Identity Theft: What to Do, How to Report, and How to Recover

Identity theft affects millions of Americans every year, costing victims an average of hundreds of hours and thousands of dollars to resolve. Whether someone has opened credit cards in your name, filed a fraudulent tax return, or used your Social Security number for employment, the experience is both financially devastating and emotionally exhausting. However, federal law provides strong protections, and following the right steps immediately can significantly limit the damage.

This guide provides a comprehensive, step-by-step action plan for identity theft victims, including how to file reports with the FTC and police, how to place credit freezes and fraud alerts, and how to dispute fraudulent accounts.

Signs You May Be a Victim of Identity Theft

Identity theft is not always immediately obvious. Watch for these warning signs:

• Unfamiliar accounts or charges on your credit report.
• Bills or collection notices for debts you do not owe.
• Unexpected denials when applying for credit, a loan, or an apartment.
• Missing mail, especially bank statements or bills.
• IRS notification that more than one tax return was filed in your name, or that you have income from an employer you do not recognize.
• Medical bills for services you never received.
• Health insurance explanation of benefits for treatments you did not get.
• Notifications from data breach monitoring services.
• Unexpected two-factor authentication codes or password reset emails.

Step 1: Report to the FTC at IdentityTheft.gov

The Federal Trade Commission (FTC) operates IdentityTheft.gov, the federal government's one-stop resource for identity theft victims. This should be your first stop.

1. Go to IdentityTheft.gov and click "Get Started."
2. Answer questions about what happened and what information was compromised.
3. The system will generate a personalized recovery plan with specific steps for your situation.
4. You will receive an FTC Identity Theft Report, which serves as an official report that you can use with creditors, credit bureaus, and law enforcement.
5. The site also generates pre-filled letters and forms for disputing fraudulent accounts and debts.

The FTC Identity Theft Report is a critical document. It gives you specific legal rights, including the ability to block fraudulent debts from appearing on your credit report, stop debt collectors from collecting on fraudulent debts, and place an extended fraud alert lasting seven years on your credit file.

Step 2: File a Police Report

While not all police departments actively investigate identity theft, a police report creates an official record and may be required by some creditors and insurers. To file effectively:

• Bring your FTC Identity Theft Report to the police station.
• Provide a copy of any evidence you have (fraudulent statements, collection notices, etc.).
• Ask for a copy of the police report or the report number.
• If your local police refuse to take a report, ask them to create an informational or miscellaneous report, or file with your state attorney general.

Step 3: Place a Credit Freeze

A credit freeze (also called a security freeze) restricts access to your credit report, making it much harder for identity thieves to open new accounts in your name. Under federal law, credit freezes are free and do not affect your credit score.

You must place a freeze separately with each of the three major credit bureaus:

• Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 1-800-349-9960
• Experian: experian.com/freeze/ or call 1-888-397-3742
• TransUnion: transunion.com/credit-freeze or call 1-888-909-8872

Each bureau will give you a unique PIN or password. Store these securely — you will need them to temporarily lift or permanently remove the freeze when you want to apply for credit.

You should also freeze your credit with the lesser-known bureaus: Innovis (innovis.com) and the National Consumer Telecom and Utilities Exchange (NCTUE, nctue.com), which is used by phone and utility companies.

Step 4: Place a Fraud Alert

A fraud alert tells creditors to take extra steps to verify your identity before opening new accounts. Unlike a freeze, you only need to contact one credit bureau, and they are required to notify the other two.

• Initial fraud alert: Lasts one year. Any consumer can place one, no documentation required.
• Extended fraud alert: Lasts seven years. Requires an FTC Identity Theft Report or police report. Removes your name from pre-screened credit offers for five years.
• Active duty military alert: Lasts one year for service members deployed away from their usual station.

Step 5: Dispute Fraudulent Accounts and Charges

Contact every company where fraud occurred and follow these steps:

1. Call the fraud department. Explain that you are an identity theft victim and ask them to close or freeze the fraudulent account.
2. Follow up in writing. Send a dispute letter along with your FTC Identity Theft Report and a copy of your police report. Send by certified mail with return receipt requested.
3. Request removal from credit reports. Under the Fair Credit Reporting Act, if you provide an Identity Theft Report, credit bureaus must block fraudulent information from your report within four business days.
4. Dispute with credit bureaus. File disputes directly with each credit bureau that shows fraudulent information. You can do this online, by phone, or by mail. Include copies (not originals) of supporting documents.

Under federal law, you are not liable for unauthorized charges on credit cards beyond $50, and most major card issuers have zero-liability policies. For debit cards, report fraud within two business days to limit your liability to $50; after two days, liability increases to $500; after 60 days, you could be liable for the full amount.

Step 6: Secure Your Accounts and Information

Take these additional steps to prevent further damage:

• Change passwords on all online accounts, starting with email, banking, and social media. Use strong, unique passwords for each account.
• Enable two-factor authentication on all accounts that support it, preferably using an authenticator app rather than SMS.
• Contact the IRS if you suspect tax-related identity theft. File Form 14039 (Identity Theft Affidavit) and consider getting an Identity Protection PIN (IP PIN) from the IRS.
• Contact the Social Security Administration if your SSN was compromised. Review your Social Security statement at ssa.gov for unauthorized activity.
• Notify your health insurer if medical identity theft occurred. Request copies of your medical records and an accounting of disclosures to identify fraudulent claims.
• Monitor your credit regularly. You are entitled to free weekly credit reports from annualcreditreport.com. Review them carefully for any new unauthorized activity.

Special Types of Identity Theft

Child identity theft: Children are frequent targets because their Social Security numbers have no existing credit history. If you suspect your child's identity has been stolen, contact the credit bureaus to check if a credit file exists. If it does and includes fraudulent accounts, follow the same dispute process using the child's information.

Tax identity theft: If someone files a tax return using your SSN, the IRS will reject your legitimate return. File Form 14039 with the IRS, continue to pay any taxes owed, and respond to any IRS notices. The IRS has an Identity Theft Victim Assistance line at 1-800-908-4490.

Medical identity theft: Request your medical records and review them for treatments or prescriptions you did not receive. Incorrect medical records can be dangerous to your health. Write to each healthcare provider requesting corrections under HIPAA.

Synthetic identity theft: Thieves combine real information (such as your SSN) with fake information to create a new identity. This can be harder to detect because it may not immediately show up on your credit report.

Prevention: Protecting Yourself Going Forward

• Keep your credit frozen at all three bureaus when not actively applying for credit.
• Use a password manager to generate and store unique, strong passwords.
• Never provide personal information in response to unsolicited calls, emails, or texts.
• Shred documents containing personal information before disposing of them.
• Opt out of pre-screened credit offers at optoutprescreen.com or 1-888-567-8688.
• Review your credit reports at least annually.
• Use credit monitoring services (many are free after data breaches).

Recovery from identity theft takes time, but the law is on your side. Document everything, follow up persistently, and do not pay for debts you did not incur. Free help is available through the FTC, your state attorney general, and legal aid organizations.