Identity Theft Recovery: Step-by-Step Action Checklist

Recovery works best when containment, documentation, credit-file cleanup, and noncredit problems are handled as separate jobs. Trying to solve everything with a credit dispute or monitoring subscription can leave the source account or another type of identity misuse untouched.

No universal 30-day recovery calendar applies. Some tasks are urgent, while others continue until every affected record is corrected.

Step 1: Contain Active Fraud and Secure Access

Start with the accounts and credentials that can still be abused. Treat identity-theft warning signs such as an unfamiliar bank login, card transaction, password-reset notice, or fraudulent account application as higher priority than paperwork that cannot create new losses.

Secure email and important logins

Change compromised passwords and replace reused credentials anywhere else they appear. Protect the primary email account especially carefully because access to that inbox can let an attacker reset passwords at banks, retailers, social platforms, and other services.

Turn on multifactor authentication where available and review recovery phone numbers, backup email addresses, remembered devices, and connected apps for changes you did not make.

Lock down financial accounts

Contact banks and card issuers through a trusted channel and report unauthorized activity. Depending on the account, the institution may freeze transactions, replace a card, issue new account credentials, reverse qualifying fraudulent charges, or add monitoring.

Compromised phones require their own response. A suspected SIM swap, lost device, or hijacked mobile account can undermine one-time security codes, so contact the wireless carrier and secure the device account as well.

Preserve evidence before it disappears

Save suspicious emails, texts, account screenshots, statements, collection letters, fraud notices, and confirmation numbers. Keep dates, company names, contact methods, and case numbers in one recovery file.

Once active access is contained, move from emergency response to formal documentation and credit protection.

Step 2: Create the Identity-Theft Record and Protect Your Credit Files

IdentityTheft.gov is the federal reporting portal for confirmed identity theft. The portal can generate an Identity Theft Report and a recovery plan with letters and steps matched to the fraud you describe.

Place the right credit-file protection

An initial fraud alert can be placed through one nationwide bureau, which must notify the other two. Once placed, the alert is free for one year and tells prospective creditors to take identity-verification steps before granting new credit.

Security freezes create the stronger access control. Freeze Equifax, Experian, and TransUnion separately when new-account fraud is a meaningful risk; placement, temporary lifts, and removal are free under federal law.

Review all three credit reports

Use AnnualCreditReport.com, the official federally authorized source, to review Equifax, Experian, and TransUnion. Look for unfamiliar accounts, inquiries, addresses, collections, or personal information that may be connected with the theft.

Current online access allows free weekly reports from each nationwide bureau, which can be useful while an identity-theft case is active.

Notify companies where fraud occurred

Contact each creditor, bank, lender, merchant, collector, or service provider connected with the misuse. Ask the appropriate fraud department to close or secure the account, stop treating you as responsible, and provide written confirmation of the outcome.

A police report is not automatically required for every identity-theft recovery step. It can still be useful or requested in particular cases, especially when the thief is known, local criminal activity occurred, or a company asks for additional documentation.

Step 3: Block Fraudulent Credit Information and Repair Other Records

Fraudulent bureau information has a specific federal remedy. For a complete Section 605B request, generally provide proof of identity, an Identity Theft Report, identification of the information resulting from identity theft, and a statement that it does not relate to a transaction you made.

Qualifying information generally must be blocked within four business days after the consumer reporting agency receives those materials. That process is different from the ordinary credit-report dispute framework used for non-identity-theft inaccuracies.

Use the identity-theft blocking process for the detailed documentation and follow-up steps.

Follow through with creditors and collectors

Credit-report blocking does not automatically repair every internal account record. Send identity-theft documentation to the companies involved, ask for written confirmation that you are not liable, and keep proof that collection or reporting was corrected.

Handle tax identity theft through the IRS

Unexpected IRS notices, duplicate-return messages, or earnings you do not recognize can signal tax-related identity theft. Follow the instructions in the specific IRS notice or the current Identity Theft Central workflow.

Form 14039, Identity Theft Affidavit, is not a generic response to every lost Social Security number or non-tax fraud event. Complete Form 14039 only when the IRS instructions and facts of the tax identity-theft case call for it.

An Identity Protection PIN can also help prevent fraudulent federal tax returns. The IRS issues a new six-digit IP PIN each year, and eligible taxpayers can request one proactively after identity verification.

Address Social Security and other noncredit misuse

Review Social Security earnings records for work you do not recognize and use the appropriate SSA or Office of Inspector General channel for suspected misuse. Benefits fraud, medical identity theft, utilities, phone accounts, and leases may require direct correction with the agency or provider involved.

Each system keeps its own records. Even a clean credit report does not prove that tax, medical, employment, or government-benefit identity theft has been resolved.

Step 4: Verify the Cleanup and Strengthen Ongoing Protection

Recovery is complete only when the affected records and access points are actually corrected. Fresh credit reports, final creditor letters, replacement account details, and government confirmations provide stronger evidence than a verbal promise from a call center.

Keep freezes and alerts for as long as the risk supports them

Persistent identifiers such as a Social Security number can remain useful to criminals long after the first incident. Standing credit freezes reduce new-account exposure without requiring constant manual monitoring, and legitimate applications can be handled with temporary lifts.

No single federal monitoring period fits every victim. Monitoring duration depends on what information was stolen, whether it was actually used, and whether new suspicious activity continues.

Monitor the places credit reports cannot see

Bank and card alerts can catch existing-account fraud. Tax and government notices may reveal noncredit misuse, while email security alerts can expose another account takeover attempt.

Credit monitoring can add convenience, but understand its scope before paying for it. Compare credit monitoring with broader identity protection before choosing a paid service.

Improve household security

Unique passwords, multifactor authentication, software updates, careful handling of sensitive documents, and skepticism toward urgent requests for verification codes reduce repeat exposure.

Children and other family members can also be affected by identity theft. Shared incidents—such as stolen tax records or a major data breach—may justify checking whether more than one person’s information was involved.