you didn't earn. File Form 14039 with the IRS and contact the employer's HR department to report the fraud.

Utility and phone fraud: If accounts were opened in your name for utilities, cell phone service, or other services, contact each company's fraud department with your Identity Theft Report and request closure.

Month 1-6: Monitoring and Restoration

Monitor Your Credit Continuously

Check your credit reports weekly through AnnualCreditReport.com. Set up free credit monitoring alerts through your bank, credit card issuer, or a service like Credit Karma (free). Watch for new inquiries, new accounts, or changes you didn't authorize.

If you placed a fraud alert (which lasts one year), renew it when it expires. If you placed a credit freeze, keep it active permanently and only temporarily thaw it when you need to apply for credit.

Maintain Your Documentation

Keep a file — physical or digital — containing copies of everything: your FTC Identity Theft Report, police report, dispute letters, creditor responses, credit bureau communications, and any other correspondence related to the theft. Include a log of phone calls with dates, names of representatives, and what was discussed.

This documentation is your protection if disputes don't get resolved, if fraudulent accounts reappear, or if collection agencies come after you for debts that aren't yours. Under the Fair Debt Collection Practices Act, you have the right to dispute any debt, and your Identity Theft Report is powerful evidence.

Watch for Secondary Exploitation

Identity thieves rarely use stolen information once and stop. Your compromised data may have been sold to multiple parties or compiled into "fullz" packages on dark web markets. We covered this lifecycle in detail in our data breach article.

This means you should expect additional fraud attempts over the following months and years. The monitoring you set up isn't temporary — it should become a permanent habit.

Long-Term: Building Permanent Defenses

Once you've addressed the immediate theft and resolved the fraudulent accounts, build permanent protections so recovery is faster if — when — it happens again.

Keep your credit frozen permanently. Only thaw temporarily when you need to apply for credit, and refreeze immediately after. This single measure blocks the most common form of identity theft (new account fraud) completely.

Use a password manager with unique passwords for every account. If the identity theft originated from a data breach where your credentials were compromised, credential stuffing across other services is the next step for attackers.

Enable non-SMS two-factor authentication on every important account. Passkeys are ideal. Authenticator apps are the minimum.

Opt out of data brokers. Your personal information in data broker databases makes targeted identity theft easier. We covered the removal process in our data broker guide.

Consider an IRS Identity Protection PIN even if your taxes weren't affected. This prevents anyone from filing a return using your SSN without the PIN.

Check your Social Security statement annually at ssa.gov/myaccount for employment you don't recognize.

The Emotional Reality

I want to acknowledge something that most identity theft guides don't mention. Identity theft is emotionally devastating. Victims report feelings of violation, helplessness, anxiety, anger, and exhaustion — the recovery process is bureaucratic, time-consuming, and often feels like the victim is being punished for something someone else did.

One commenter on the FTC's own resource page described having a heart attack during their recovery process. Others describe months of phone calls, rejected disputes, and ongoing fear.

These feelings are normal. The process is hard. But the tools exist, the legal protections are real, and recovery is possible. The Identity Theft Resource Center (ITRC) offers free help from trained advisors who understand both the technical and emotional aspects of recovery.

You're not alone in this. And it does get resolved, even when it feels endless.

Key Resources

• IdentityTheft.gov — FTC's central reporting and recovery tool
• AnnualCreditReport.com — Free weekly credit reports
• Identity Theft Resource Center — Free help from trained advisors
• IRS Identity Theft Central — Tax-related identity theft
• Have I Been Pwned — Check if your email appears in data breaches

The most important thing is to start. Pick up the phone. File the report. Freeze your credit. Every step you take reduces the damage and moves you closer to resolution.

Your identity was stolen. That's not your fault. Getting it back is in your hands.