What To Do If Your Identity Is Stolen: 9-Step Recovery Checklist (2026)

TL;DR

If your identity has been stolen, you need to act quickly but carefully. Do not panic, do not respond to suspicious emails or calls, and do not give out personal information to anyone who contacts you first. Stolen credentials are frequently traded on dark web markets, so speed matters. The nine steps below walk you through everything from freezing your credit and placing fraud alerts to filing federal reports and closing fraudulent accounts. Follow them in order.

Step 1: Verify the Threat Is Real

Before you do anything, stop and ask yourself: why do you think your identity has been stolen?

This matters because there are a variety of phishing scams designed to whip you into a panicked state — a state in which you are prone to reveal personal information to the very people trying to steal it. If you think your identity has been stolen because you received an intimidating email from PayPal, a phone call from someone claiming to be the IRS about unpaid taxes, or even a disaster relief agency requesting verification fees, pause.

Never respond to these emails, texts, or phone calls directly. They are almost always scams.

Instead, find the phone number of the institution in question and contact them directly using that number. Double and triple check that you are on their legitimate website before calling.

If after contacting the institution directly you still suspect identity theft has occurred, continue with the steps below.

Step 2: Consider Identity Theft Protection

If you are dealing with identity theft — or even suspect it — an identity theft protection service can be a significant advantage. No service can reverse identity theft, but they provide critical support during recovery:

• 24/7 threat resolution specialists who give you specific next steps to follow
• Three-way calls with your bank and financial institutions to help clean up fraudulent accounts
• Emotional support at a time when you genuinely need it
• Power of attorney options — services like Aura and Identity Guard allow you to sign over power of attorney so they can handle the cleanup on your behalf

Personally, I use and recommend Aura. Their resolution team is US-based, available 24/7/365, and they offer up to $1 million in identity theft insurance per adult.

Get Aura — 24/7 Identity Theft Recovery Support

60-day money-back · Cancel anytime

Step 3: Place a Fraud Alert

Whether you use a service or not, this is where the real work begins. A fraud alert tells businesses to take extra steps to verify your identity before issuing any credit in your name.

Here is what you need to know:

• A fraud alert lasts one year and can be renewed for up to 7 years if necessary
• You only need to place it at one of the three credit bureaus — by law, that bureau must notify the other two
• When you initiate the fraud alert, you are entitled to a free copy of your credit report

Contact any one of these bureaus to place your fraud alert:

• Equifax: 1-800-349-9960
• TransUnion: 1-888-909-8872
• Experian: 1-888-397-3742

Once you receive your credit report, review it carefully and make note of any unauthorized accounts. We will deal with those in a later step.

Step 4: Freeze Your Credit at All Three Bureaus

This is probably the single most important thing you can do. A credit freeze prevents anyone — including you — from opening new lines of credit in your name. Since the most common type of identity theft involves someone opening lines of credit in your name, this effectively shuts the door.

Unlike a fraud alert, a credit freeze needs to be done individually at each of the three bureaus. Expect it to take about 10 to 20 minutes per bureau.

Once the freeze is in place, your thief is essentially unable to open new lines of credit in your name. Given how many Americans fall victim to identity theft each year, this step alone can prevent the most common form of damage. And if you have a big purchase in the pipeline where a lender needs to access your files, do not worry — by law, the credit bureaus are required to unfreeze your account within one hour of your request.

Credit freezes are free and for Americans, they do not affect your credit score. Even if you have not been a victim of identity theft, freezing your credit is a smart preventative measure.

Credit Freeze vs. Credit Lock

You may be wondering what the difference is between a credit freeze and a credit lock. They achieve essentially the same thing. Freezes are free; credit locks usually cost money and are upsells from the credit agencies. Freezes may afford you additional legal protections and may be slightly harder for an identity thief to undo.

Some identity theft protection services let you lock your credit with one click. For instance, with Aura you can lock and unlock your Experian credit file directly from their dashboard — no phone call required.

SAVE 68% on Aura — One-Click Credit Lock Included

Step 5: Change Your Login Credentials

Now that your credit is frozen, it is time to change your login credentials — and this means more than just changing your passwords. You need to change your usernames and potentially your email addresses as well.

Think about it: if your bank login is your first name and last name, that is trivially easy for a hacker to guess. If you use the same email address for social media posts and for your banking, an identity thief can reverse-engineer your login.

Here is what to do:

• Use a reputable password manager like Bitwarden or 1Password to generate and store strong, unique passwords
• Set up email aliases using a service like Proton Mail — create one that you use exclusively for banking
• Link a non-public phone number to your bank accounts if possible
• Enable multi-factor authentication on every account that supports it

Step 6: Create a Recovery Plan at IdentityTheft.gov

IdentityTheft.gov is an incredible resource from the FTC that helps you create a customized recovery plan tailored to your specific situation. Visit the site, answer their questions about what happened, and they will generate step-by-step instructions specific to your case.

Bookmark this site. It is one of the most useful tools available to identity theft victims and it is completely free.

Step 7: Report to the FTC

Report the identity theft to the Federal Trade Commission (FTC) via their website at IdentityTheft.gov or by phone. The FTC will not investigate your individual case, but your report goes into the FTC’s national database on identity theft. This database helps local law enforcement track and catch criminals.

More importantly, filing this report reduces your legal liability for any damages stemming from the identity theft. File as soon as you discover the theft — ideally within 48 hours.

Step 8: File a Police Report

Local police probably will not catch the thief. But like the FTC report, filing a police report creates a paper trail that is essential when disputing fraudulent charges with creditors and financial institutions.

When creating the report:

• Compile all available evidence — debt collection notices, credit reports showing false information, any correspondence related to the theft
• Request a copy of the report from your local police department for your own records
• If local law enforcement pushes back or is unwilling to take your report, you can use the FTC’s law enforcement letter template to support your case

Step 9: Close Fraudulent Accounts

At this point you should have a copy of your credit report — either from AnnualCreditReport.com or through a service like Aura. Go through that report and identify any unauthorized accounts that have been opened in your name.

For each fraudulent account:

1. Contact the fraud department of that business
2. Ask them to remove any unauthorized charges
3. Ask them to close the account
4. Request written confirmation that the account has been closed and any fraudulent charges have been waived

Also check the NCTUE (National Consumer Telecom and Utilities Exchange) data report. This records any phone, cable, and utility accounts opened in your name. If you find unusual activity, dispute it.

SAVE 68% on Aura — Full Identity Theft Protection

Additional Steps to Consider

After completing the nine steps above, here are several more actions worth taking:

Freeze your ChexSystems file. ChexSystems is a consumer reporting agency used by banks when you open a checking or savings account. Freezing your file here prevents thieves from opening bank accounts in your name.

Check for mail forwarding. Contact the United States Postal Service and check whether a mail forwarding order has been set up in your name. Identity thieves do this to intercept your mail — including bank statements, credit card offers, and tax documents. While you are on the USPS website, sign up for their Informed Delivery program to monitor what mail is being sent to your address.

Get an IRS Identity Protection PIN. From now on, anyone filing taxes in your name — including you — will need to provide this PIN. This makes it significantly harder for a thief to file a fraudulent tax return and intercept your refund. You can request an IP PIN directly from the IRS website. This is recommended for everyone, not just identity theft victims.

Review your Social Security work history. Check your Social Security work history and benefits through the SSA website. If you discover that your number is being used fraudulently, contact your local Social Security Administration office immediately. For a full breakdown of the damage a stolen Social Security number can cause, see our dedicated guide. If the victim is a senior or you’re helping an aging parent recover, our guide to protecting seniors from identity theft includes specific recovery steps and caregiver checklists.

Contact your State Attorney General. If you are still having issues after following all of the steps above, consider reaching out to your State Attorney General’s office. Many states offer an ID Theft Passport — a state-issued document that serves as proof that you are a victim of identity theft. This can be useful when dealing with creditors and law enforcement.

FAQ

What are the first steps to take if your identity is stolen?

The first steps are: verify the threat is real by contacting the institution directly (never respond to suspicious emails or calls), freeze your credit at all three bureaus (Equifax, Experian, TransUnion), place a fraud alert at one bureau (which legally notifies the other two), and change your login credentials for all financial accounts. If you use an identity theft protection service like Aura, contact their 24/7 resolution team immediately for guided support and emotional assistance.

How do I freeze my credit after identity theft?

Contact each of the three major credit bureaus individually to freeze your credit: Equifax (1-800-349-9960), Experian (1-888-397-3742), and TransUnion (1-888-909-8872). Freezing is free, takes about 10-20 minutes per bureau, and does not affect your credit score. Once frozen, no one can open new lines of credit in your name. By law, the bureaus must unfreeze your account within one hour when you need it.

What is the difference between a credit freeze and a credit lock?

A credit freeze and a credit lock achieve essentially the same thing — they prevent new credit accounts from being opened in your name. The key differences: freezes are free and may afford additional legal protections, while credit locks usually cost money and are upsells from credit bureaus. Some identity theft protection services like Aura let you lock your Experian credit file with one click from their dashboard, saving you the time of calling the bureau directly.

Should I file a police report for identity theft?

Yes. While local police may not catch the thief, filing a police report creates a paper trail that is essential when disputing fraudulent charges with creditors and financial institutions. Compile all available evidence before filing — debt collection notices, credit reports showing fraudulent accounts, any related correspondence — and always request a copy of the report for your records.

Where do I report identity theft to the federal government?

Report identity theft to the FTC (Federal Trade Commission) at IdentityTheft.gov or by phone. The FTC does not investigate individual cases, but your report enters a national database that helps law enforcement track criminals. Filing also reduces your legal liability for damages from the theft. Additionally, IdentityTheft.gov generates a customized recovery plan based on your specific situation. Report as soon as possible — ideally within 48 hours.

Can identity theft protection services help after identity theft has already occurred?

Yes. Services like Aura provide 24/7 US-based threat resolution specialists who give you specific next steps, join you on calls with banks and financial institutions to resolve fraudulent accounts, and offer emotional support throughout the process. Aura and Identity Guard also offer the ability to sign over power of attorney so they can handle the entire recovery process on your behalf. Most services also include up to $1 million in identity theft insurance.

How do I get an IRS Identity Protection PIN?

Visit the IRS website to request an Identity Protection PIN (IP PIN). Once set up, anyone filing taxes in your name must provide this PIN, preventing thieves from filing fraudulent returns and stealing your refund. The IRS issues a new IP PIN each year. This is recommended for everyone as a preventative measure — not just for identity theft victims.

What To Do If Your Identity Is Stolen: Quick Reference Checklist

1. Verify the threat is real — do not respond to suspicious emails, texts, or calls
2. Consider identity theft protection — services like Aura provide 24/7 recovery support
3. Place a fraud alert at one of the three credit bureaus
4. Freeze your credit at Equifax, Experian, and TransUnion
5. Change all login credentials — passwords, usernames, and email addresses
6. Create a recovery plan at IdentityTheft.gov
7. Report to the FTC — file within 48 hours
8. File a police report and request a copy
9. Close all fraudulent accounts and request written confirmation

SAVE 68% on Aura — Full Identity Theft Protection + Recovery

Related: Best Identity Theft Protection Services | How to Prevent Identity Theft | Famous Identity Theft Cases | What To Do When You Lose Your Wallet | Best Identity Theft Protection for Seniors | Mail Identity Theft | Senior Identity Theft Prevention Guide