What to Do If Your Identity Is Stolen: A Step-by-Step Recovery Guide

Discovering that your identity has been stolen triggers a flood of emotions: panic, anger, violation, helplessness. The impulse is to fix everything at once, but effective recovery requires a systematic, step-by-step approach. Every action you take in the first hours and days after discovery directly impacts how quickly and completely you can recover. This guide walks you through the exact process, from initial discovery through full restoration, so you can act with confidence rather than confusion.

Identity theft recovery is a marathon, not a sprint. Depending on the complexity of the theft, full recovery can take anywhere from a few weeks to over a year. The key is to start immediately, document everything, and follow through on each step methodically. The sooner you begin, the less damage the thief can do, and the faster you will reach resolution. Let this guide be your roadmap.

Discovering the Theft: Warning Signs

Identity theft is often discovered through unexpected warning signs rather than through direct observation. You might receive a bill for an account you never opened. A credit application may be denied when you expected approval. Your tax return might be rejected because someone already filed using your Social Security number. You receive medical bills for treatments you never had. Or a debt collector contacts you about debts that are not yours.

Less obvious signs include unfamiliar charges on your bank or credit card statements, even small ones. Criminals often test stolen financial information with small charges before making larger ones. Missing mail, especially bills or financial statements, may indicate that a thief has redirected your correspondence. Receiving two-factor authentication codes you did not request means someone is attempting to access your accounts.

Sometimes the discovery comes from a data breach notification. If a company informs you that your personal information was exposed in a breach, do not ignore it. Even if no immediate theft has occurred, your information may be sold or used months later. Our guide on responding to data breaches covers the specific steps for that scenario.

The moment you suspect identity theft, begin documenting everything. Create a dedicated folder, physical or digital, for all correspondence, reports, and notes related to the incident. Record dates, times, names of people you speak with, and reference numbers for every interaction. This documentation becomes essential evidence during the recovery process.

Immediate Actions: The First 24 Hours

Speed is critical in the first 24 hours. Your first action should be placing a credit freeze at all three major credit bureaus: Equifax, Experian, and TransUnion. A credit freeze prevents anyone from opening new credit accounts in your name. This costs nothing and can be done online or by phone in minutes. Do not confuse a credit freeze with a fraud alert, which merely asks creditors to verify your identity but does not block new accounts.

Next, change passwords on all compromised accounts and any accounts that share the same password. Start with your email, banking, and financial accounts. If you suspect your email has been compromised, change its password from a different device if possible, as the attacker may have installed monitoring on your current device. Enable two-factor authentication on every account that supports it.

Contact your bank and credit card companies to report the fraud. Request that compromised accounts be frozen or closed and that new account numbers be issued. Ask for copies of any fraudulent applications or transactions, as these serve as evidence for your official reports. Most financial institutions have dedicated fraud departments that handle these cases daily.

If your Social Security number was compromised, consider filing an IRS Identity Protection PIN request to prevent tax fraud. The IRS issues a six-digit PIN that is required for filing tax returns, preventing someone else from filing in your name. This is especially important if the theft occurs near tax season. Learn more about how criminals exploit Social Security numbers in our SSN scam guide.

Identity theft victims are often targeted with secondary scams. Verify suspicious communications instantly.

Filing Official Reports

Filing an identity theft report with the Federal Trade Commission at IdentityTheft.gov is a critical step. The FTC report generates a personalized recovery plan and an official Identity Theft Report that you will need when disputing fraudulent accounts with creditors and credit bureaus. The FTC's site walks you through the process step by step and provides template letters for communicating with companies.

File a police report with your local law enforcement agency. While police may not actively investigate the theft, the police report is a legal document that creditors may require as proof of fraud. Bring your FTC Identity Theft Report, copies of fraudulent transactions or accounts, and any other evidence you have collected. Request a copy of the police report for your records.

If the theft involved specific types of fraud, file additional reports with the appropriate agencies. Tax-related identity theft should be reported to the IRS. Mail theft or postal fraud goes to the U.S. Postal Inspection Service. Social Security-related fraud should be reported to the Social Security Administration's Office of the Inspector General. Each report creates a paper trail that strengthens your case and helps law enforcement identify patterns.

Consider filing a complaint with the FBI's Internet Crime Complaint Center if the theft involved online fraud. While individual cases may not trigger an investigation, the FBI uses complaint data to identify and pursue large-scale identity theft operations.

Financial Account Recovery

With your official reports in hand, begin the process of disputing fraudulent accounts and transactions. Contact each company where a fraudulent account was opened in your name. Provide a copy of your FTC Identity Theft Report and request that the account be closed and the debt cleared. Under federal law, companies must respond to identity theft claims and cannot continue collection efforts on accounts you have reported as fraudulent.

For fraudulent charges on existing accounts, work with your bank or credit card company to dispute each transaction. Most financial institutions have 60-day windows for disputing charges, which is why speed matters. Provide copies of your reports and any supporting documentation that demonstrates the transactions were not authorized by you.

If the thief opened bank accounts in your name, contact those institutions to close the accounts. Request written confirmation that the accounts were opened fraudulently and that you bear no liability for any transactions. If checks were written from fraudulent accounts, contact the check verification companies to report the fraud.

Keep detailed records of every communication. Follow up phone calls with written correspondence sent via certified mail. Financial institutions are required by law to respond to identity theft claims within specific timeframes, and your written records serve as proof of when you reported the fraud if disputes arise later.

Restoring Your Credit

Once fraudulent accounts have been identified, dispute them with all three credit bureaus. Under the Fair Credit Reporting Act, credit bureaus must investigate disputes within 30 days and remove information that cannot be verified. Send disputes in writing, include copies of your FTC Identity Theft Report and police report, and specify each fraudulent entry by account name and number.

After the bureaus complete their investigations, request updated credit reports to verify that all fraudulent entries have been removed. If any remain, follow up with additional disputes including any new evidence. Persistence is key, as some entries may require multiple dispute rounds to fully resolve.

Monitor your credit closely for at least a year after the theft. Criminals sometimes wait months before using stolen information, and new fraudulent accounts may appear even after you think the situation is resolved. Consider maintaining your credit freeze indefinitely and only lifting it temporarily when you need to apply for credit.

Use Truvizy's scanning tool to verify suspicious communications during the recovery process. Identity theft victims are frequently targeted with secondary scams, including fake recovery services, phishing emails impersonating credit bureaus, and fraudulent debt collection attempts.

Long-Term Protection After Identity Theft

Identity theft victims are statistically more likely to be targeted again. Once your information is compromised, it may circulate through criminal marketplaces for years. Implementing robust identity theft prevention measures after recovery is essential to avoid a repeat incident.

Maintain your credit freeze as a permanent security measure. The minor inconvenience of temporarily lifting it when applying for credit is far outweighed by the protection it provides. Keep your passwords updated and unique across all accounts. Continue monitoring your credit reports and financial statements indefinitely.

Consider enrolling in an identity monitoring service that scans criminal marketplaces and data breach databases for your personal information. Early warning of a new exposure allows you to take preventive action before another theft occurs. Check whether your information is currently available on criminal marketplaces by reviewing our guide on checking the dark web for your identity.

Don't wait for the next attack, get ongoing protection for yourself and your family.

Invest in ongoing digital protection that helps you detect and respond to threats before they become full-blown identity theft incidents. The cost of prevention is a fraction of the time, money, and stress that recovery requires.

Recovery from identity theft is possible, even in severe cases. The process demands patience, persistence, and organization, but the legal protections are on your side. Document everything, follow through on every step, and do not hesitate to escalate with regulatory agencies if companies are unresponsive. You did not cause this situation, and the systems in place are designed to help you resolve it.

Related reading: Data Breach Response Guide — What to do when your data is exposed in a breach

Related reading: Password Security in 2026 — Modern strategies that actually protect your accounts

Related reading: Social Engineering Attacks — Recognize manipulation tactics before they work