Identity Theft Basics: First Steps When Someone Uses Your Identity

Identity theft means someone is using your personal information — your Social Security number, bank details, or account logins — without your permission, usually to open accounts, drain money, or commit fraud in your name. It rarely announces itself. Most people find out from a strange bill, a collection call about a debt they never incurred, or a login alert they didn’t trigger. The good news: the recovery path is well marked, the two most powerful tools (credit freezes and the FTC’s IdentityTheft.gov) are free, and acting in the first days makes a real difference. This guide walks the path in order.

How identity theft shows up

None of these signs alone proves identity theft, but each one deserves a hard look:

• An account, loan, or credit inquiry on your credit report that you don’t recognize
• Bills, statements, or collection letters for accounts or medical services you never used
• Password reset emails, login alerts, or two-factor codes you didn’t request
• A tax return rejected because “you” already filed, or an IRS notice about wages from an employer you’ve never worked for
• Notices about unemployment or other government benefits you never claimed
• Mail that stops arriving, or a credit report showing an address that isn’t yours
• Your phone suddenly losing service — a possible sign your number was hijacked in a SIM swap

If any of these hit close to home, pull your credit reports from all three bureaus and read them line by line. Our credit report basics guide explains how to get your reports and what each section means.

First steps, in order

Identity theft recovery is a sequence, and the order matters.

1. Call the companies where fraud happened. If a card was misused or an account was opened in your name, contact that company’s fraud department first. Ask them to close or freeze the fraudulent account and confirm in writing that you won’t be held responsible for the charges. Get a case number every time.
2. Place a fraud alert. One call or online request to any of the three bureaus — Equifax, Experian, or TransUnion — and that bureau must notify the other two. A fraud alert is free and tells lenders to verify your identity before extending new credit.
3. Report at IdentityTheft.gov. This is the FTC’s official identity theft site. It builds a recovery plan for your specific situation and generates an FTC identity theft report — the key document for everything that follows.
4. Freeze your credit at all three bureaus. Unlike the alert, you must contact each bureau separately for a freeze. It’s free everywhere and it’s the single strongest move you can make, because it blocks new credit in your name outright.
5. Lock down your accounts. New passwords everywhere the thief might have reached, starting with your email account, which controls password resets for everything else. Turn on two-factor authentication. If your phone number was involved, call your carrier and ask for a port-out lock or PIN.

Fraud alerts vs. credit freezes

These two tools get confused constantly, so here’s the plain version.

A fraud alert is a flag on your credit report asking lenders to take extra care verifying identity before opening new credit. It’s free, one bureau notifies the others, and an initial alert lasts one year. With an FTC identity theft report you can get an extended alert that lasts seven years. The weakness: the lender decides how much extra care to take.

A credit freeze doesn’t ask — it blocks. Lenders can’t pull your report at all, so new applications in your name simply fail. Freezes are free at all three bureaus, free to lift, and they last until you remove them. The cost is convenience: when you want a new card, loan, or apartment credit check, you have to temporarily lift the freeze, which you can do online in minutes.

If you’ve confirmed identity theft, use both. If you’re merely worried, a freeze alone is the better everyday protection — and it’s reasonable protection even for people who have never been a victim.

Use IdentityTheft.gov — it’s the hub

Everything in identity theft recovery routes through documentation, and IdentityTheft.gov is where the core document comes from. When you report there, the site:

• Asks what happened and builds a personal recovery plan — a checklist ordered for your exact situation, whether that’s a fraudulent credit card, a hijacked tax refund, or a stolen SSN
• Generates an official FTC identity theft report, which you’ll attach to disputes with credit bureaus, creditors, and debt collectors
• Pre-fills dispute letters for many common situations

Keep the report and your recovery plan in a dedicated folder along with every case number, letter, and confirmation you collect. Identity theft cleanup can stretch over months, and the person with organized records is the person whose disputes stick.

Disputing fraudulent accounts and credit report errors

Once you have your FTC identity theft report, work through the fraud item by item:

1. Dispute with the credit bureaus. Write to each bureau reporting the fraudulent account, identify the item, state that it resulted from identity theft, and attach your FTC report. Bureaus must investigate, and identity theft victims can have fraudulent information blocked from their reports.
2. Dispute with the company itself. Contact the fraud department of the lender or merchant where the account was opened. Ask them to close the account, absorb the fraudulent charges, and send you written confirmation.
3. Answer debt collectors in writing. If a collector calls about a fraud debt, tell them — in writing — that the debt results from identity theft, and include your FTC report. Never pay a fraudulent debt just to make the calls stop; payment can be treated as admitting the debt is yours.
4. Re-check your reports a few months later. Fraudulent items sometimes reappear or get re-sold to new collectors, and a fresh report is how you catch it.

Special situations

Tax identity theft. If a return was filed in your name, respond to any IRS notice promptly and follow the IRS’s identity theft procedures; IdentityTheft.gov’s recovery plan includes the tax-specific steps.

Government benefits fraud. Unemployment and benefits fraud in your name should be reported to the agency that issued the benefit, in the state where it was claimed — even if you’ve never lived there.

Account takeover. If the thief controls your actual email, bank login, or social media account, recovering access comes first — use each platform’s account recovery process, then change every password that email address could reset.

Online-based theft. When identity theft flows from a hack, phishing email, or online scam, also file a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov. It doesn’t replace IdentityTheft.gov — it adds your case to federal cybercrime tracking.

Watch for the follow-up scams

Identity theft victims land on target lists. Expect calls or emails from “fraud departments,” “credit repair specialists,” or “recovery services” offering to erase the fraud, restore your credit score, or recover stolen money — for a fee, or for your passwords. Everything legitimate in identity theft recovery is free or nearly free, and no one can lawfully remove accurate information from a credit report or guarantee recovery of stolen funds. If the identity theft began with a scam payment, our scam recovery guide covers what your bank can and can’t do — and how to recognize the second wave of scammers.

When to get help

Most identity theft cleanup is something you can do yourself with IdentityTheft.gov’s plan and patient record-keeping. Bring in professional help when the situation escalates: you’re sued over a fraudulent debt, a collector ignores your identity theft report, the theft involves your tax records or government benefits and you’re getting nowhere, or the sheer scale is overwhelming. A consumer attorney can enforce the credit reporting and debt collection laws that protect victims — and if a collector or bureau breaks those laws, you may not owe the attorney anything out of pocket. If money is tight, start with our guide to finding legal help and our legal aid basics guide, which explain where free and low-cost civil legal services come from and who qualifies.