If your identity is stolen, act quickly in this order: secure the affected accounts, freeze your credit with all three credit bureaus, report the theft at IdentityTheft.gov, and dispute any fraudulent accounts or charges. The Federal Trade Commission’s identity theft report gives you legal rights to block fraudulent information from your credit reports.
Key takeaways
- Credit freezes are free at Equifax, Experian and TransUnion and stop most new-account fraud.
- An FTC identity theft report is the key document for disputes and blocks.
- Tax, medical and government benefit fraud each have their own reporting steps.
Signs your identity may have been stolen
- Charges or withdrawals you did not make.
- Bills, collection calls or credit cards for accounts you never opened.
- A notice that more than one tax return was filed in your name.
- Medical bills or insurance statements for care you did not receive.
- A data breach notice from a company that holds your information.
Step 1: Lock down the accounts you know about
Call the fraud department of every bank, card issuer or service where you see suspicious activity. Ask them to close or freeze the account and issue new card numbers. Change passwords, starting with your email account, because access to email lets thieves reset everything else. Turn on two-factor authentication using an app or security key rather than text messages where possible.
Step 2: Freeze your credit
A credit freeze stops lenders from pulling your report, which blocks most new accounts in your name. It is free by federal law and does not affect your credit score. Place it separately with each bureau online or by phone, and save the PINs or login details. You can lift it temporarily when you apply for credit yourself.
As an alternative or addition, a fraud alert tells lenders to verify your identity before opening credit. An initial alert lasts one year; with an identity theft report you can request an extended alert lasting seven years. Placing a fraud alert with one bureau notifies the other two.
Step 3: Report the theft to the FTC
Go to IdentityTheft.gov and complete the report. The site creates a personalized recovery plan and pre-filled letters to send to creditors and bureaus. Your FTC Identity Theft Report lets you exercise rights under the Fair Credit Reporting Act, including asking the bureaus to block fraudulent information and obtaining records from businesses where the thief opened accounts.
Step 4: Consider a police report
Some creditors, insurers or debt collectors ask for a police report. File one with your local police department, bring your FTC report and proof of identity, and keep a copy.
Step 5: Review your credit reports and dispute errors
Get your reports free at AnnualCreditReport.com, the only site authorized by federal law for that purpose. Dispute every account, inquiry and address you do not recognize with both the credit bureau and the company that reported it. Bureaus must investigate and correct inaccurate information, generally within 30 days.
Step 6: Handle special types of identity theft
- Tax identity theft: respond to any IRS letter, file IRS Form 14039 if your e-filed return is rejected as a duplicate, and request an IRS Identity Protection PIN to protect future returns.
- Medical identity theft: ask your health insurer and providers for records, review them for care you did not receive and request corrections.
- Government benefits and IDs: report misuse of your Social Security number to the Social Security Administration and lost or stolen driver’s licenses to your state motor vehicle agency.
- Debt collectors: send a written dispute stating the debt results from identity theft, with your FTC report; collectors must stop until they verify the debt.
Keep records of everything
Write down every call: date, name, what was agreed. Send important letters by certified mail and keep copies. Recovery can take weeks or months, and a clear record makes disputes much easier.
Frequently asked questions
Am I responsible for fraudulent charges?
Federal law limits liability for unauthorized credit card charges to $50, and most issuers waive even that. Debit card protection depends on how quickly you report the loss, so call your bank right away.
Does a credit freeze stop all identity theft?
No. It mainly prevents new credit accounts. It does not stop misuse of existing cards, tax fraud or medical identity theft, so keep monitoring statements.
Can I sue after a data breach?
Sometimes. Companies may face class actions or state enforcement after a breach, and all states have breach notification laws. Whether you have an individual claim depends on the facts and the harm you suffered.
This guide is general information. For complex cases, such as criminal charges filed in your name, consider speaking with a consumer protection attorney or a local legal aid office.