Identity Theft Recovery: Step-by-Step Action Checklist

Discovering charges you don’t recognize, denial letters for accounts you never opened, or an IRS notice about a tax return you didn’t file can be terrifying. The good news: identity theft is disruptive, but there is a clear process to contain the damage and take back control. The faster and more organized your response, the easier it is to prove what’s fraudulent, fix your records, and protect your credit. This checklist walks you through what to do in order — from the very first hour to the follow-up steps that many people miss.

Step 1: Immediate actions in the first hours

The moment you suspect identity theft — a notification from your bank, a login you don’t recognize, a debt collection call for an account you never opened — treat it as real until you prove otherwise. Quick steps in the first few hours can stop more damage before it spreads. Focus first on the accounts and access points thieves can actively use right now.

1. Secure your logins. Change passwords for your email, financial accounts, and any account tied to money, credit, or sensitive data. Turn on multi-factor authentication (MFA) everywhere you can. Start with your primary email: if someone controls that inbox, they can reset nearly everything else.

2. Lock or replace compromised cards and accounts. Call the number on the back of your card or use your bank’s app to lock, cancel, or reissue compromised debit and credit cards. Ask the issuer to reverse fraudulent charges and send you written confirmation of your dispute and account changes.

3. Save evidence. Take screenshots of suspicious transactions, emails, texts, letters, and collection notices. Keep confirmation numbers from phone calls and chats. Create a simple folder (digital or paper) where you store every document, date, and contact name. This “paper trail” will be crucial when you dispute items later.

4. Do not respond directly to suspicious messages. If you received emails, texts, or calls asking for personal data, do not click links or call numbers in those messages. Instead, go directly to the official website or the number on the back of your card to verify activity. Many identity theft incidents start with phishing that looks “almost” legitimate.

5. If your phone or device is lost or hacked, act now. Use your device’s “find my” or remote wipe tools, change your Apple ID/Google account password, and notify your wireless carrier if your SIM or number might be compromised.

These first moves are about shutting doors. Once the immediate exposure is contained, you can turn to official reports, your credit files, and systematic cleanup.

Step 2: Secure your credit file and file an official identity theft report

After you’ve stabilized your accounts, your next priority is to protect your credit reports and create an official record that proves you’re a victim. This documentation gives you rights under federal law to block fraudulent information and debts.

1. Go to IdentityTheft.gov (FTC). Use the Federal Trade Commission’s official portal at IdentityTheft.gov to report what happened. Based on your answers, it generates:
a formal Identity Theft Report, and
a personalized recovery plan with letters and checklists you can use with banks, credit bureaus, and collectors.
This report is powerful evidence when you dispute fraudulent accounts.

2. Place a fraud alert on your credit reports. Contact any one of the three nationwide credit bureaus (Equifax, Experian, TransUnion) and request an initial fraud alert. That bureau must notify the others. Lenders then have to take extra steps to verify your identity before opening new credit. Alerts are free and, as of current rules, generally last one year and can be renewed.

3. Consider a credit freeze (security freeze) for stronger protection. A credit freeze blocks most new creditors from accessing your reports, making it very hard for identity thieves to open new accounts in your name. Freezes are free nationwide; you place and lift them separately with Equifax, Experian, and TransUnion. You can temporarily lift a freeze when you legitimately apply for credit.

4. Order and review your credit reports. Go to AnnualCreditReport.com (the only federally authorized site) to get your reports from all three bureaus. Look for:
new accounts you don’t recognize,
credit inquiries from unfamiliar lenders,
addresses or personal information that aren’t yours.
Flag every suspicious item for follow-up.

5. Contact affected companies’ fraud departments. For each fraudulent account or transaction, call the company’s dedicated fraud line. Ask them to:
close or freeze the account,
remove fraudulent charges,
notate that it was identity theft,
send you written confirmation.
Use your Identity Theft Report and any police report as backup.

6. Consider filing a police report. Local police reports may help in some cases (for example, when a creditor or collector requests it, or when the thief is known). Bring copies of your FTC report, government ID, and evidence.

By the end of this step, you should have: an FTC Identity Theft Report, alerts and/or freezes in place, your credit reports in hand, and active disputes in progress with impacted companies.

Step 3: Dispute fraudulent items and repair financial records

Once you’ve contained the immediate damage and set alerts or freezes, the work shifts to cleaning your files. This is where staying organized pays off. Your goal is to remove fraudulent accounts, charges, and inquiries — and to prevent collectors or lenders from treating identity theft as unpaid debt.

1. Dispute fraudulent accounts with the credit bureaus. Send disputes (online or by mail) to Equifax, Experian, and TransUnion for any account, inquiry, or record that is not yours. Include:
your Identity Theft Report,
a copy of your ID and proof of address (if requested),
a clear explanation of what’s fraudulent.
Ask them to block fraudulent information as allowed by federal law.

2. Follow up with creditors and collectors in writing. For each affected creditor or collection agency, send a letter stating the account is identity theft, attaching your Identity Theft Report and any police report. Request:
written confirmation that you are not liable,
removal of the account from your record,
no further collection attempts for that fraudulent debt.

3. Handle tax-related identity theft separately. If you receive an IRS notice about a return you didn’t file or income you didn’t earn, follow IRS instructions carefully. In some cases, you’ll file Form 14039 (Identity Theft Affidavit) or use IRS online verification tools, depending on the notice you received. Only use Form 14039 for tax-related identity theft when the IRS directs or when your information was clearly misused for tax fraud.

4. Address Social Security number misuse. If someone is using your SSN for work, benefits, or other fraud:
review your Social Security statements for unfamiliar earnings,
report misuse through the Social Security Administration and its Office of Inspector General,
follow SSA instructions if your number has been compromised or benefits abused.

5. Clean up other records. Depending on the case, you may need to:
update your bank account numbers,
change direct deposit info for payroll or benefits,
correct utility, cell phone, or lease records opened fraudulently,
work with your insurer or providers if medical identity theft occurred.

6. Keep copies of all outcomes. Save letters showing fraudulent debts were removed or closed. These documents are critical if items reappear or if a future lender questions your history.

Step 4: Monitor, strengthen, and prevent future attacks

Identity theft recovery doesn’t end when the first fraudulent charge is fixed. Thieves may test your information again months or years later, or sell it to others. A strong monitoring and prevention routine helps ensure you only have to fight this battle once.

1. Monitor your credit regularly. For the next 12–24 months, check your reports periodically (you can get free reports more frequently via AnnualCreditReport.com and some monitoring tools). Look for new accounts, inquiries, or address changes. Act quickly if anything looks off.

2. Use alerts from banks and card issuers. Turn on real-time alerts for transactions, new payees, sign-ins from new devices, and profile changes. These alerts often catch fraud before statements are even generated.

3. Tighten your security hygiene. Use strong, unique passwords for every important account, stored in a reputable password manager. Turn on MFA (prefer app-based or hardware keys over SMS where possible). Keep your devices updated and avoid public Wi-Fi for sensitive logins unless you’re using a trusted VPN.

4. Be cautious with sharing personal information. Shred documents with financial or personal data. Limit what you share on social media (full birthdate, address, kids’ schools, etc.). Be skeptical of unsolicited calls, emails, or texts demanding urgent action, payments, or verification codes.

5. Consider longer-term freezes or alerts. If your SSN or core identifiers were exposed in a major breach, keeping a long-term credit freeze in place is often a smart, low-cost safeguard. You can temporarily lift it when you legitimately apply for credit.

6. Educate your household. Identity theft often affects entire families — including children and older adults. Teach basic red flags (phishing, tech support scams, romance scams, fake government calls), and review their statements and notices with them if needed.

7. Know when to get professional help. If your case is complex — multiple fraudulent accounts, criminal or medical identity theft, or cross-state issues — consider:
nonprofit credit counseling agencies for budgeting and debt issues,
legal aid or a consumer law attorney if creditors refuse to remove fraudulent items,
direct work with the FTC, IRS, SSA, or state AG where required.

Strong habits plus the legal protections already in place for consumers give you leverage. With a structured plan, most victims can restore their records and move forward without permanent damage.