Quick answer: Report the theft at IdentityTheft.gov, the FTC’s official site. It creates an Identity Theft Report and a step-by-step recovery plan. Then place a fraud alert or credit freeze, contact the companies where fraud occurred, and change compromised passwords.
Key Takeaways
- Report at IdentityTheft.gov to get an official FTC report and recovery plan
- Place a fraud alert or credit freeze right away
- Contact each affected company’s fraud department
- Change passwords and enable two-factor authentication
Step 1: Report to the FTC
At IdentityTheft.gov describe what happened. You will receive an Identity Theft Report, which businesses and credit bureaus accept as proof, plus prefilled letters.
Step 2: Place a fraud alert or freeze
A fraud alert (free, one year, set at one bureau which notifies the others) tells lenders to verify identity. A credit freeze (free at all three bureaus) blocks new credit entirely and is stronger.
Step 3: Contact affected companies
Call the fraud department of each bank, card issuer, or company where an account was opened or misused. Ask them to close or freeze the account and send written confirmation.
Step 4: Secure your accounts
- Change passwords and enable two-factor authentication on email and financial accounts
- Review credit reports at AnnualCreditReport.com
- Set up transaction alerts on your cards
Special situations
- Tax identity theft: file IRS Form 14039 and get an Identity Protection PIN.
- Medical identity theft: request records from providers and correct errors.
- Stolen SSN used for employment: contact the Social Security Administration and check your earnings record.
Should you file a police report?
The FTC report is usually sufficient, but some creditors require a police report. Bring your FTC report and ID to your local department.
FAQ
Am I liable for fraudulent charges? Federal law limits credit card liability to $50, and most issuers waive it. Debit card protection depends on how quickly you report.
How long does recovery take? Simple cases resolve in weeks; complex ones can take months. Keep a log of every call and letter.
Should I pay for identity monitoring? Optional. Freezes and free monitoring from your bank cover most needs.
The first hour matters more than the first week
Identity theft response is a race against how fast the thief can convert access into money. Two actions in the first hour reduce damage more than anything you do later.
First, secure your email account before anything else. Email is the recovery mechanism for every financial account you own, so a compromised inbox undoes every other protective step. Change the password and enable two-factor authentication with an authenticator app, not SMS.
Second, place a credit freeze at all three bureaus rather than a fraud alert. A freeze blocks new credit outright; an alert only asks lenders to verify identity, which some do perfunctorily. Freezes are free by law and take effect within an hour when placed online.
Building the paper trail that everything else depends on
IdentityTheft.gov generates an Identity Theft Report, which is the document banks, creditors, and bureaus accept as proof. Without it, each company applies its own standard and you repeat your story indefinitely. With it, you gain specific legal rights: creditors must stop collection on disputed fraudulent accounts, bureaus must block fraudulent information from your report, and an extended seven-year fraud alert becomes available.
The site also produces prefilled dispute letters and a checklist that tracks what you have completed. Before starting, gather your credit reports from all three bureaus, statements showing the fraudulent activity, any collection notices, and the breach notification if you received one.
Keep a log from the first call onward: date, time, company, representative name, what was promised, and any reference number. This log is what settles disputes months later when a company claims it was never notified.
Different types of identity theft need different agencies
Credit card fraud is the version everyone pictures, but several other types require entirely different responses.
Tax identity theft, where someone files a return using your Social Security number, is handled with IRS Form 14039 and by requesting an Identity Protection PIN, which prevents future fraudulent filings.
Medical identity theft means someone received care under your name, which can corrupt your medical records with another person’s blood type or allergies. Request records from each provider and insurer, and ask for an accounting of disclosures.
Employment-related theft, where your Social Security number is used to work, surfaces as unfamiliar income on your Social Security earnings record. Contact the Social Security Administration and review your earnings statement.
Government benefits fraud, particularly unemployment claims filed in your name, is reported to the state agency involved as well as through IdentityTheft.gov.
Child identity theft requires first checking whether a credit file exists for your child at all, then freezing it.
Your actual liability, which is lower than most people fear
Federal law caps credit card liability for unauthorized charges at $50, and virtually every major issuer waives even that under zero-liability policies. Debit cards are governed by different rules with a sliding scale: up to $50 if you report within two business days of learning about the loss, up to $500 if you report within 60 days of the statement, and potentially unlimited after that.
This difference is the strongest practical argument for using a credit card rather than a debit card for online purchases and travel. With a credit card, disputed funds were never yours to begin with. With a debit card, the money leaves your account while the bank investigates, which can take weeks and cause bounced payments in the meantime.
After the cleanup: what to keep in place permanently
Most people restore access, breathe out, and remove the protections. Stolen data circulates for years, and re-victimization is common.
Keep the credit freeze in place permanently and lift it only when you apply for credit, which takes about an hour online. Keep the IRS Identity Protection PIN. Create a my Social Security account so nobody else can create one using your number. Use a password manager so a breach at one company does not cascade. Opt out of prescreened offers at OptOutPrescreen.com. And review all three credit reports every few months for at least two years, which is free weekly at AnnualCreditReport.com.
Sources
Last updated: August 16, 2026. Written by the InfoBrief Editorial team. We link to official government and company sources and update articles when facts change. See our disclosure.