Your Identity Was Stolen: The Exact Steps to Take, In Order

An unfamiliar charge on your card. A collection notice for a debt you don't recognize. A tax return rejected because someone already filed one using your Social Security number. That's how most people find out. There's no siren, no warning — just a small sign that something is wrong.

In 2024, the FTC received more than 1.1 million identity theft reports, part of 6.5 million total fraud and identity theft reports that year. This isn't rare. It's common enough that having an actual plan matters more than panicking.

Here's the order to do things in, and why the order matters.

Step 1: Contain the damage today

Before you file anything or call any agency, stop the bleeding on the accounts you already know are compromised.

• Call the fraud department of any bank, card issuer, or company where you spotted unauthorized activity. Tell them it's identity theft and ask them to close or freeze the account.
• Change the passwords and PINs on those accounts, and on your email — thieves often pivot from one compromised account to your inbox to reset everything else.
• If a physical card, checkbook, or Social Security card was stolen, report it separately.

This step happens before you file any government report. Every hour a compromised account stays open is an hour more damage can pile up.

Step 2: File your official reports

Once the immediate bleeding is stopped, go to IdentityTheft.gov, the FTC's official reporting site. You'll answer questions about what happened, and the site generates two things: an FTC Identity Theft Report and a personalized recovery plan with pre-filled letters and forms you can send to businesses, credit bureaus, and debt collectors. This report matters because it gives you legal standing — businesses have to take it seriously, and it's what lets you get certain fraudulent items removed from your credit report without a fight. You can also file a report with your local police department, though it's optional in most cases.

Step 3: Decide between a fraud alert and a credit freeze

These two tools do different jobs, and you can use either one — or both.

A credit freeze is the stronger tool: with a freeze in place, most lenders can't see your report at all, so they won't approve new credit in your name. You'll need to contact each of the three bureaus (Equifax, Experian, TransUnion) separately to freeze all three files, though placing a fraud alert with just one bureau requires that bureau to notify the other two.

If you already have an identity theft report from Step 2, you qualify for the extended fraud alert, which lasts seven years instead of one.

Step 4: Pull your credit reports and dispute what's wrong

Go to AnnualCreditReport.com — the only site authorized to give you free reports from all three bureaus. This access is now permanent and weekly, not just once a year, so there's no reason to put this off. Go through each report line by line. For any account or transaction you don't recognize, file a dispute with the bureau reporting it. Include a copy of your Identity Theft Report and a form of ID. Accounts opened fraudulently in your name can typically be blocked from your report once you provide that documentation.

Step 5: Watch for tax identity theft specifically

If someone used your Social Security number to file a fraudulent tax return, you likely won't find out until your own return gets rejected for e-filing because "a return has already been filed" under your SSN. Don't jump straight to filing IRS Form 14039 (Identity Theft Affidavit) unless the IRS tells you to or your e-filed return gets rejected for this exact reason — in most cases the IRS's own filters catch a suspicious return first and send you a letter (5071C, 4883C, or 5747C) asking you to verify your identity, and you follow those instructions instead. Filing 14039 when it's not needed just slows things down. Once you've dealt with an incident, consider signing up for an IRS Identity Protection PIN. It's a six-digit number, known only to you and the IRS, that blocks anyone else from filing a return using your SSN. It's valid for one calendar year and you'll get a new one automatically each January.

Step 6: Keep monitoring after the immediate crisis passes

Recovery isn't a one-time event. Set a recurring reminder to check your credit reports for a few months after the incident — weekly, if you want to use the free access fully. Keep an eye on:

• New accounts you didn't open
• Hard inquiries you don't recognize
• Address changes you didn't make
• Collection notices for debts that aren't yours

If you want a quick gut-check on where your overall finances stand while you're already in review mode, running your numbers through a tool like Grade My Finance can help you see whether the incident dented anything beyond your credit — savings, debt ratios, or your emergency fund — so you're fixing the whole picture, not just the credit report.

What this actually costs you if you skip steps

The main risk of skipping the fraud alert or freeze isn't emotional — it's financial. New accounts opened in your name can rack up debt collectors will eventually come after you for, even though you never agreed to it. Fixing that after the fact takes far longer than freezing your file up front would have. The FTC's own data shows fraud losses reported by consumers reached $12.5 billion in 2024, a 25% jump from the year before — the trend is toward more successful fraud per victim, not fewer victims, which is exactly why locking things down early matters more each year, not less.

The bottom line

Identity theft recovery isn't complicated once you know the order: stop the immediate damage, file your official report, freeze or alert your credit, dispute what's wrong, handle any tax-specific fallout separately, and then keep checking. None of these steps cost money. All of them are things you control. The part that actually takes discipline is doing them in order instead of all at once out of panic.