Identity theft happens when someone uses your personal or financial information — your Social Security number, credit card, or bank account — to commit fraud. The early hours matter most. Here is what to do in the first 24 hours and how to protect your accounts going forward.
First 24 hours: stop the damage
1. Report the fraud to the FTC
Go to IdentityTheft.gov (the FTC's identity theft portal) and file a report. This creates an official Identity Theft Report that you can use to dispute fraudulent accounts and charges. The report gives you specific rights to block fraudulent information from appearing on your credit report.
2. Contact the companies where fraud occurred
For each account that was opened or charged fraudulently:
- Call the fraud department of the company.
- Tell them the account was opened without your permission or the charge is fraudulent.
- Ask them to close the account and send you a letter confirming the fraud.
- Get a case number for your records.
3. Place a fraud alert or credit freeze
A fraud alert tells lenders to verify your identity before opening new credit. It is free and lasts one year (renewable). A credit freeze blocks new accounts entirely. Both are free, and you can learn the difference in our credit freeze explained guide.
For a freeze, contact each of the three major credit bureaus:
- Equifax: equifax.com/personal/credit-report-services
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
4. Change passwords and enable two-factor authentication
Change the passwords on your affected accounts — and any account that shares the same password — starting with your email. Turn on two-factor authentication everywhere it is offered. The two-factor authentication guide covers the setup.
The first month: monitor and document
5. Check your credit reports
Get free credit reports from annualcreditreport.com (weekly through 2026). Look for accounts you did not open, inquiries you did not authorize, and collections you do not recognize. Dispute anything that is wrong.
6. Watch your bank and credit card statements
Review every charge for the next few months. Identity thieves often start with small charges to test whether the card is active, then move to larger ones. Report any unauthorized charge immediately — our dispute unauthorized charges guide walks through the process.
7. Check for tax fraud
If someone files a tax return using your Social Security number, it can delay your refund. The IRS handles this case through its Identity Protection Specialized Unit. If you cannot file electronically because a return was already filed under your number, file a paper return and include Form 14039 (Identity Theft Affidavit).
The ongoing: prevention for the future
8. Use a password manager
A password manager generates a unique, strong password for every account. If one service is breached, your other accounts are not affected.
9. Set up breach alerts
Monitor your email addresses against known breaches using a service like Have I Been Pwned. When a breach is reported, change the password on that account immediately.
10. Keep your identity theft report accessible
The Identity Theft Report from the FTC is your primary document for disputing fraudulent accounts. Keep it somewhere you can find it quickly, along with case numbers from each company.
Quick answers
What is the first thing I should do if my identity is stolen? Report it to the FTC at IdentityTheft.gov, then contact the companies where fraud occurred and place a fraud alert or credit freeze.
How do I freeze my credit? Contact Equifax, Experian, and TransUnion separately. Each must be frozen individually. It is free and stays until you remove it.
Do I need to file a police report? Not necessarily. The FTC Identity Theft Report is sufficient for most purposes. File a police report if you know the thief or if a creditor requires it.
How long does identity theft recovery take? It varies. Simple cases resolve in weeks; complex ones can take months. The FTC identitytheft.gov site provides a personalized recovery plan.
Sources and further reading
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.