What to do if your identity is stolen: a step-by-step recovery plan

Finding out that someone has used your name, Social Security number or accounts is unsettling, but recovery is well mapped. IdentityTheft.gov, the federal government's one-stop resource for identity theft victims, splits it into what to do right away and what to do next. The order matters. First-day calls limit new damage, and many of your rights depend on the FTC Identity Theft Report you create next.

The first day: stop the damage and report it

1. Call the fraud department of each company where fraud happened. Ask it to close or freeze the accounts, so no one can add new charges unless you agree, and change those logins, passwords and PINs.
2. Place a free one-year fraud alert with one credit bureau: Equifax, Experian or TransUnion. IdentityTheft.gov says that bureau must tell the other two, and businesses must then verify your identity before issuing new credit in your name.
3. Get your free credit reports at AnnualCreditReport.com or 1-877-322-8228, and note every account or transaction you don't recognize.
4. Report the theft at IdentityTheft.gov or 1-877-438-4338. The FTC site turns your answers into an FTC Identity Theft Report and a personal recovery plan.

What does the FTC Identity Theft Report do for you?

IdentityTheft.gov says the report proves to businesses that someone stole your identity and guarantees you certain rights. You'll send it to block fraudulent accounts, get an extended fraud alert or dispute a debt collector's claim. If you create an account on the site, it tracks your progress and pre-fills letters for you. If you don't, print and save the report and plan right away, because you can't get back to them once you leave the page.

Do you need a police report?

IdentityTheft.gov treats it as optional, while the CFPB advises reporting the theft to both local police and IdentityTheft.gov. A police report can help later. The FTC says an extended fraud alert is open to people with an FTC report or a police report, and the Department of Labor says some state unemployment agencies may require one. If you go, IdentityTheft.gov says to bring:

• A copy of your FTC Identity Theft Report.
• A government-issued photo ID.
• Proof of your address, like a mortgage statement, rental agreement or utility bill.
• Any other proof of the theft, such as bills or IRS notices. Then ask for a copy of the police report.

Freeze your credit at all three bureaus

A credit freeze goes further than a fraud alert: while it's in place, nobody can open a new credit account in your name, including you. The FTC says it's free to place and lift and doesn't affect your credit score. A freeze isn't passed from one bureau to the others, the CFPB notes, so contact each one. It won't stop a thief from taking over accounts you already have.

• Equifax: Equifax.com/personal/credit-report-services or 800-685-1111.
• Experian: Experian.com/help or 888-EXPERIAN (888-397-3742).
• TransUnion: TransUnion.com/credit-help or 888-909-8872. TransUnion says a freeze added online or by phone typically takes effect almost immediately.
• Need credit later? The FTC suggests lifting the freeze only at the bureau your lender uses, then putting it back.

Should you add an extended fraud alert too?

Once you have an FTC Identity Theft Report, consider it. The FTC says an extended fraud alert lasts seven years, and the CFPB says a creditor must contact you before approving new credit in your name. Request it from one bureau, which the FTC says must tell the other two, and send a copy of your FTC report; TransUnion says extended alerts must be placed online or by mail, not by phone. The FTC adds that you can place a fraud alert even with a credit freeze in place.

Check your credit reports and dispute what isn't yours

Read each report line by line, because each bureau may get its information from different sources, the FTC says. Look for accounts, transactions and credit inquiries you don't recognize. When a thief doesn't pay the bills on an account opened in your name, it's reported as unpaid and delinquent. After the cleanup, keep checking: your reports are free every week at AnnualCreditReport.com.

How do you get fraudulent accounts off your credit report?

Ask each bureau to block them. Blocked information won't show up on your report, IdentityTheft.gov says, and companies can't try to collect the debt from you. With an FTC Identity Theft Report the bureaus must honor the request, and the CFPB says they must block the information within four business days after receiving your request. The CFPB adds that a bureau can refuse or remove a block if the information you give isn't correct or the debt wasn't caused by identity theft. Without one you can still dispute the entries, a right the FTC says the Fair Credit Reporting Act guarantees, but it can take longer and removal isn't guaranteed. Write to all three bureaus and include:

• A copy of your FTC Identity Theft Report.
• Proof of your identity, like your name, address and Social Security number.
• An explanation of which information on your report came from identity theft.
• A request that the bureau block that information.

Someone opened a credit card in your name. What now?

Call the fraud department of the business where the account was opened and ask it to close the account. Ask for a letter confirming that the account isn't yours, that you aren't liable for it and that it was removed from your credit report, and keep it. The business may want a copy of your FTC report or a special dispute form. IdentityTheft.gov also suggests asking for a copy of the application and the applicant's signature.

Debt collectors calling about debts you don't owe

1. Write to the debt collector within 30 days of getting the collection letter. Say that someone stole your identity and you don't owe the debt, and send copies of your FTC Identity Theft Report.
2. Tell the business where the account was opened that it isn't your debt and to stop reporting it to the credit bureaus.
3. Ask that business for details of the debt and how it happened; it must give them to you if you ask.
4. Ask the credit bureaus to block the debt from your credit report, if you haven't already.

IdentityTheft.gov lists the rights behind these steps. Once you give creditors and debt collectors a valid FTC Identity Theft Report, they may not report the fraudulent accounts to the credit bureaus. In most cases a debt collector must stop contacting you after you tell it to stop in writing. And under most state laws, you're not responsible for debts on fraudulent new accounts opened without your permission.

Tax identity theft and the IRS

Tax identity theft can surface as an IRS letter or a rejected e-filed return. If the IRS writes to you, follow its instructions; with a Taxpayer Protection Program letter, it won't process your return or issue a refund until you respond. Letters 5071C, 4883C and 5747C ask you to verify your identity and say whether you filed the return, and the IRS removes it if you didn't. Confirmed victims are issued a new six-digit Identity Protection PIN every year, and the IRS advises any victim to get one to protect their tax account. Keep filing and paying tax as usual; for specialized help, IdentityTheft.gov points to the IRS at 1-800-908-4490.

Do you need IRS Form 14039?

Usually not. Form 14039, the Identity Theft Affidavit, reports tax-related identity theft, but the IRS says most people don't need to file it. You can file it for yourself, a dependent or someone who has died. Don't file it in these cases:

• You already sent it to the IRS or filed it through IdentityTheft.gov.
• The IRS already sent you a letter or notice.
• The identity theft isn't tax-related.
• You used, or the IRS tells you to use, its Identity and Tax Return Verification Service.

File it only if the IRS tells you to, if you can't use that service, or to flag possible tax-related identity theft the IRS doesn't have on file, such as a data breach. If you can't e-file, the IRS says you can attach it to the back of a paper return. Its Identity Theft Victim Assistance organization then takes the case. Don't send duplicate forms or call about the status, because the IRS says both cause delays.

If your Social Security number was stolen

Social Security doesn't handle identity theft issues itself; it points victims to the FTC. If someone used your number to open an account or make a purchase, report it at IdentityTheft.gov. If your number was exposed but not misused, the SSA says you don't need an FTC report, though you should still check, freeze and monitor your credit. Then cover the other places a number gets misused:

• Work record: review your work history in a my Social Security account at socialsecurity.gov/myaccount, and report errors to your local SSA office.
• Jobs: an E-Verify account at e-verify.gov/mye-verify lets you lock your number, so employers that use E-Verify must get more information before someone else can use it to get a job.
• Tax forms: if you get a Form W-2 or Form 1099 from an employer you don't know, the IRS says to leave that income off your return and contact the SSA.
• Your SSA account: the SSA suggests considering an eServices block, which stops anyone, including you, from seeing or changing your information online, and a Direct Deposit Fraud Prevention block, which stops anyone, including you, from enrolling in or changing direct deposit or changing your address through my Social Security or a bank's auto-enrollment. Removing either block, or making later direct deposit or contact changes, means contacting your local office.
• Benefits: report misuse of your Social Security benefits to the SSA Office of the Inspector General at 1-800-269-0271.

Can you get a new Social Security number?

Only in limited cases. The SSA can assign one to an identity theft victim who has tried to fix the problems but is still disadvantaged by the original number, and you request it at an in-person appointment. Without evidence of misuse, you generally can't get a new number. And IdentityTheft.gov warns that it likely won't solve every problem, because companies and agencies will still link records to the old one.

Medical, benefits, unemployment and child identity theft

Medical identity theft

A thief may use your health insurance or Medicare number to see a doctor, get prescription drugs or submit claims, and the FTC warns that their health information mixed with yours could affect the care you can get. Get copies of your records from each provider and insurer the thief may have used, and look for services you didn't get. Report errors to the provider in writing with your FTC report, by a method you can track like certified mail; the FTC says it must respond within 30 days and notify other providers who may have the same mistake. IdentityTheft.gov says to send the FTC report to your insurer's fraud department too and, if you're covered by Medicare, to call 1-800-633-4227.

Unemployment and government benefits

Unemployment identity fraud often shows up as mail about a claim you never filed or a Form 1099-G for benefits you never got, the Department of Labor says. Report it to the state where it happened and follow its instructions, since some states may require a police report or a sworn affidavit. Don't wait for the corrected 1099-G the state issues: file your taxes with only the income you actually received. The IRS says Form 14039 isn't required here, unless your e-filed return is rejected because a duplicate return with your Social Security number is already on file or the IRS tells you to file one, and it suggests getting an IP PIN. If you already filed your taxes, the Department of Labor says not to file an amended return. For other government benefits, contact the agency that issued them.

Child identity theft

IdentityTheft.gov says children generally won't have credit reports unless someone is using their information for fraud, so ask each bureau for a manual search for your child's Social Security number. Each bureau has its own process. If you find fraud, IdentityTheft.gov says to tell the company that your child is a minor who can't enter into legal contracts, and ask it to close the account and confirm in writing that your child isn't liable. The FTC adds: ask each bureau to remove the fraudulent accounts, request a free credit freeze if your child is under 16, and report the theft at IdentityTheft.gov. If someone filed taxes with your child's number, IdentityTheft.gov points to IRS Form 14039, though the IRS says not to file it if it has already sent you a letter or notice, unless it tells you to.

Lock down your accounts, phone number and email

• Change the password on each affected account and anywhere you reused it, IdentityTheft.gov advises. Make it long, and change the username too if you can.
• Turn on two-factor authentication, which the FTC says makes it harder for scammers to log in even with your username and password.
• If you have an IRS Online Account, the IRS says to update its password and make it complex and unique.
• IdentityTheft.gov suggests checking your NCTUE Data Report at nctue.com for phone, pay TV or utility accounts you don't recognize.

How can you tell if a thief still has access to your email?

The FTC calls protecting your email critical, because whoever controls your inbox can request password-reset links for your other accounts and lock you out. Once you're back in, change the password, sign out of all devices and turn on two-factor authentication. Make sure the recovery email addresses and phone numbers are ones you entered. Then delete forwarding rules you didn't set up, and check your sent and deleted folders for messages the intruder sent or read.

What is a SIM swap, and what should you do?

In a SIM swap, a scammer gets your carrier to activate a new SIM card for your number on their own phone, so they receive your calls and texts, including sign-in codes, the FTC explained in a 2019 consumer alert. The signs it lists include a phone that suddenly stops working or a notice that your SIM was activated on a new device. Contact your carrier immediately to take back your number, then change your passwords and check your financial accounts. To protect yourself, the same alert suggests a PIN or password on your cellular account and an authentication app or security key instead of text codes.

Keep a paper trail

Many steps on IdentityTheft.gov end the same way: write down who you contacted and when. Keep copies of every letter you send, too. The IRS gives victims the same advice for letters, phone calls and emails. Store these together:

• Your FTC Identity Theft Report and recovery plan.
• A copy of any police report.
• Letters from businesses confirming a fraudulent account isn't yours, in case it reappears on your credit report.
• Credit bureau letters confirming your fraud alerts, and written results of any dispute.
• IRS letters and notices, and any clearance letter from police or a court if a thief used your name in a criminal case.

When an identity theft protection service helps

The core recovery steps are free: the FTC's recovery plan, fraud alerts, credit freezes and weekly credit reports. Some people still want help with the work. Companies that sell monitoring may also offer identity recovery services, the FTC says, which typically give you counselors or case managers who might help you write letters to creditors and debt collectors, place a credit freeze and work through documents. Some will deal with creditors for you if you formally grant them authority, though you might be able to do some of this on your own. After a data breach, IdentityTheft.gov suggests accepting free credit monitoring if the company offers it.

• Credit monitoring won't alert you to bank withdrawals or to a tax return filed with your Social Security number, the FTC says.
• Most identity monitoring won't alert you if someone uses your information to claim Social Security or unemployment benefits, or to get Medicare, Medicaid or welfare benefits.
• Identity theft insurance generally won't reimburse money scammers stole.
• If you're considering insurance, ask about the deductible and what isn't covered.

Call the companies, add a fraud alert and report it. Then freeze your credit and block every account that isn't yours. And write down who you spoke to, and when.