What to Do if Your Identity Is Stolen: First Steps

Last updated: August 11, 2026

Quick Answer: When your identity is stolen, the first 24 hours should focus on three things: stop access, protect credit, and document everything. In practice, that usually means changing your main email password first, freezing credit with Equifax, Experian, and TransUnion, and filing a report at IdentityTheft.gov.

Key Facts
– A credit freeze is stronger than a fraud alert.
– The three major credit bureaus each manage their own freeze.
– Identity theft can affect credit, taxes, banking, medical records, and phone numbers.
– The FTC’s recovery site is a central starting point for U.S. identity theft cases.
– Debit card fraud can move money directly out of checking, so banks may need to act fast.
– When the case involves taxes, benefits, or medical records, the agency or service provider usually matters more than the credit bureaus at first.

Your identity is stolen? The first move is simple: stop the damage, lock down the accounts that matter most, and create a paper trail. If someone is already opening accounts, draining your bank, or filing taxes in your name, the order you act in matters.

I’m going to give you the exact sequence I would follow when helping someone through this right now. The right first step changes depending on whether this is a stolen card, a hacked email, a bank fraud problem, or full identity theft. Pick the wrong path first, and you burn time. That is exactly what thieves want.

What kind of identity theft is this?

A weird charge on one card? That may be fraud, not full identity theft. But when someone opened a new credit card, filed taxes, tried to take over your phone number, or used your name for a loan, treat it as identity theft and consider getting professional help if the situation is unclear.

The distinction matters because the response changes. One card can usually be frozen or replaced by the issuer. Once your Social Security number, phone number, email, or government ID has been exposed, though, the response has to be broader. No room for half-measures.

Here’s the simplest way I’d sort it, with professional help worth considering if you are unsure:

When you are unsure, act as though it is the larger problem, and consider consulting a fraud professional or attorney. Better to overreact for a day than to spend months unwinding a mess.

Quick check: Did you find one bad transaction, or signs that someone is using your identity across accounts?

The first 30 minutes: lock the doors that thieves use most

Think access first. If an attacker may still be inside your email, phone, bank, or credit accounts, lock those down before you start cleaning up the rest. Do not tidy the house while the door is open.

1. Change the password on your main email account first.
2. Turn on multi-factor authentication with an app or security key if you can.
3. Check recovery email addresses and phone numbers for anything you do not recognize.
4. Sign out of all devices and sessions.
5. Then change passwords on your bank, shopping accounts, and anything else tied to that email.
6. If your phone number may be at risk, call your carrier and ask about a SIM swap or port-out lock.

Why this order? Because email is usually the reset key for everything else. If someone can open your inbox, they can often get back into your bank, Amazon account, PayPal, or social media by clicking “forgot password.”

If your bank account is involved, call the fraud department on the number from the back of your debit or credit card, not a number sent in a text or email. Ask them to freeze the card, stop transfers, and note the account for fraud. Debit card cases can get ugly fast because the money is already gone from your account.

If your phone number is the weak point, ask the carrier to add a passcode, SIM protection, or port freeze. That helps prevent someone from hijacking your number and intercepting text messages.

I would not spend this first half hour combing through every old account. Secure the accounts that can unlock the rest, then widen out, and consult a professional if you cannot tell which account is the real entry point.

Quick check: Could someone with your inbox or phone number still reset your passwords right now?

How do you protect your credit after identity theft?

A new account, a loan inquiry you did not authorize, or any sign that your Social Security number has been used means your next move is to protect your credit file. That usually means a fraud alert or a credit freeze, depending on how serious the situation is.

A fraud alert is easier to place and tells lenders to verify your identity before opening new credit. A credit freeze is stronger. It blocks most new credit unless you lift it with a PIN or login. If you want the strongest barrier, I would choose a freeze.

You can place a freeze with the three major credit bureaus: Equifax, Experian, and TransUnion. Each bureau handles its own freeze. Annoying? Yes. But that is how the system works. You can also request an identity theft report and use it later to dispute accounts.

Here is the path I’d follow when credit misuse is already happening:

1. Pull your credit reports and look for accounts, inquiries, or addresses you do not recognize.
2. Place a fraud alert if you need quick signaling to lenders, or a credit freeze if you want stronger blocking.
3. Contact the lender for each fraudulent account and say the account is identity theft.
4. Ask for the account’s fraud department and request written confirmation that the account is under dispute.
5. File an identity theft report with the Federal Trade Commission at IdentityTheft.gov.
6. Use that report to support disputes with the bureaus and creditors.

The hard truth: a freeze can slow your life down for a bit. If you apply for a mortgage, car loan, apartment, or some jobs that check credit, you may need to lift the freeze temporarily. Trade-off. The upside is that a thief usually cannot open new credit while the freeze is in place.

For people in the United States, the Federal Trade Commission’s identity theft recovery process is the cleanest starting point I know of. And for freezes and alerts, the Consumer Financial Protection Bureau has clear guidance on credit freezes.

Quick check: Did you already see a new account, hard inquiry, or debt collector calling about something you never opened?

If the thief used your bank, card, or payment app, what should you do?

Money moved out of your checking account, debit card, credit card, Venmo, Cash App, PayPal, or Zelle-linked account? The first priority is stopping more transfers. After that, gather proof and, if needed, ask a bank or consumer fraud professional how to frame the dispute.

The route changes by payment type. Credit card fraud is often easier to dispute than debit card fraud. Bank transfer fraud can be harder if you authorized the transfer yourself under pressure or deception. Payment apps sit in the middle and often depend on how the transfer was funded.

Here is the route I’d take:

1. Call the bank or payment app’s fraud line immediately.
2. Ask them to freeze the account, reverse pending transfers, and issue a new card or account number if needed.
3. Change the password and sign out all sessions on the payment app.
4. Download or screenshot the suspicious transactions, dates, times, and recipient details.
5. Dispute the transactions in writing if the company allows it.
6. Keep a log of every call: date, time, name, department, and what they promised.

If a debit card is involved, I would treat it as urgent because the money is directly tied to your checking account. You may need to ask the bank whether overdraft protection, card controls, or account closure make sense. If your bank account itself was compromised, close the account and open a new one. A password change alone is not enough.

If a credit card was used without permission, report it as unauthorized card fraud right away. Ask for a replacement card and a zero-liability review if the issuer offers it. If your bank asks whether the charge was “authorized,” answer carefully. “I did not make this purchase” is clearer than a long explanation.

One honest limitation: if you approved a transfer after someone tricked you by phone or text, the path may be different. Some scams look like identity theft but are really authorized push payment fraud. That can change your rights and how fast you need to act, so if the amount is significant, talk to your bank’s fraud team and, if needed, a consumer attorney.

Quick check: Did money leave a bank account, card, or payment app, or are you still in the “someone tried” stage?

If your tax, medical, or government records were used, what comes next?

Someone filed a tax return in your name, used your health insurance, or tried to take benefits or government services? The usual “call the bank and freeze credit” advice is incomplete. You need the agency or provider that controls that record.

For tax identity theft, contact the IRS and follow its identity theft procedures. If your refund was stolen or your return was rejected because one had already been filed, the IRS matters more than the credit bureaus at first.

For medical identity theft, contact the provider’s billing office and the insurer. Ask for the records, dispute services you did not receive, and request corrections in writing. Medical identity theft can be especially messy because the damage may show up as bills, mixed records, or denied coverage.

For government benefits or ID documents, contact the issuing agency right away. If your driver’s license, passport, or national ID was stolen, report the theft to the agency that issued it and ask how to replace or flag it. If your Social Security number is exposed, you cannot “replace” it, so the goal becomes protection, documentation, and monitoring.

The best sequence here is usually:

1. Contact the agency or service provider tied to the fraud.
2. Ask exactly what they need to mark the record as compromised.
3. File the FTC identity theft report if you have not already.
4. Keep copies of letters, case numbers, and names.
5. Put a credit freeze in place if the theft could spread to new accounts.
6. Monitor mail for new notices, bills, or benefits letters.

This section is where generic advice fails most often. People rush to freeze credit and ignore the agency that actually controls the bad record. Then the tax, medical, or benefits problem keeps breathing.

Quick check: Is the problem showing up in taxes, insurance, benefits, or government records rather than just bank accounts?

Edge cases where the normal advice breaks down

When any of these is your situation, change the playbook.

• Situation: You still have the stolen phone, wallet, or laptop.
  What changes: The device itself is part of the breach.
  What to do instead: Remote-lock or wipe the device if possible, then change passwords from a different device. If the wallet is gone, replace cards before spending time on account cleanup.

• Situation: The thief is someone you know.
  What changes: They may already know your answers, addresses, or recovery info.
  What to do instead: Remove old recovery methods, change passwords from a safe device, and consider that shared family plans, joint accounts, or access to mail may be the weak point.

• Situation: Your Social Security number is exposed but you see no fraud yet.
  What changes: There may be a delay before accounts appear.
  What to do instead: Freeze your credit now, not after the first bill shows up. Then monitor credit reports and mail.

• Situation: You lost access to your email and phone at the same time.
  What changes: Account recovery gets much harder.
  What to do instead: Start with the email provider and mobile carrier in person or through their account recovery channels. Ask them to secure the account before trying to reset everything else, and consider professional help if recovery stalls.

• Situation: A child’s identity is involved.
  What changes: Fraud may sit undetected for years.
  What to do instead: Check whether a credit file exists for the child, then freeze it if appropriate. Children are often overlooked because they do not actively use credit.

• Situation: The amount is small.
  What changes: Small fraud can be a test run.
  What to do instead: Do not dismiss it. A $5 charge can be a signal that the thief is testing whether the card or account is alive.

Quick check: Are you dealing with a lost device, a known person, a child’s identity, or a tax/benefits case that needs a different agency?

What should you document so you can prove the theft later?

If you are going to dispute charges, accounts, or collections, keep a clean record from the start. People lose leverage when they rely on memory and scattered screenshots.

Create one folder, digital or paper, and put everything in it:

• screenshots of suspicious charges, emails, texts, and login alerts
• dates and times of calls
• names and departments of every person you speak with
• copies of dispute letters and confirmation numbers
• police report, if you file one
• the FTC identity theft report
• letters from lenders, banks, credit bureaus, insurers, or agencies

I would also keep a simple timeline. Not a novel. Just: what happened, when you noticed it, who you contacted, and what they said. That timeline helps if you need to escalate, file disputes, or correct mixed-up records later.

Should you file a police report? Sometimes yes, sometimes no. If the thief is local, there is a real financial loss, or a company asks for a police report as part of its process, filing one can help. But a police report is not always required to start the recovery. For many people, the FTC identity theft report is the more useful first document.

One drawback here: document gathering feels slower than calling everyone in panic. But without proof, you may end up repeating the same story to three different companies and still not get the fix.

Admin