Identity Theft Recovery Steps: Where to Start

If you discover identity theft — someone using your personal information, such as your name, Social Security number, or account details, to open accounts or make charges — getting started means three things: contact the companies where the fraud happened, protect your credit with a fraud alert or a credit freeze, and start a written record of everything you do. There is no single phone call that fixes it, and no honest guide can promise you a timeline. But the first steps are clear, they are the same for almost everyone, and taking them calmly, in order, puts you in the strongest position available.

Key Takeaways

Act on what you can prove: gather the statements, letters, or alerts that show what happened before you start calling.
Contact each company where fraud occurred, ask for its fraud department, and request that fraudulent accounts or charges be closed or removed.
A fraud alert tells lenders to take extra care checking identity; a credit freeze restricts access to your credit report more strongly. Both are general tools described by the CFPB.
Change the passwords on your important accounts — especially email and banking — and turn on two-step sign-in, in case your information is still circulating.
Keep a simple log of every call, letter, and promise. Dates, names, and what was agreed are worth more than you expect later.
Recovery is a process measured in persistence, not a single form. Official plain-language guidance is available from the CFPB, the FDIC, SSA.gov, and USA.gov.

In This Guide

How Most People Find Out
Step 1: Gather What You Know
Step 2: Contact the Companies Involved
Step 3: Protect Your Credit
Step 4: Secure Your Own Accounts
Step 5: Keep Records Like It Matters — Because It Does
The First Moves at a Glance
A Worked Example: One Couple’s First Week After a Discovery
Frequently Asked Questions
Your Next Step
Related Articles

How Most People Find Out

Identity theft rarely announces itself with a siren. More often it arrives as something small and odd: a charge you do not recognise, a letter about an account you never opened, a bill from a company you have never used, or a notice that a tax return was filed in your name. Sometimes a bank’s own alert system flags it first. Whatever the signal, treat it seriously without treating it as a catastrophe. You do not need to solve the whole problem today. You need to start the right process, and the first steps below are how that process generally begins.

One reassurance worth hearing early: discovering a problem is not a personal failure. Personal information circulates through data breaches and scams that have nothing to do with how careful you were. The same habits that help you avoid trouble in the first place — covered in our guide to spotting financial scams and shaky online money advice — now support the recovery, but blame plays no useful part in it.

Step 1: Gather What You Know

Before calling anyone, put the evidence in one pile: the statement with the strange charge, the letter about the unknown account, screenshots or notes of anything you found online. Write down what you know and when you noticed it. This is not bureaucracy — it is how you stay consistent across many conversations, and how a company can find the right records quickly.

Also check the obvious places for the extent of the problem, as far as you reasonably can: your bank and card accounts for other unfamiliar activity, and your credit reports, which you are entitled to review, to see whether accounts appear that are not yours. You are looking for a map of what happened, not proof of who did it. Finding out who did it is generally a job for the companies and, where appropriate, law enforcement — not for you.

Step 2: Contact the Companies Involved

For each account or charge that is not yours, contact the company directly — using the phone number on your statement, your card, or the company’s official website, never a number from a suspicious message itself. Ask for the fraud department. Explain that you believe your identity was used without your permission, and ask the company to close or freeze the affected account and remove charges that are not yours. Companies have their own procedures for this, and the first call usually opens a case rather than finishing one.

Ask three questions on every call: What happens next? What will you send me in writing? And what is the case or reference number? Then write the answers in your log. If a company asks you for a written dispute or supporting documents, send copies — never your only originals — and keep a note of what you sent and when. If a debt collector later contacts you about a fraudulent debt, you can tell them the debt is not yours and ask for information about it in writing; the CFPB publishes plain-language guidance on your rights in that situation.

Step 3: Protect Your Credit

While you deal with what already happened, protect against what could happen next. Two widely used tools work at the level of the credit bureaus — the companies that compile credit reports:

Fraud alert. You ask a credit bureau to place an alert on your report, which tells businesses to take extra steps to verify identity before opening new credit in your name. Contacting one bureau is generally enough for it to notify the others, and the alert lasts for a set period that you can ask about and renew.
Credit freeze. A freeze restricts access to your credit report itself, which makes it much harder for anyone — including, temporarily, you — to open new accounts in your name. You lift or remove it when you genuinely need to apply for credit. A freeze is placed with each bureau.

Neither tool changes accounts that already exist, and neither is a magic shield; they guard the door to new credit. Many couples place a freeze on both partners’ reports as a precaution while a recovery is under way, and some keep one in place permanently, lifting it only for planned applications. The CFPB explains both tools and how to request them, in plain language, and the bureaus’ contact details are listed through official sources such as USA.gov if you are unsure where to start.

Step 4: Secure Your Own Accounts

Identity theft raises a fair question: how did they get in? You may never know the full answer, but you can close the obvious doors today. Change the password on your main email account first — it is the reset point for nearly everything else — then your banking and other financial accounts. Give each a long, unique password, and turn on two-step sign-in (a second check, such as a code sent to your phone) wherever it is offered.

Do the same check for your partner. Fraud affecting one spouse often involves information the household shares, and a discovery about one partner’s accounts is a sensible prompt for both of you to tighten your own. Check that the contact details on your accounts — phone number, email, home address — are yours and current, since a changed detail you did not make is itself a warning sign worth reporting to that company.

Step 5: Keep Records Like It Matters — Because It Does

Recovery involves repetition: you will explain the same facts to several organisations, sometimes more than once. A simple log turns that from exhausting to manageable. One notebook or document, with an entry for every contact: the date, the organisation, the name of the person you spoke with, the case number, what they said they would do, and what they asked of you. Keep copies of every letter you send and receive in the same place.

This log has a second job. If a fraudulent account resurfaces months later, or a company says it has no record of your dispute, your notes are your evidence that you acted and when. Couples often split the work — one makes the calls, the other keeps the log — which keeps the process steady without it consuming both partners. Protecting the household’s information going forward follows the same teamwork, as our guide to identity theft recovery steps during tax season explores for the specific case of tax-related fraud, where a return filed in your name adds the IRS to the list of organisations to contact through its official channels.

The First Moves at a Glance

First move	What it does	What to write down
Gather your evidence	Gives every conversation the same facts	What you found, and when you noticed it
Call each company’s fraud department	Opens a case; starts closing fraudulent accounts	Case number, the person’s name, what happens next
Place a fraud alert or credit freeze	Guards against new accounts in your name	Which bureaus you contacted, and when
Change key passwords, add two-step sign-in	Closes doors the thief may still hold keys to	Which accounts you secured, on which date
Keep one written log	Makes the whole process provable and repeatable	Every call, letter, and promised action

A Worked Example: One Couple’s First Week After a Discovery

Meet Priya and Tom, a fictional couple invented for this example; any figures below are invented round numbers used only for illustration. On a Monday, Priya found 2 charges on a card statement that neither of them recognised, totalling an invented $300 in this telling. Instead of calling the number on a text message about the charges — a message that had arrived the same morning and might itself have been part of the scam — they used the number on the back of the card.

The card company’s fraud department opened a case, closed the card, and said a replacement would follow; Tom wrote down the case number, the agent’s name, and the date in a fresh notebook. On Tuesday they reviewed their other accounts together, found nothing else, and placed credit freezes with the bureaus for both of them as a precaution. On Wednesday they changed the passwords on their email and bank accounts and turned on two-step sign-in. The rest of the week was quiet, which is normal: recovery often moves in steps, with letters and follow-ups arriving over time. What they had by Friday was not a finished story — it was an organised one, with every action logged and nothing left to memory.

Frequently Asked Questions

How long does identity theft recovery take?

There is no honest single answer, and you should be wary of anyone who promises one. Straightforward cases can move quickly once a company’s fraud department is involved, while tangled ones — several accounts, or tax-related fraud — can take considerably longer. What you control is the quality of your start: prompt calls, clear disputes, and complete records consistently make the process smoother, whatever its length.

Should we file a police report?

It depends on the situation. Some companies or agencies may ask for a formal report or a sworn statement as part of their process, and filing a report with your local police can be a useful supporting document. If a company requests one, ask exactly what they need. Whether or not you file, your own written log of the facts serves as the backbone of every conversation.

What is the difference between a fraud alert and a credit freeze?

An alert is a flag: it tells businesses checking your credit report to take extra care verifying that an applicant is really you. A freeze goes further by restricting access to the report itself, which generally prevents new accounts being opened until you lift it. Both are described in plain language by the CFPB, and many people use a freeze for stronger day-to-day protection while an alert suits shorter, simpler situations.

The fraud is on my partner’s accounts, not mine. Should I do anything?

Yes. Check your own accounts and credit reports too, because couples share addresses, devices, and sometimes information that a thief could use against either of you. Placing freezes on both partners’ credit is a common precaution. Practically, recovery is also a two-person job — sharing the calls, the log, and the follow-up keeps it from falling entirely on the person already dealing with the shock.

Will we be responsible for charges someone else made?

In general, consumer protections exist that limit what you owe for unauthorised use, and reporting promptly is the single best thing you can do to protect yourself — delays make disputes harder. The exact rules depend on the type of account and the situation, so ask each company’s fraud department what applies and get their answer in writing. The CFPB’s guidance explains these protections in plain English.

Someone is offering to fix our credit for a fee. Should we use them?

Be cautious. Everything in this article — contacting companies, placing alerts or freezes, disputing charges — you can do yourselves, free, through official channels. A service cannot do anything with a credit bureau that you cannot do yourself, and upfront-fee promises to erase accurate information or guarantee results are classic warning signs. The FDIC and CFPB both publish guidance on spotting these offers for what they are.

Your Next Step

Today, before anything else, make the first call: pick the account where you found the problem, find the number on your statement, card, or the company’s official website, and ask for the fraud department. Open the case, write the case number at the top of a fresh page, and let that page become your log. Every other step in this article follows from that one, and it takes less time than you fear.

This article is for general educational purposes only and is not financial, tax, legal, or investment advice. Consult a licensed professional about your situation.

How to Get Started With Identity Theft Recovery Steps