The Complete Guide to Recovering From Identity Theft Step by Step

You open your credit card statement and see a $1,200 charge at a store you've never visited. Or maybe a debt collector calls about a loan you never took out. Your stomach drops. You've been hit by identity theft.

Here's the truth: panic doesn't help, but a systematic plan does. Recovery is a process, not a magic fix. This guide walks you through exactly what to do, in order, without fluff.

Phase 1: Stop the Bleeding (First 24 Hours)

Step 1: Lock Down Your Financial Accounts

Start with the obvious: any account that's been compromised gets frozen. Call your bank, credit card issuers, and any other financial institution where you spotted fraud. Request new cards and account numbers. Most banks have a 24/7 fraud hotline—use it.

Step 2: Place a Fraud Alert

Contact one of the three major credit bureaus—Equifax, Experian, or TransUnion—and tell them you're a victim. By law, they must notify the other two. A fraud alert lasts 90 days but can be renewed. It forces businesses to verify your identity before opening new credit in your name.

Pro tip: This is free. Anyone charging you to place a fraud alert is scamming you.

Step 3: Freeze Your Credit

A fraud alert is a speed bump. A credit freeze is a concrete wall. It prevents anyone—including you, for the moment—from opening new accounts in your name. You must contact each bureau individually:

• Equifax
• Experian
• TransUnion

It's free and can be lifted temporarily when you legitimately need new credit. Write down the PINs or passwords each bureau gives you—you'll need them later.

Step 4: Change Passwords—Everywhere

Don't just change the compromised account. Change passwords for email, banking, social media, and any site that stores payment info. Use a password manager (Bitwarden, 1Password, KeePass) so you don't reuse weak passwords.

Enable two-factor authentication on everything that offers it. Text-based 2FA is better than nothing, but app-based (Google Authenticator, Authy) or hardware keys (YubiKey) are stronger.

Phase 2: Document Everything (Days 1–3)

Step 5: File an Identity Theft Report with the FTC

Go to IdentityTheft.gov and fill out the form. This creates an official FTC Identity Theft Report. It's a legally binding document that proves you're a victim and helps when disputing fraudulent accounts. Print it, save a PDF, and keep multiple physical copies.

Step 6: File a Police Report

Not all cases require this, but many creditors and debt collectors demand it. Take the FTC report to your local police station. Ask for a copy of the police report (case number at minimum). Some police departments resist filing these; politely insist, as the FTC report gives them legal grounds to accept it.

Step 7: Create a Recovery Log

Buy a notebook or open a spreadsheet. Record every call you make: date, time, company name, representative's name, what you discussed, and the outcome. This log is your weapon against he-said-she-said disputes later.

Phase 3: Clean Up the Damage (Weeks 1–12)

Step 8: Dispute Fraudulent Accounts

Get your free credit reports from AnnualCreditReport.com. (You're entitled to one free report from each bureau every 12 months. Since you're a victim, you can request more frequent reports.)

Mark every account that isn't yours. Contact each bureau in writing, include copies of your FTC report and police report, and explain which accounts are fraudulent. By law, they must investigate within 30 days. Keep copies of every letter you send.

Step 9: Deal with Debt Collectors

If a collector contacts you about fraudulent debt, do not pay a cent. Don't even acknowledge the debt as yours. Instead:

1. Request validation in writing within 30 days (you have this right under the Fair Debt Collection Practices Act).
2. Send them copies of your FTC and police reports.
3. Inform them they're collecting on a fraudulent account.

Keep copies of all correspondence. If they continue calling, file a complaint with the Consumer Financial Protection Bureau (CFPB).

Step 10: Monitor Like a Hawk

For the next year, check your credit reports every 3–4 months. You're allowed additional free reports as a fraud victim. Sign up for a credit monitoring service (many offer free tiers after identity theft). Watch for:

• New accounts you didn't open
• Hard inquiries you didn't authorize
• Address changes you didn't make

Some services like Credit Karma or IdentityForce offer additional alerts, but they're not necessary if you're diligent about checking reports yourself.

Phase 4: Strengthen Your Defenses (Ongoing)

Step 11: Secure Your Digital Life

Identity theft often starts with a data breach. Check Have I Been Pwned to see if your email has been compromised. If it has, that password is now public—change it everywhere it was used.

Consider using a separate email address exclusively for financial accounts. Enable login alerts so you get notified of unrecognized logins instantly.

Step 12: Shred and Secure Physical Documents

Bank statements, medical records, tax returns—anything with personal information should be shredded before disposal. Buy a cross-cut shredder, not the strip-cut kind, which can be reassembled.

For documents you need to keep, use a fireproof safe or a locked filing cabinet. Never leave mail with account numbers in your mailbox overnight.

Step 13: Know Your Rights

The Fair Credit Reporting Act gives you the right to dispute errors. The Fair Debt Collection Practices Act restricts how collectors can contact you. The Identity Theft and Assumption Deterrence Act makes identity theft a federal crime. You're not a powerless victim—you have legal tools. Use them.

When to Get Professional Help

If the fraud is complex—involving tax returns, medical identity theft, or stolen government benefits—consider hiring a certified identity theft remediation specialist. The Identity Theft Resource Center (ITRC) offers free assistance for complex cases. Don't pay for help before exhausting free resources.

Final Reality Check

Recovery takes time: 6 months for simple cases, 1–2 years for complicated ones. You won't forget it happened, but you can make it a footnote in your financial history rather than a permanent scar.

Stay methodical. Log everything. Follow the steps. Identity theft is a crime, not a life sentence.