What Should You Do If You Are a Victim of Identity Theft?

The order you do things in matters almost as much as doing them. File the wrong step first, or skip the one document that everything else depends on, and you end up repeating work — or worse, missing a deadline that would have capped your losses.

Here’s the sequence that actually works, based on what each agency and law actually requires, not just a general list of “contact your bank” advice.

Step 1: Stop the Bleeding — Contact Whoever’s Being Actively Used Right Now

Before anything else, deal with whatever is actively happening. If a card is being used right now, call the issuer and freeze or cancel it immediately. If your bank account shows an unauthorized transfer, call the bank the same day — debit card and bank transfer fraud gets dramatically more expensive to you personally the longer you wait to report it, because federal liability caps under Regulation E jump from $50 to $500 to unlimited depending on how many days pass before you report it.

Credit card fraud is more forgiving — your liability is capped at $50 by federal law, and most major issuers waive that to $0 — but call it in anyway so the card gets shut down before more charges hit.

Step 2: File Your Report at IdentityTheft.gov

Do this before you do almost anything else that follows. It takes ten to fifteen minutes and produces three things you’ll need for nearly every step after this one: a personalized recovery plan, pre-filled dispute letters, and the Identity Theft Report itself.

That report isn’t just paperwork — it’s what legally forces credit bureaus to block fraudulent information within four business days, stops debt collectors from chasing you on blocked debt, and qualifies you for a seven-year extended fraud alert instead of the standard one-year version. Skipping it or doing it last means doing everything else the slow way, without the legal deadline behind it.

Print or download your report immediately after filing. You’ll be attaching it to letters, sending it to creditors, and referencing it more than once.

Step 3: Freeze Your Credit at All Three Bureaus

Contact Equifax, Experian, and TransUnion separately — placing a freeze at one triggers a notification to the other two, but the freeze itself has to be requested at each. It’s free, doesn’t affect your credit score, and blocks any new account from being opened in your name until you lift it.

While you’re there, request the extended seven-year fraud alert using your Identity Theft Report as proof. Don’t settle for the basic one-year initial alert if you already have grounds for the extended version — the seven-year window covers the fact that stolen information sometimes gets sold and reused years after the original theft.

If you’re not sure what’s already been opened in your name, check which accounts are tied to your SSN before you freeze, so you have something to compare against once your credit reports come back.

Step 4: Notify Every Financial Institution Involved

Every bank, card issuer, or lender with a fraudulent account or charge tied to your name needs a direct call, followed up in writing. Ask each one to close or freeze the affected account, issue new account numbers where relevant, and send you copies of any fraudulent applications or transaction records — you’re entitled to those under federal law once you provide your Identity Theft Report and proof of identity.

Send your dispute in writing within 60 days of the statement date if credit card charges are involved — that’s the window the Fair Credit Billing Act gives you for full protection.

Step 5: File a Police Report If Your Situation Calls for One

Your FTC report covers most situations on its own, since it’s filed with a federal law enforcement agency and carries the same legal weight in most disputes. But there are specific cases where an actual police report still matters — if you know who committed the fraud, if the thief used your name during any encounter with police, or if a particular creditor insists on one before releasing detailed records. Bring your FTC report, your ID, and whatever documentation you have when you file.

Step 6: Handle Tax-Related Fraud Separately

If someone used your SSN to file a fraudulent tax return, you’ll usually find out when your legitimate e-filed return gets rejected because a return under your number was already filed. That’s when you file IRS Form 14039, Identity Theft Affidavit — not before, since the IRS specifically asks that this form only be filed once your return has actually been rejected or the IRS has instructed you to file it.

Request an IRS Identity Protection PIN once your case is resolved, so a fraudulent return under your SSN gets automatically rejected in future years without the six-digit code.

Step 7: Handle Unemployment Benefits Fraud Separately Too

If you receive a 1099-G tax form for unemployment benefits you never claimed, or your employer gets a notice about a claim you never filed, that’s a distinct category with its own reporting path. Report it to your state’s workforce agency directly — not the IRS — and request a corrected 1099-G so you’re not taxed on income you never received. The U.S. Department of Labor keeps a directory of state-specific contacts at dol.gov/fraud.

Do not file Form 14039 for this one unless the IRS specifically tells you to, or your own tax return separately gets rejected — the two fraud types get reported to different agencies and mixing them up slows both cases down.

Step 8: Check Your Social Security Earnings Record

Someone using your SSN for work — rather than credit — won’t show up on your credit report at all. It shows up as unfamiliar income on your Social Security earnings statement. Log into ssa.gov/myaccount and review your work history. If you find income you never earned, contact the SSA’s Office of the Inspector General at 1-800-269-0271 to report it, since the SSA itself doesn’t investigate identity theft directly — it refers most cases to the FTC, but the OIG specifically handles misuse tied to benefits and employment.

Step 9: Address Medical Identity Theft If It Applies

If you’re getting bills for services you never received, or an insurance statement lists a procedure you didn’t have, contact your insurer’s fraud department and request your explanation-of-benefits history. This one carries a risk beyond the financial hit — a thief’s medical history can end up merged into your own records, which matters the next time a doctor makes a treatment decision based on what’s on file. Request a corrected medical record from the provider once the fraudulent claim is identified.

Step 10: Lock Down What Comes Next

Once the immediate fires are handled:

• Set up an E-Verify Self Lock at e-verify.gov/mye-verify if your SSN was involved, to block anyone from using it to pass a work-eligibility check
• Change passwords on every account tied to the compromised information, starting with your email — most password resets flow through it
• Keep a dedicated folder, physical or digital, with every report, letter, and confirmation number — you’ll likely need to reference these more than once as new accounts surface over the following months
• Know the difference between what actually causes SSN theft in the first place so you can identify how it happened and close that specific gap going forward

If a Child or Aging Parent Was Affected

The steps above apply to them too, but checking whether a child’s SSN is being misused requires a slightly different process, since children rarely have an existing credit file to freeze — you may need to establish one first just to lock it down. Older relatives targeted through phone or mail scams often need more hands-on help walking through these same steps, especially the credit freeze and FTC filing, which can feel unfamiliar if they’re not used to managing accounts online.

What Not to Do

Don’t wait to “see if it gets worse” before reporting — every day of delay is a day a fraudulent account has to grow or a debt collector has grounds to keep calling. Don’t pay a debt you don’t recognize just to make collection calls stop; dispute it instead once you’ve filed your Identity Theft Report, since payment can be read as an admission that the debt is legitimate. And don’t assume one report covers everything going forward — if a new fraudulent account surfaces six months from now, it needs its own updated filing and its own documentation trail.

Frequently Asked Questions

What’s the very first thing I should do?

Stop active damage first — call your bank or card issuer if something’s happening right now — then file your report at IdentityTheft.gov before anything else. That report is what makes almost every later step faster and legally enforceable.

Do I need a lawyer to recover from identity theft?

 Not for most straightforward cases. The FTC process, credit bureau disputes, and IRS forms are all designed to be handled without one. A consultation becomes worth considering if a creditor refuses to remove fraudulent information despite your Identity Theft Report, or if the fraud caused damages significant enough to justify a legal claim under the FCRA.

How long does the whole process usually take? 

A single fraudulent charge can be resolved in weeks. Tax fraud, employment-related SSN misuse, or accounts that spread across multiple institutions can take several months to fully clear, particularly if new fraudulent activity keeps surfacing as you go.

Should I report to the IRS and my state’s unemployment agency for the same incident?

 Only if both actually happened. Tax return fraud and unemployment benefits fraud are reported to different agencies and require different forms — filing Form 14039 for unemployment fraud you haven’t actually experienced on your tax return just slows the process down.

What if I don’t know how the theft happened?

 You don’t need to know in order to file your FTC report or freeze your credit — both work regardless of the cause. Once the immediate damage is contained, it’s worth reviewing the common ways SSNs get exposed so you can figure out which one applies to your situation.

Sources

• Federal Trade Commission — IdentityTheft.gov
• Fair Credit Billing Act (15 U.S.C. § 1666) and Regulation E (15 U.S.C. § 1693) — liability and dispute timelines
• Internal Revenue Service — Identity Theft and Unemployment Benefits guidance; Form 14039, Identity Theft Affidavit
• U.S. Department of Labor — dol.gov/fraud, state workforce agency directory
• Social Security Administration — Fraud Prevention and Reporting, ssa.gov/fraud

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com.