How to Recover from Identity Theft: Complete Step-by-Step Guide

You just discovered someone opened a credit card in your name. Or your bank called about suspicious transfers. Or you received a collections notice for a debt you never incurred. Whatever the trigger, you are now in crisis mode — and the next 48 hours determine how bad this gets.

Identity theft recovery is not quick. The FTC estimates an average of 200 hours of phone calls, paperwork, and follow-up spread over 6 to 12 months. But the process is navigable if you follow the right sequence. This guide covers every step from initial discovery through full resolution, with the exact forms, phone numbers, and deadlines you need at each stage.

Phase 1: The First 24 Hours (Emergency Response)

These five actions need to happen today. Not tomorrow, not next week. Every hour you delay gives the thief more time to open accounts, drain funds, and create damage that takes months to undo.

Step 1: Document What You Have Found

Before you make a single phone call, write down everything you know:

• What tipped you off (unknown account on credit report, collection notice, bank alert, IRS notice, denial of credit)
• Which accounts or transactions appear fraudulent
• Approximate dates the fraud occurred
• Any suspicious communications you received recently (phishing emails, unusual phone calls)
• Screenshots of everything — fraudulent transactions, unknown accounts on your credit report, collection letters

Start a dedicated folder (physical or digital) for your identity theft case. You will add to this folder for months. Label everything with dates.

Step 2: Freeze Your Credit at All Three Bureaus

This is the single most important action. A credit freeze blocks anyone from opening new accounts in your name.

• Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 800-685-1111
• Experian: experian.com/freeze/ or call 888-397-3742
• TransUnion: transunion.com/credit-freeze or call 888-909-8872

Also freeze at these lesser-known agencies:

• ChexSystems (bank accounts): chexsystems.com or 800-428-9623
• NCTUE (utilities and telecom): nctue.com or 866-349-5185

All freezes are free. Save your PINs and confirmation numbers in your password manager immediately.

Step 3: File Your FTC Identity Theft Report

Go to IdentityTheft.gov and complete the reporting process. This is not optional — the FTC Identity Theft Report is the legal foundation for your entire recovery. It:

• Creates an official record accepted by creditors, banks, and law enforcement
• Generates a personalized recovery plan with specific steps for your situation
• Produces pre-filled letters you can send to creditors, debt collectors, and credit bureaus
• Triggers your rights under the Fair Credit Reporting Act (FCRA) and Fair Debt Collection Practices Act (FDCPA)
• Gives you the legal right to block fraudulent information from appearing on your credit report

Save your FTC report number. You will reference it in every dispute letter, phone call, and communication for the duration of your recovery.

Step 4: File a Police Report

Call your local police department's non-emergency line and file an identity theft report. Bring:

• Your FTC Identity Theft Report
• A government-issued photo ID
• Proof of your address
• Evidence of the theft (fraudulent statements, collection notices, credit report showing unknown accounts)

Some officers may tell you they cannot do anything about identity theft. Politely insist on filing a report — many creditors and insurance companies require a police report number. Get a copy of the filed report before you leave.

Step 5: Contact Affected Financial Institutions

Call the fraud department at every institution where you have found fraudulent activity:

• Banks — request immediate account freeze and filing of a fraud claim. Ask for a new account number
• Credit card companies — report the fraudulent account. Request closure and a fraud investigation. Get a case number
• Investment accounts — report unauthorized access or transactions. Request a freeze on asset transfers
• Utility companies — if accounts were opened in your name, report them as fraudulent

For every call: record the date, time, name of the person you spoke with, their direct phone number or extension, and any case or reference number. This log is critical.

Phase 2: The First Week (Dispute and Contain)

Step 6: Pull and Review All Three Credit Reports

Go to AnnualCreditReport.com and request reports from all three bureaus. Review each report line by line for:

• Accounts you did not open
• Hard inquiries you did not authorize
• Addresses where you have never lived
• Employment history that is not yours
• Name variations you do not recognize

Mark everything that is fraudulent. You will dispute each item individually.

Step 7: Dispute Fraudulent Accounts with Credit Bureaus

For each fraudulent item on your credit report, file a dispute with each bureau where it appears:

• Equifax: equifax.com/personal/credit-report-services/credit-dispute/ or by mail to Equifax Information Services LLC, P.O. Box 740256, Atlanta, GA 30374
• Experian: experian.com/disputes/ or by mail to Experian, P.O. Box 4500, Allen, TX 75013
• TransUnion: transunion.com/credit-disputes or by mail to TransUnion LLC, Consumer Dispute Center, P.O. Box 2000, Chester, PA 19016

Include with each dispute:

• A copy of your FTC Identity Theft Report
• A copy of your police report
• A clear statement identifying each fraudulent item
• A request to block the fraudulent information under Section 605B of the FCRA

Important: Under Section 605B, when you provide an identity theft report, the credit bureau must block the fraudulent information within 4 business days. This is faster than the standard 30-day investigation for regular disputes.

Step 8: Send Dispute Letters to Creditors

For each fraudulent account, send a letter directly to the creditor's fraud department stating:

• The account was opened through identity theft and is not yours
• You are requesting immediate closure of the account and cessation of collection activities
• Include your FTC Identity Theft Report and police report numbers
• Request copies of all records the thief used to open the account (you have this right under Section 609(e) of the FCRA)

Send these letters by certified mail with return receipt requested. Keep copies of everything.

Step 9: Deal with Debt Collectors

If fraudulent debts have been sent to collections:

1. Send the collector a written dispute within 30 days of their first contact
2. Include your FTC Identity Theft Report
3. State that the debt resulted from identity theft and you are not responsible
4. Under the FDCPA, the collector must stop collection activities until they can verify the debt

Do not pay any portion of a fraudulent debt. Even a partial payment can be interpreted as acknowledgment that the debt is yours.

Step 10: Protect Against Tax Identity Theft

If your SSN was compromised:

• Apply for an IRS Identity Protection PIN at irs.gov/get-an-ip-pin — this prevents anyone from filing a tax return using your SSN
• If a fraudulent tax return has already been filed, submit IRS Form 14039 (Identity Theft Affidavit)
• Contact your state tax agency and inquire about similar protections

Phase 3: Ongoing Recovery (Months 2-12)

Step 11: Follow Up on Every Dispute

Credit bureaus have 30 days (45 days in some circumstances) to investigate regular disputes, or 4 business days for identity theft blocks under Section 605B. Track every dispute and follow up if you do not receive a resolution within the required timeframe.

If a dispute is denied:

1. Request a written explanation of the investigation results
2. Submit a more detailed dispute with additional evidence
3. File a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov/complaint
4. Consider consulting an attorney if the fraudulent items are not removed after your second dispute

Step 12: Set Up Ongoing Monitoring

• Check your credit reports monthly for at least 12 months (free weekly reports available at AnnualCreditReport.com)
• Set up a free credit monitoring service (Credit Karma covers Equifax and TransUnion, Experian offers free single-bureau monitoring)
• Consider a paid identity theft protection service if your case was severe (they provide dark web monitoring, restoration support, and insurance)
• Monitor all financial account statements monthly
• Review your Social Security Statement annually at ssa.gov for fraudulent employment

Recovery Steps for Specific Types of Identity Theft

Medical Identity Theft

Someone used your insurance to receive medical care. This is particularly dangerous because it can corrupt your medical records with incorrect blood types, allergies, medications, and diagnoses.

1. Contact your health insurance provider's fraud department
2. Request an "accounting of disclosures" under HIPAA — this shows everyone who has accessed your medical records
3. Request copies of all medical records associated with the fraudulent care
4. Send a written dispute to each healthcare provider that treated the thief, asking them to correct or segregate the fraudulent records
5. Follow up to confirm your medical records have been corrected — incorrect medical data can be life-threatening in an emergency

Criminal Identity Theft

Someone gave your name and information during a traffic stop, arrest, or other law enforcement encounter, creating a criminal record under your name.

1. Contact the arresting agency and provide proof of your identity versus the impersonator's identity
2. Work with the local district attorney's office to have charges dismissed or records corrected
3. Obtain a court order (sometimes called an "Identity Theft Passport" or "Certificate of Identity Theft") clearing your name
4. Submit the court order to the FBI to correct NCIC (National Crime Information Center) records
5. Check state-specific resources — many states have identity theft passport programs

Child Identity Theft

Children's SSNs are prime targets because the fraud can go undetected for years until the child applies for student loans, a first credit card, or a job.

1. Check if your child has a credit report at all three bureaus (children should not have credit files unless fraud has occurred)
2. If a file exists, follow the standard dispute and freeze process
3. File an FTC Identity Theft Report specifically noting the victim is a minor
4. Contact the SSA to determine if someone is using your child's SSN for employment (this can be detected through income reports on the SSN)
5. Freeze the child's credit at all three bureaus to prevent future fraud

Your Legal Rights as an Identity Theft Victim

Federal law provides significant protections:

• FCRA Section 605B — credit bureaus must block fraudulent information within 4 business days when you provide an identity theft report
• FCRA Section 609(e) — you have the right to obtain copies of all records a thief used to open fraudulent accounts
• FDCPA — debt collectors must cease collection on debts you have reported as fraudulent with supporting documentation
• Electronic Fund Transfer Act — limits your liability for unauthorized electronic transfers to 50 dollars if reported within 2 business days, 500 dollars within 60 days
• Truth in Lending Act — limits your liability for unauthorized credit card charges to 50 dollars (and most issuers offer zero liability)
• State laws — many states offer additional protections including identity theft passport programs, extended fraud alert periods, and civil remedies

Preventing Future Identity Theft

Once you have been victimized, your risk of repeat identity theft is significantly higher because your stolen data continues to circulate. Permanent defensive measures:

• Keep credit frozen at all five agencies permanently — only lift temporarily when you need to apply for credit
• Use unique passwords for every account with a password manager
• Enable two-factor authentication everywhere (hardware keys or authenticator apps, not SMS)
• Opt out of data broker sites — use a service like DeleteMe or manually request removal from major brokers
• Switch to an IRS Identity Protection PIN (renew annually at irs.gov)
• Monitor your credit reports quarterly even after your case is resolved
• Consider a paid identity theft protection service that includes real-time monitoring and restoration support

The Bottom Line

Identity theft recovery is a marathon, not a sprint. But the first 48 hours are a sprint within that marathon — the actions you take immediately determine whether recovery takes weeks or years. Freeze your credit, file your FTC report, and start documenting everything today. The rest of the process is methodical paperwork and persistent follow-up, and it does end. Your credit score will recover, fraudulent accounts will be removed, and your identity will be yours again.