How To Recover From Identity Theft: Step-by-Step Guide

What Should You Do If You’re the Victim of Identity Theft?

As soon as you think your identity has been stolen, you should immediately freeze your credit , file an official report of the crime, and secure your online accounts. These first steps are crucial — as once scammers have access to your accounts, they will misuse them to the fullest extent.

Nearly 1 in 4 identity theft victims reported multiple identity-related crimes — an increase of 60% year-over-year.

The identity theft recovery process can be long and frustrating. Follow these steps to quickly secure your identity and limit the damage that identity thieves can do.

What To Do If Your Identity Is Stolen

The identity theft recovery process is made up of three critical phases:

1. Restriction: Limiting the damage done and securing your most vulnerable accounts. 
2. Reporting: Filing official reports with impacted companies, the police, and relevant government agencies. 
3. Recovery and protection: Disputing fraudulent activity, repairing your credit, and securing yourself against future fraud.

Here are the specific steps you need to take in order of importance.

Note: Don’t forget to look after yourself. Identity theft can take an emotional toll on anyone. If you’re feeling overwhelmed or distraught, the Office for Victims of Crime (OVC) has a list of online resources that can help.

1. Place a credit freeze and an initial fraud alert on your credit files

Identity thieves often use stolen information to open accounts or take out new credit loans in their victims’ names.

No matter which warning sign of identity theft you see, your first step should be to protect your credit.

A fraud alert is an easy first step. Contact one of the three major credit reporting agencies (Experian, Equifax, and TransUnion), and ask for an initial fraud alert. This requires lenders to verify your identity before opening new credit accounts. By law, the bureau you contact is required to forward your request to the other two.

An initial fraud alert lasts for one year and will not impact your credit score.

For more protection, you should ask for a credit freeze. A freeze prevents anyone from accessing your credit files until you lift it. Some lenders may not respect a fraud alert — but a credit freeze will block them from accessing your credit report. 

To request a credit freeze, you need to contact each of the three major credit bureaus individually:

Each bureau will supply you with a PIN that you can use to “thaw” your credit file later. Credit freezes last until you lift them and won’t impact your credit score.

2. Contact any affected financial institutions

Even if your financial information hasn’t been compromised, it’s a good idea to contact your bank and credit card issuer to alert them of the fraud. Use the phone number on the back of your debit card or credit card and ask to speak to the fraud department.

If your credit card was stolen or lost, here's how to contact most major U.S. credit card companies:

• Visa: 1-800-847-2911
• Mastercard: 1-800-627-8372 (1-800-MASTERCARD)
• Chase: 1-800-432-3117
• Capital One: 1-800-227-4825 (1-800-CAPITAL)
• Citibank: 1-800-950-5114
• Bank of America: 1-800-732-9194
• Discover: 1-800-347-2683 (1-800-DISCOVER)
• American Express: 1-800-528-4800

📚 Related: How To Protect Your Bank Account From Identity Theft →

3. Secure your online accounts and phone number

Next, you’ll want to lock down your vulnerable online accounts and secure your phone number.

• Change all critical passwords immediately. Start with your online banking, email, and social media accounts. Make sure each uses a strong, unique, and complex password. If you haven’t already, store these passwords in a secure password manager which provides easier access (and warnings if your credentials are leaked in a data breach).
• Enable two-factor authentication (2FA). Every sensitive account should have 2FA enabled — ideally with an authenticator app such as Authy or Google Authenticator. Unlike SMS-based 2FA, authenticator apps aren’t susceptible to SIM swap scams. 
• Review and revoke unfamiliar app permissions. Check app permissions on your phone for unfamiliar apps (which could be malware installed by hackers). You can also check the logged in sessions on online accounts to see if unfamiliar devices have access to your accounts.
• Scan your devices for malware. Use reputable antivirus to check for malware. This only applies to Android mobile devices and Windows and Mac desktop computers — iPhones don’t allow third-party virus scanners.
• Set up a SIM PIN with your mobile phone carrier. Prevent scammers from taking over your phone number by calling your carrier and asking for a secure SIM PIN or “port-out freeze.”

4. Report identity theft to the FTC

If your personal information has been used by an identity thief, you need to file an official report with the Federal Trade Commission (FTC). An FTC report, along with a police report, are required to dispute fraudulent accounts under the Fair Credit Reporting Act (FCRA).

You can file an FTC ID theft report online at IdentityTheft.gov or by calling 1-877-438-4338.

5. File a report with your local law enforcement

Contact your local police department and ask to file an identity theft report. They may ask for your FTC report and other additional information about the crime.

If an identity thief uses your personal information during a police stop (criminal identity theft), you must contact your local law enforcement agency and the department in the municipality where the crime was committed. 

A police report isn’t just a formality. By attaching your FTC Identity Theft Affidavit to your police report, you can create an official Identity Theft Report. This will help clear your name and dispute fraudulent charges with impacted vendors and financial lenders.

Pro tip: Consider an extended fraud alert. Once you’ve created an Identity Theft Report, you can apply for an extended fraud alert that will last for seven years. The bureaus must also remove your name from marketing lists (that send prescreened credit offers) for five years.

6. Take stock of the damage and organize your documentation

Dealing with identity theft is an exhausting process that can require months of effort — entailing numerous phone calls to banks and credit unions, preparing and sending dispute letters, and trying to recover lost funds. 

As you go through the next steps, follow these guidelines for documenting your efforts:

7. Dispute fraudulent accounts and charges

Review your bank statements, credit reports, and mail for signs of fraudulent accounts and charges.

• Bank accounts. Look for suspicious activity or unfamiliar transactions. Contact each vendor directly and ask for more information about the transaction. You can dispute fraudulent charges with your bank or credit card company.
• Credit reports. Request free credit reports from all three bureaus online by visiting AnnualCreditReport.com and review them for unauthorized changes, new accounts, or unfamiliar hard inquiries. Use this free credit dispute letter template to block the fraudulent information from appearing in your credit files.
• Debt collectors. If debt collectors are harassing you about fraudulent debts, lodge a request with the debt collection agency to send you all information related to debts in your name. You can then provide your Identity Theft Report to prove you’re a victim of identity theft. 
• Unfamiliar accounts. If you receive mail or notifications about unfamiliar new accounts (at companies, banks, payday loan issuers, utilities, or cell phone providers), contact the company directly to dispute and close the account.

8. Notify any impacted government agencies

If identity thieves use your stolen personal information with a government agency, you’ll need to take special steps to dispute the fraud — for example, if scammers file taxes in your name or gain employment by using your Social Security number (SSN).

• Tax identity theft. If a thief has used your SSN to get a job or file a fraudulent tax return, report the fraud to the IRS immediately at 1‑800‑908‑4490 or visit www.irs.gov/identitytheft. 
• Medical identity theft. If someone uses your health insurance information, contact each impacted healthcare provider and request an “accounting of disclosures.” If the provider refuses to provide your records within 30 days of your request, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
• Social Security fraud. If impersonators use your details for employment identity theft, visit your local Social Security Administration (SSA) office or call 1-800-772-1213 to correct your earnings record. For government benefits fraud, report any false claims to the relevant state unemployment agency.
• Student loan fraud. If a thief takes out a student loan in your name, contact the school or program involved and ask them to terminate the loan. You can also contact the U.S. Department of Education by using the online OIG Hotline or by calling 1-800-647-8733.

9. Set up bank account and identity monitoring

Identity theft is rarely an isolated event. Once your personal information is out there, and scammers know they can use it, you’ll likely be continually targeted.

Stay vigilant by setting up monitoring for your bank account, passwords, and other sensitive information. Most banks include some form of security monitoring, but you can get additional protection by signing up for an identity theft protection solution like Aura.

Aura monitors over 140 pieces of your personally identifiable information (PII) as well as your credit files, bank accounts, and more. Plus, every account comes with digital security tools to proactively protect you and your family against hackers and scammers, 24/7 U.S-based support, and up to $5 million in identity theft insurance.

How To Protect Yourself Against Identity Theft

While there’s no way to completely prevent all identity theft, you can take measures to make yourself a less vulnerable target: 

• Monitor your credit reports. You can obtain free weekly credit reports online at AnnualCreditReport.com. Or, sign up for a three-bureau credit monitoring solution for 24/7 monitoring and alerts.
• Reduce your digital footprint. Request that Google remove your personal information from search results, and use a data broker opt-out service to prevent scammers from researching you. It’s also a good idea to update your social media privacy settings. 
• Secure your online accounts and data. Along with the best practices cited above for password hygiene and 2FA, use services like a virtual private network (VPN) to hide your browsing history, especially on public Wi-Fi networks. Never click on suspicious links in emails or texts.
• Protect your sensitive documents. Store your passport, birth certificate, and Social Security card in a locked safe. Shred mail and documents that contain your banking and personal information.‍
• Consider an identity theft protection provider. Protecting yourself and your loved ones from identity theft can feel like a full-time job. Aura does the work for you with 24/7 identity monitoring, the industry’s fastest fraud alerts³, round-the-clock U.S.-based support, and up to $5 million in identity theft insurance.