Identity Theft: What to Do First, Step by Step

A letter shows up for a credit card you never opened. Your bank app lists a withdrawal you did not make. Or a tax return gets rejected because someone already filed one with your Social Security number. If identity theft just happened to you, here is what to do first: lock down your credit, report it to the FTC, then clean up account by account. This checklist walks through those steps in order, using guidance from the Federal Trade Commission, the IRS and the Social Security Administration.

Red flags that someone is using your identity

The FTC lists several signs worth taking seriously. Any one of them deserves a closer look:

• Charges on a card or bill for things you did not buy
• Bank withdrawals you did not make
• Accounts on your credit report that you do not recognize
• Bills that suddenly stop arriving, which can mean someone changed your billing address
• A tax return rejected because one was already filed under your SSN
• A W-2 or 1099 from an employer you never worked for, or an IRS notice about income you did not earn

If you only have a hunch, start by pulling your credit reports. They are free at AnnualCreditReport.com, and the three bureaus now offer free reports weekly. You can also call 1-877-322-8228.

Step 1: Freeze your credit with all three bureaus

A credit freeze stops new lenders from pulling your report, which blocks most attempts to open new accounts in your name. It is free and lasts until you lift it. The catch is that you have to place it separately with each bureau:

1. Equifax: equifax.com or 1-800-685-1111
2. Experian: experian.com/help or 1-888-397-3742
3. TransUnion: transunion.com/credit-help or 1-888-909-8872

Save the login or PIN each bureau gives you. You will need it to lift the freeze later when you apply for a loan or a new card.

Step 2: Add a fraud alert

A fraud alert tells lenders to verify your identity before approving credit. Unlike a freeze, you only contact one bureau, and it must notify the other two. According to the FTC's guide to credit freezes and fraud alerts:

• An initial fraud alert is free and lasts one year, and you can renew it.
• An extended fraud alert lasts seven years, but you need an FTC identity theft report or a police report to get one. It also takes you off prescreened credit offer lists for five years.

Freezes and alerts work fine together. Many victims use both.

Step 3: Report it at IdentityTheft.gov

Go to IdentityTheft.gov, the FTC's official reporting site (the Spanish version is RobodeIdentidad.gov). You answer questions about what happened, and the site produces an FTC Identity Theft Report plus a free personal recovery plan built around your situation. For help in other languages, call 877-438-4338 and press 3. Interpreters are available from 9 a.m. to 5 p.m. Eastern.

That report matters. It is the document you will show to banks, lenders and the credit bureaus when you dispute fraudulent accounts, and it qualifies you for the extended fraud alert. Some people also file a police report, which a creditor may ask for. If a scammer contacted you directly, you can also send details to the FTC through our guide on how to report a scam.

Step 4: Close or dispute the fraudulent accounts

Work through your credit reports line by line. For every account or charge you did not authorize:

1. Call the company's fraud department, not the general customer service line.
2. Tell them the account was opened or used without your permission and ask them to close or freeze it.
3. Ask for written confirmation that you are not responsible for the debt.
4. Dispute the entry with each bureau that lists it, attaching your FTC report.

Keep a simple log with the date, the company, who you spoke with and what they agreed to. Recovery often takes weeks, and that log saves a lot of repeated explaining.

Step 5: Secure the accounts you already have

If a thief has your personal details, your email, bank and phone carrier accounts are likely next. Change passwords on those first, using a different password for each one. Turn on two step verification wherever it is offered. Our walkthrough on how to protect your online accounts covers this in about ten minutes, and if juggling unique passwords sounds painful, read whether you need a password manager.

Step 6: Protect your tax return with an IRS IP PIN

Tax identity theft is common because a fake return can produce a real refund. The IRS offers an Identity Protection PIN, a six digit number that stops anyone else from filing a federal return with your SSN or ITIN. Anyone with an SSN or ITIN who can verify their identity can get one, and parents can request one for dependents.

The fastest route is your IRS Online Account, under the IP PIN section of your profile. A new PIN is issued every calendar year, and online users retrieve it themselves each year. If you cannot verify online, you can file Form 15227 (with income limits) or book an appointment at a Taxpayer Assistance Center. Details are on the IRS IP PIN page.

The IRS says most people do not need Form 14039, the Identity Theft Affidavit. Skip it if you already reported through IdentityTheft.gov or if the IRS sent you a letter with instructions. If you did get a letter asking you to verify your identity, follow that letter and use the IRS Identity and Tax Return Verification Service. Also check with your state tax agency, since states run separate systems.

One more warning from the IRS: it never asks for your IP PIN. A call, email or text requesting it is a scam.

Step 7: Lock your Social Security record online

The Social Security Administration lets you add an eServices block, which stops anyone from viewing or changing your information online, and a Direct Deposit Fraud Prevention block, which stops online changes to your direct deposit or address. Removing either block requires contacting your local SSA office. Fraud involving Social Security benefits can be reported to the SSA Office of the Inspector General at oig.ssa.gov or 1-800-269-0271.

If it happened to your child

Kids are attractive targets because nobody checks their credit for years. The FTC notes that parents can request a free credit freeze for a child under 16. Each bureau has its own process for minors, so you will need to contact Equifax, Experian and TransUnion separately, usually with proof of your identity and your child's.

A quick checklist to keep

• Pull all three credit reports
• Freeze credit at Equifax, Experian and TransUnion
• Place a fraud alert with one bureau
• File at IdentityTheft.gov and save the report
• Call fraud departments and dispute bad entries
• Change passwords and turn on two step verification
• Get an IRS IP PIN
• Consider SSA online blocks

After the urgent work is done, set a reminder to check your credit reports every few months for the next year. Thieves sometimes sit on stolen data and try again later, and a freeze plus a quick routine check is the cheapest protection you will find. For more security guides, browse our tech section.