Identity theft: what to do right now

Published October 22, 2026

If your identity was stolen, do three things today: call the company where the fraud happened and close the account, report it at IdentityTheft.gov to get your official recovery plan, and freeze your credit at Equifax, Experian and TransUnion (and three smaller agencies). All of it is free. Then fix your credit report and protect your taxes and Social Security.

Today: stop the damage

1. Call the company where the fraud happened

Use the number on the back of your card or on the company's official website, not one from an email or text. Ask for the fraud department and say: “Someone opened this account (or made these charges) using my identity. Please close it, remove the charges and send me a letter confirming I'm not responsible.” Write down the date, the name of the person and what they said.

Then change the passwords and PINs of that account, and of your email: whoever controls your email can reset everything else. Turn on two-step verification.

2. Report it at IdentityTheft.gov

The Federal Trade Commission's site asks what happened and gives you two things: an FTC Identity Theft Report, which works as proof you're a victim, and a personal recovery plan with pre-filled letters. Save the PDF of the report; you'll need it for several steps below.

3. Freeze your credit at the three bureaus

A freeze stops anyone, including you, from opening new credit in your name until you lift it. It's free by law and lasts until you remove it, but you have to do it at each bureau separately. The step-by-step, with links and phone numbers, is in how to freeze your credit at all six bureaus.

If you prefer an alert to a freeze, a fraud alert tells lenders to verify your identity before opening anything. Placing it at one bureau notifies the other two. The initial alert lasts one year; with your FTC Identity Theft Report you can get an extended alert of seven years.

This week: clean up your credit

4. Get your credit reports

Download all three for free at AnnualCreditReport.com, the only official site; you can do it every week. Mark every account, inquiry or address you don't recognize.

5. Block the fraudulent information

Send each bureau your Identity Theft Report and a letter listing what's fraudulent (your recovery plan includes the letter). Under the Fair Credit Reporting Act, the bureau must block that information within four business days of receiving it. Send the same letter to each company that opened a fake account, and ask them to stop reporting it.

6. Watch for debt collectors

If a collector calls about a debt that isn't yours, tell them in writing that it's the result of identity theft and include your report. They must stop collecting while they check, and tell the company that hired them.

Protect the rest: taxes, Social Security, bank accounts

IRS: request an Identity Protection PIN. With it, nobody can file a tax return with your Social Security number.
Social Security: create your my Social Security account at ssa.gov before a thief does it for you.
Bank accounts and phone lines: thieves also open checking accounts and phone or utility contracts, which the big three bureaus don't cover. Freeze those too, for free, at ChexSystems (bank accounts) and NCTUE (phone, utilities).
Your children: if their information was exposed too, you can freeze the credit of a child under 16 at each bureau.

If money was taken from your bank

Call the bank immediately and dispute every unauthorized transaction in writing. With credit cards, your liability for unauthorized charges is capped at $50 by federal law. With debit cards and transfers, protection depends on how fast you report, so don't wait for the statement.

If you only got a breach notice

If a company told you your data was exposed but nobody has used it yet, start with what to do after a data breach: the steps depend on what was taken.

How long recovery takes

Closing accounts and freezing credit takes an afternoon. Removing fraudulent accounts from your reports usually takes a few weeks of letters. Keep a folder with every report, letter and call note until it's done, and keep checking your reports every few weeks for a year.

Paying for a protection service doesn't undo the theft, but some include recovery specialists and insurance for the costs. We compare what you get for the money in is identity theft protection worth it?.

Sources: IdentityTheft.gov (FTC) · FTC, credit freezes and fraud alerts · AnnualCreditReport.com · IRS Identity Protection PIN. As of October 2026.

Questions people ask

What should I do first if someone opened a credit card in my name?

Call the card issuer's fraud department, say the account is fraudulent and ask them to close it and send you a letter confirming you're not responsible. Then report it at IdentityTheft.gov and freeze your credit at Equifax, Experian and TransUnion so no new account can be opened.

Do I need a police report for identity theft?

Usually not. The FTC Identity Theft Report you get at IdentityTheft.gov is accepted for most recovery steps, including the extended fraud alert and blocking fraudulent information. Some creditors or situations still ask for a police report; file one if they do, or if you know the thief.

Will identity theft hurt my credit score?

Only if the fraudulent accounts or debts stay on your report. Once you send your Identity Theft Report, the credit bureaus must block the fraudulent information within four business days, and the score recovers as it's removed.

Am I responsible for charges someone else made?

For credit cards, federal law caps your liability for unauthorized charges at $50, and the major networks offer zero liability. For debit cards and bank accounts, report fast: your protection depends on how quickly you tell the bank.

What should I do if my Social Security number was stolen?

Freeze your credit at all three bureaus, create your my Social Security account at ssa.gov before a thief does, request an IRS Identity Protection PIN so no one can file a tax return with your number, and check your credit reports weekly for a few months.

More guides

How much do managed IT services cost in Houston? — What Houston providers charge per user in 2026, what each tier includes, hurricane-season must-haves, and our own measurement of Houston business email.
How to freeze your credit at all six bureaus — Not just Equifax, Experian and TransUnion: Innovis, ChexSystems and NCTUE too. Free, no effect on your score, with every link and phone number.
Is identity theft protection worth it? — When paying is worth it and when free steps are enough, with Aura and LifeLock 2026 prices and what identity theft insurance really pays.
Aura vs LifeLock: prices, coverage and which to choose — Both compared with prices from their own sites: credit bureaus, stolen-funds limits, data removal, family plans and who each suits.
Ransomware recovery: what to do first and which service to call — The first hour, who to call, free decryptors, whether to pay, and how to pick a recovery service that won't quietly pay the attackers.
How to remove your personal information from the internet — Free opt-outs, California's DROP, Google's removal tool, and DeleteMe vs Incogni with 2026 prices.
California DROP: how to delete your data from every data broker at once — Step by step through California's free DROP: verify residency, build your profile, track each broker, and what DROP can't delete.
What to do after a data breach exposes your information — Steps for each type of data exposed: Social Security number, password, card, bank account, license, health and kids' information.
SOC 2 certification cost: Type 1 vs Type 2, line by line — What a first SOC 2 really costs in 2026: the CPA audit, readiness, software, pen test and your own team's time, with the ranges that hold up and how to cut them.
Vanta competitors: what buyers actually pay for each one — Drata, Secureframe, Sprinto, Thoropass and Hyperproof against Vanta, with the median prices real buyers paid and who each one fits.
Vanta pricing: what buyers actually pay — Median $20,000 a year across 375 purchases: price by company size, the add-ons and audit that cost extra, and how buyers negotiate it down.
Vanta vs Drata: real prices and which to choose — 611 real purchases compared: median price, ranges by size, frameworks, discounts, and which one fits a first SOC 2 or a scaling company.
Drata alternatives: real prices and who each one fits — Vanta, Secureframe, Sprinto, Thoropass and Hyperproof against Drata, with median prices paid and why companies switch.
Drata pricing: what companies really pay — Median $24,934 a year across 236 purchases: costs by company size, add-ons and audit fees, renewal increases and how to negotiate.
Secureframe vs Vanta: prices, plans and which to choose — Same median price, different strengths: multi-framework costs, CMMC, reviews and free trial, with real buyer data.
KnowBe4 pricing: per-user cost and what buyers really pay — List price per user by seat count turned into yearly cost, what 684 buyers really paid, add-ons, and the renewal increase to watch.
KnowBe4 alternatives: prices compared, including free ones — Huntress, Hoxhunt, Proofpoint, Microsoft's built-in training and free Gophish, with 2026 prices and who each one fits.
Cybersecurity for small business: the 10 controls that matter — The short list that stops most attacks on a small company, what each control costs per user, and the free government guides behind it.
23 NYCRR 500: the NYDFS cybersecurity regulation in plain English — Who Part 500 covers, the limited exemption, MFA and asset inventory since November 2025, the 72-hour notice and the April 15 filing.
CCPA cybersecurity audit requirements: who, what and when — Which businesses need California's annual cybersecurity audit, the 2028–2030 deadlines by revenue, and what the auditor checks.
HIPAA compliance for dental offices: a practical checklist — Risk analysis, safeguards, business associate agreements, patient access and breach notices for a dental practice, with HHS's free tools.
FTC Safeguards Rule checklist, and how the WISP fits in — The ten elements of the rule, the under-5,000-customer exemption, the 30-day breach notice, and IRS Publications 5708 and 4557 for tax preparers.