Identity theft: what to do

Someone is shopping, posting or opening accounts in your name? That is identity theft. This plan shows you, step by step, how to stop the damage and take your name back.

Identity theft leaves you feeling powerless. You are not. Acting quickly and in the right order stops the misuse and reverses most of the damage. The order is the part that matters.

The short version

  • Secure your accounts: change passwords, turn on two-factor authentication , email first.
  • Report it at IdentityTheft.gov – the FTC report is your most useful document.
  • Freeze your credit at Equifax, Experian and TransUnion. It is free.
  • Dispute fraudulent debts in writing and do not pay them to keep the peace.
  • Check your credit reports and have false entries blocked.

How to recognize it

The misuse usually shows up through its consequences. Take these signs seriously:

  • Bills, collection letters or notices about orders and contracts you never made.
  • A loan or account turned down for no obvious reason – often a sign of damaging entries on your credit file.
  • Charges you do not recognize, or credit inquiries you did not authorize.
  • Login alerts, password changes or new devices that were not you.
  • Mail from agencies, stores or banks about matters you know nothing about.
  • Friends receiving messages in your name that you never wrote.

It often starts with leaked login details. To find out whether your data is circulating, see Check for a data breach and, for your inbox specifically, Your email is in a data breach – what now? .

Act now – the emergency plan

The first hours count
  1. Secure your email account first: new unique password plus two-factor authentication. It is the master key to every other account.
  2. Lock down the money: call your bank and card issuers, dispute charges you did not make, and ask for new card numbers.
  3. Report it at IdentityTheft.gov and save the FTC Identity Theft Report you get.
  4. Freeze your credit with all three nationwide bureaus – Equifax, Experian and TransUnion. Free, and it stops new accounts being opened.
  5. Tell the services involved: stores, payment providers, marketplaces. Have the accounts locked or secured.
  6. Preserve evidence: screenshots, emails, invoices, dates and times.

Banks, cards and payment services

Money is the usual target. Go through your financial accounts carefully:

  • Read every transaction, including small unfamiliar amounts. Thieves often test with tiny charges first.
  • Have cards replaced, not just blocked, if the number itself was exposed.
  • Check payment services such as PayPal, Klarna and Amazon: saved payment methods, shipping addresses and open orders.
  • Dispute unauthorized charges with your bank in writing, and note the date you reported them. Reporting quickly is what protects you.

Fighting fraudulent debts

Thieves order on credit and open accounts and subscriptions. Those are not your obligation:

  • Dispute in writing – by mail or email. Name the identity theft and attach your FTC Identity Theft Report.
  • Do not pay just to stop the letters. Paying can be read as accepting the debt.
  • Note every deadline and keep copies of everything you send.
  • With debt collectors, write and dispute. Once you dispute in writing, a collector has to stop and verify the debt before contacting you again.
What to write to a collector Stay factual and firm: “I am a victim of identity theft (FTC report number …). This account was not opened by me. I dispute this debt in full and request written verification.” Send it in writing and keep proof of what you sent.

Protecting your credit

If the thief opened accounts in your name, false entries can land on your credit file:

  • Get your reports from all three bureaus at AnnualCreditReport.com and read every line.
  • Have fraudulent entries blocked. With an FTC Identity Theft Report, the bureaus must block information that resulted from the theft.
  • Keep a freeze in place unless you are actively applying for credit. Lifting it takes minutes.
  • Check again after a few months, until everything is clean.

If the fraud happened online, also file a report with the FBI’s Internet Crime Complaint Center at IC3.gov. It does not resolve your case directly, but it feeds the investigations that do.

Protecting yourself long term

Common mistakes

  • Waiting out of embarrassment. Every hour counts, and none of this is your fault.
  • Paying a fraudulent bill instead of disputing it.
  • Changing one password and forgetting the email account.
  • Skipping the FTC report. Without it, blocking false credit entries gets much harder.

Related first aid: Account hacked and the emergency section .

Frequently asked questions

How do I know it is identity theft?

Typical signs are bills or collection notices you do not recognize, orders you never placed, a loan turned down for no clear reason, mail about accounts that are not yours, and login alerts or password changes you did not make.

Do I have to report identity theft?

Report it at IdentityTheft.gov. That gives you an FTC Identity Theft Report, which is the document banks, stores and credit bureaus ask for. Some creditors also want a police report, so file one if they do.

Do I have to pay a debt a thief ran up in my name?

No. You are not responsible for accounts you did not open. Dispute them in writing, say clearly that this is identity theft, and include your FTC Identity Theft Report. Do not pay just to make collection letters stop.

Topics: Identity, Emergency