Identity theft: what to do first, and how to lock your credit

What identity theft really is

Identity theft is when someone uses your personal details, such as your name, date of birth, address or government ID number, to get money, credit or services in your name. It usually shows up as accounts you never opened, a loan or credit card you did not apply for, bills or debt collectors you do not recognise, a tax return already filed in your name, or a bank account emptied.

The details usually come from data breaches, phishing, mail theft or scams in which you are talked into handing them over. Our guide to how data breaches actually happen explains why your information is almost certainly already out there somewhere, and why prevention matters as much as recovery.

Do these first

1. Place a fraud alert. Contact any one of the three US credit bureaus (Equifax, Experian or TransUnion). That bureau must tell the other two. A standard fraud alert is free and lasts one year. If you have been a victim of identity theft, you can ask for an extended alert, which lasts seven years. A fraud alert tells lenders to verify your identity before opening new credit.
2. Consider a credit freeze. A freeze blocks most people from viewing your credit file, which makes it much harder for a thief to open new accounts. You must contact all three bureaus separately. It is free to place and free to lift. Online or phone requests take effect within one business day, and lifting a freeze takes effect within an hour. You can lift it temporarily whenever you need to apply for credit yourself.
3. Report it at IdentityTheft.gov. This is the US federal government’s official site. It asks about what happened and creates a personal recovery plan, with pre-filled letters and a checklist. Filing there does not start a criminal investigation, but it gives you a report that helps prove the theft to banks and creditors.
4. Secure your accounts. Change passwords on email, banking and anything linked to the stolen details, starting with your email account. Turn on two-factor authentication everywhere.

Then work through the damage

1. Order your free credit reports from all three bureaus and read them line by line. Look for accounts, addresses or inquiries you do not recognise.
2. Contact each affected company (bank, card issuer, lender, utility) using a number from their official website or a statement. Tell them it is identity theft, ask for their fraud department, and ask what they need from you.
3. Dispute the fraudulent items with the company and with the credit bureaus, in writing, and keep copies. Close accounts that were opened without your knowledge.
4. File a police report if a creditor or bank asks for one. A police report together with your IdentityTheft.gov report helps back up your case. Ask for a copy.
5. Check other areas. If your tax details may have been used, contact the tax agency in your country. In the US that means the IRS, and the Social Security Administration if your Social Security number has been misused.
6. Follow up. Check your reports again after about 30 days, and keep checking over the next year. Keep a simple log of dates, names and reference numbers for every call.

If you are not sure where to start, our first 24 hours checklist covers the immediate steps after any scam, including money you sent.

Fraud alert or credit freeze: which one?

They do different jobs. You can use both.

• Fraud alert. Free. One year as standard, seven years if you are a victim of identity theft. You only have to contact one bureau. Lenders are told to verify your identity, but a determined thief may still get through.
• Credit freeze. Free. Stays in place until you lift it. You must contact all three bureaus. It blocks most new-credit checks, which is why it is the stronger protection, and it does not affect your existing accounts or your credit score.
• Credit “locks”. Some companies sell these as an app feature, sometimes with a monthly fee. The FTC recommends a freeze if you want the no-cost option.

Since September 2018, US federal law has made freezes free for everyone, and parents can freeze the credit file of a child under 16 for free. A child’s clean file is worth protecting, because misuse often goes unnoticed for years.

If you do not live in the United States

The names and rules are different, but the plan is the same. The credit-reporting bodies in your country are the equivalent of the three US bureaus, and many offer a way to place an alert, ban or block on your file. Because the details vary and change, ask the bodies directly what they offer and whether it is free.

1. Report the theft to the police or national fraud agency. Find the right one for your country on our Report a Scam page.
2. Contact your bank and any affected company using official contact details.
3. Ask the credit-reporting bodies in your country about alerts, freezes or similar protection.
4. Look for a national identity-support service where you live. Several countries run free ones.

What thieves do with your details

Knowing what to look for makes it easier to catch early. Stolen identity details are used to:

• Open credit cards, loans, store accounts or mobile phone plans in your name.
• Take over existing bank or card accounts by passing the checks you would normally pass.
• File a fake tax return and claim the refund before you do.
• Claim government or health benefits, or use your health insurance.
• Rent a home, set up utilities or apply for a job using your details.
• Sell your details on to other criminals, who then use them in many of the ways above.

Not all of these are obvious at once. A credit card opened in your name might not trigger a bill for a month. That is why a freeze, which blocks the account being opened in the first place, is so valuable.

Early warning signs

• Letters, calls or emails about accounts, debts or applications you do not recognise.
• A refused loan or application when your finances look fine.
• Missing mail, or mail you did not expect, such as new cards.
• Bank or card transactions you did not make.
• A message from the tax agency saying a return has been filed that you did not file.
• Notifications that your details appeared in a breach. These do not mean theft has happened, but they are a good reason to freeze and change passwords.

Check your credit reports at least once a year. In the US, the three bureaus offer free reports, and checking them is one of the best habits you can build.

Keep a simple log

Recovery involves many phone calls and letters, often over weeks. A log saves you from repeating yourself and gives you evidence if a dispute drags on. Record, for each contact:

• The date and time, and who you spoke to.
• The company, department and phone number or web address you used.
• What was said, what was promised, and a reference number if you were given one.
• Copies of every letter, email, report and form you sent or received.

Send disputes in writing where you can, and keep proof of when you sent them. Be patient, but do not drop it. Following up after a month is part of the process.

Stopping it happening again

• Freeze your credit now, even if you are not a victim. It costs nothing and you can lift it whenever you apply for credit.
• Use a different password for every account. A password manager makes that realistic, and our breach checker tells you whether a password has leaked.
• Watch for scam messages that quote real details from a breach. The data in them is real, but the message is not.
• Shred or tear up paperwork with account numbers, and think twice before you hand out your government ID number.
• Protect your phone number against SIM swap scams, which are a common way in.

Sources

• FTC: Free credit freezes are hereAccessed October 12, 2026
• FTC: Credit freezes and fraud alertsAccessed October 12, 2026
• FINRA Foundation: Identity theft victim recovery checklistAccessed October 12, 2026

Published October 12, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.