What should I do first if my identity is stolen?

Start at IdentityTheft.gov, the FTC's official recovery site. It generates an Identity Theft Report, which is the legal document that unlocks your federal rights, and a step-by-step recovery plan customized to what happened. Then freeze your credit at all three bureaus and call the fraud departments of every affected company.

What is the difference between a credit freeze and a fraud alert?

A freeze blocks new creditors from accessing your credit file entirely, stopping new accounts from being opened; you must place it separately at each of the three bureaus, free. A fraud alert leaves your file accessible but requires businesses to verify your identity before extending credit; placing it with one bureau covers all three.

Am I responsible for debts an identity thief created?

Generally no. Federal law limits liability for unauthorized credit card charges to $50, and most issuers waive it entirely; fraudulent accounts you never opened are not your debts. The mechanism is disputing them with an FTC Identity Theft Report, which obligates bureaus to block the information and collectors to stop.

Do I need a police report for identity theft?

Not always. The FTC Identity Theft Report handles most disputes on its own. File a police report when you know the thief, when the thief used your name with police, when a creditor or bureau specifically demands one, or when your report supports an insurance or employer requirement.

How do I handle tax identity theft?

If a return was already filed in your name, complete IRS Form 14039 (Identity Theft Affidavit), respond to any IRS notice immediately, and file your real return on paper if e-file rejects. Then get an Identity Protection PIN, the six-digit code that prevents anyone from filing under your Social Security number without it.

Identity theft: what to do first, the exact recovery sequence, how credit freezes and fraud alerts differ, and the federal rights that make banks remove the damage

Identity theft is one of the few emergencies where the recovery process is genuinely standardized: a federal agency runs the intake, federal statutes assign the liability to someone other than you, and the paperwork sequence is the same whether the thief opened one card or built a parallel financial life. What victims lack isn't rights; it's the order of operations. Here it is, in the sequence that closes doors fastest.

What do you do in the first 24 hours?

Report the theft at IdentityTheft.gov, the Federal Trade Commission's recovery site. This is the single highest-leverage step, because it produces the FTC Identity Theft Report: the affidavit that federal law treats as proof of your victim status, and the key that unlocks the blocking and liability rights described below. The site also generates a personalized recovery plan, pre-filled dispute letters included, based on exactly what you report.

Then contain the accounts. Call the fraud department of every company where fraud occurred (card issuers, banks, lenders, phone carriers), ask them to close or freeze the compromised accounts, and follow each call with a written dispute. Change the passwords and enable two-factor authentication on every financial account, your email first, since email access is how thieves reset everything else.

Then lock your credit file, which is the next section, because it deserves precision.

Should you freeze your credit, add a fraud alert, or both?

Both, and knowing the difference tells you why. A credit freeze (security freeze) blocks lenders from pulling your credit file for new applications, which stops new fraudulent accounts cold; it's free under federal law, it doesn't affect your score or your existing cards, and you can lift it temporarily online in minutes when you apply for credit yourself. Its one operational cost: you must place it separately at each of the three bureaus, Equifax, Experian, and TransUnion.

A fraud alert is lighter: your file stays accessible, but businesses must take reasonable steps to verify identity before opening credit. One call places it at all three bureaus (the one you contact notifies the others). An initial alert lasts one year; with an FTC Identity Theft Report you qualify for the extended seven-year alert, plus two additional free credit reports per year from each bureau.

The freeze is the protection; the alert is the backstop for any creditor who somehow proceeds anyway. Place both, and pull your reports from all three bureaus at annualcreditreport.com to inventory the damage, since accounts you haven't discovered yet are the ones that grow.

How do you actually remove fraudulent accounts and debts?

This is where the FTC report converts from paperwork into power. Under the Fair Credit Reporting Act's identity-theft provisions, when you send a credit bureau your Identity Theft Report and identify the fraudulent information, the bureau must block that information from your file, generally within four business days, and notify the companies that furnished it. Blocked means it stops appearing and stops being re-reported.

For the accounts themselves, send each company's fraud department a written dispute with the FTC report attached, stating the account isn't yours. You're entitled to the records the thief created (applications, transaction histories) on request, which helps trace the scope. Liability runs in your favor throughout: unauthorized credit card charges cap at $50 by statute and are almost universally waived; debit card liability depends on how fast you report (which is why the 24-hour containment matters); and accounts a thief opened were never your contracts.

If collectors pursue the fraudulent debts, dispute in writing within 30 days of their first contact, include the FTC report, and state the debt results from identity theft; collectors who continue after that are creating their own liability. If a fraudulent debt has already produced a lawsuit against you, respond to the suit (never default) and raise identity theft as the defense; the paper trail you've built is the evidence.

When do you need a police report, and what about the special cases?

A police report becomes necessary in four situations: you know who the thief is, the thief gave your name to police during an arrest or citation (criminal identity theft, which requires clearing court records, not just credit files), a specific creditor or bureau demands a police report, or an insurer or employer requires one. Bring your FTC report, government ID, proof of address, and the fraud evidence; ask for the report number and a copy.

The special-case tracks, each with its own agency: tax identity theft (a return filed in your name, or IRS notices about income you never earned) runs through IRS Form 14039 and, going forward, an Identity Protection PIN, the six-digit code that makes your Social Security number unusable for filing without it; anyone can opt in, and it's the single best preventive tool for tax fraud. Government benefits fraud (unemployment claims in your name) goes to the state agency that paid the claim plus the FTC report. Medical identity theft warrants requesting your records from providers and disputing false entries, since a thief's medical history merged into yours creates dangers beyond money. And persistent Social Security number misuse can justify contacting the Social Security Administration, though the SSA replaces numbers only in extreme, documented cases.

Child identity theft deserves its own vigilance: a minor's clean SSN is premium raw material, and the fraud often runs undetected for years until the child applies for aid or credit. Each bureau will check for and freeze a file in a minor's name at a parent's request, and doing so at any age is free insurance.

How do you prevent the second round?

Recovered victims get re-targeted, because their data is already circulating. The durable protections: leave the credit freezes on permanently and thaw only for your own applications (this costs you minutes a year and closes the main attack surface); keep the IP PIN for every tax season; use unique passwords with a manager and two-factor authentication everywhere money or email lives; and treat unsolicited calls, texts, and "fraud department" contacts as hostile until verified through the number on your card, since the follow-up scam that harvests recovery-stressed victims is now a standard second act.

Monitor with the free tools before paying for any service: weekly free reports from all three bureaus, transaction alerts from your own banks, and your annual Social Security earnings statement (unrecognized earnings mean someone is working under your number). Paid monitoring services mostly resell alerts on data you can watch yourself; the freeze they can't place for you is the part that actually prevents anything.

The recovery arc, realistically: containment takes a day, the blocking and disputes take weeks, and stubborn furnishers or court-record cleanup can take months. But the trajectory is one-directional if you build the paper trail, because every federal right in this process keys off documentation, and you'll have it from hour one.