Identity Theft Recovery: The First 24 Hours, First Week and Follow-Up

What To Do First If Someone Stole Your Identity

Call the company where the fraud happened, place a fraud alert with one credit bureau, and report the theft at IdentityTheft.gov. Do these three things within the first 24 hours, in that order. The steps below come from the Federal Trade Commission’s IdentityTheft.gov recovery process and the FTC’s consumer guidance, and they separate what to do for stolen personal information from what to do for a lost or stolen payment card, since the rules are different for each.

Warning Signs You Should Not Ignore

Act the same day if you notice any of these:

• Bills or collection calls for accounts or purchases you never made
• A missing bank or credit card statement that normally arrives on schedule
• Withdrawals or charges on your account that you do not recognize
• An IRS letter about income or a tax refund tied to a job you never had
• A denial of credit, a job, or housing for reasons that do not add up
• Mail, calls, or collection notices about accounts in your child’s name

The First 24 Hours

These steps limit the damage while a thief still has your information.

1. Call the companies where fraud occurred. Ask for the fraud department, explain that someone stole your identity, and ask them to close or freeze the account. Change the logins, passwords, and PINs on that account and any account that reuses them.
2. Place a fraud alert and pull your credit reports. Contact one of the three nationwide credit bureaus — Equifax, Experian, or TransUnion. Federal law requires that bureau to notify the other two. A fraud alert is free, lasts one year, and tells lenders to verify your identity before opening new credit in your name. Then get your free credit reports at AnnualCreditReport.com or by calling 877-322-8228, and check them for accounts or charges you do not recognize.
3. Report the theft to the FTC at IdentityTheft.gov. The site walks you through your specific situation and generates a personal recovery plan along with an FTC Identity Theft Report, which many companies and agencies accept as proof of the theft. You can also report in Spanish at RobodeIdentidad.gov, or call 877-438-4338 and press 3 for other languages.

Stolen Personal Information vs. a Lost or Stolen Payment Card

These are two different problems with two different sets of protections. Do not treat a missing wallet card the same way you treat a stolen Social Security number.

Stolen Identity: Social Security Number, Taxes, Benefits or New Accounts

• What happened: someone used your personal details to open accounts, file taxes, or get benefits in your name
• Your risk: there is no fixed dollar cap, and recovery depends on documentation and follow-up
• What to do: place a fraud alert, pull your credit reports, file a report at IdentityTheft.gov, and add a police report if a company requires one

Lost or Stolen Credit Card

• What happened: the physical card or the card number is missing or was used without your permission
• Your risk: federal law caps your liability at $50 once you report it, and many issuers waive this entirely
• What to do: call the card issuer right away, then follow up in writing with your account number and the date you noticed it missing

Lost or Stolen Debit or ATM Card

• What happened: the card or PIN is missing or was used without your permission
• Your risk: $0 if you report it before it is misused, up to $500 if you report within 60 days of your statement, and unlimited liability after that
• What to do: call your bank immediately, follow up in writing, and check the account daily until the issue is resolved

The First Week: Reports, Records and Follow-Up

• File a police report if you need one. Some companies ask for a police report instead of, or in addition to, the FTC Identity Theft Report. Bring your Identity Theft Affidavit, a government-issued photo ID, and proof of your address.
• Combine your reports. Your FTC Identity Theft Affidavit plus a police report together form a full Identity Theft Report, which carries more weight with credit bureaus and creditors.
• Dispute errors in writing. Send letters to each credit bureau and to any business with a fraudulent account, and keep copies of everything you send and receive.
• Replace stolen government IDs. Report a lost or stolen Social Security card at ssa.gov and request a free replacement. Report a lost or stolen passport to the State Department at 877-487-2778.
• Check for SSN misuse. Review your Social Security earnings record at socialsecurity.gov/myaccount, and consider locking your number for employment checks at e-verify.gov/mye-verify.

Ongoing Follow-Up: Weeks and Months Later

• Keep checking your credit reports for new accounts or inquiries you do not recognize. All three bureaus offer free weekly online reports through AnnualCreditReport.com.
• Follow the specific next steps in your IdentityTheft.gov recovery plan, which may include closing new accounts or removing fraudulent charges.
• File your taxes as early as you can each year if a thief has used your Social Security number, since early filing can block a fraudulent return in your name.
• Respond promptly to any letter from the IRS, but never respond to an unexpected call, text, or email claiming to be the IRS, Social Security Administration, or a bank asking for personal information.

Scammers often use a stolen identity to set up follow-on contact, including fake delivery notices or urgent calls impersonating a family member. Our guides on package delivery text scams and AI voice clone scams targeting families cover how to spot and report those follow-up attempts.

Extra Caution: Children and Accounts You Manage for Someone Else

Children rarely have a credit report before age 18, so any report at all can be a red flag. If you suspect child identity theft, contact each credit bureau and request a manual search using your child’s Social Security number rather than checking a normal report. If you manage finances for an aging parent or another adult, watch their statements and mail as closely as your own, since thieves often target accounts that get less regular attention.

Protecting Personal Data Beyond Financial Accounts

Identity theft recovery is also a good time to review what other apps and accounts hold your personal details. See our checklist on health app privacy for what to check before sharing sensitive personal data, and our guide to verifying online sellers if the theft started with an online purchase or marketplace account.

Evidence Limits

This guide summarizes the general recovery process published by the FTC. Recovery timelines, required documents, and specific bureau or company procedures can change and can vary by state and by the type of account affected. Always follow the current instructions on IdentityTheft.gov and confirm requirements directly with your bank, credit bureau, or a state consumer protection office before you act.

Frequently Asked Questions

Do I have to file a police report for identity theft?

Not always. An FTC Identity Theft Report from IdentityTheft.gov is often enough on its own. Some companies or situations still require a separate police report, so ask before assuming you can skip it.

How long does a fraud alert last?

A standard fraud alert lasts one year and is free. You can renew it, and confirmed identity theft victims can qualify for an extended alert that lasts longer.

Is a credit freeze the same as a fraud alert?

No. A fraud alert asks lenders to verify your identity before opening credit. A credit freeze blocks access to your credit file entirely until you lift it. Both are free, and you can use them together.

What if the fraud involved my Social Security number for a job or taxes?

Review your Social Security earnings record for unfamiliar employers, respond promptly to any real IRS letter, and file your tax return as early as possible to reduce the chance of a fraudulent return being filed first.

This article is for general education only. It is not legal, financial, or tax advice. For guidance specific to your situation, contact IdentityTheft.gov, your credit bureau, your bank, or a qualified attorney.