Jonathan Machado
Discovering that someone has opened a credit line, drained an account, or filed taxes in your name is unsettling, but the recovery playbook is more standardized than most people realize. Federal law gives you specific tools, the three major bureaus must investigate disputes within thirty days, and creditors generally absorb the fraudulent charges once they verify the claim. The trick is doing the steps in the right order and creating a paper trail you can point to months later when a collection agency calls about a debt you never owed. Here is the sequence that works.
Lock Down Compromised Accounts First
Before anything else, contain the damage. If a credit card was used, call the issuer's fraud line (the number on the back of any current card or on the issuer's website) and ask them to close the compromised account and reissue a new card under a new number. For checking accounts, the bank will typically close the account, move funds to a new one, and issue new debit cards and checks. Reset every password that touches money: bank logins, card portals, brokerage, PayPal, Venmo, payroll, and the email address tied to those accounts. If the same email and password combination was used elsewhere, change those too, because credential stuffing is how a single breach turns into ten compromised accounts. Use a password manager to generate and store unique passwords for each site - reusing passwords is the single most common reason a breach at one company cascades into financial loss at another.
Turn on two-factor authentication using an authenticator app (Google Authenticator, Authy, or similar) rather than SMS where possible, because SIM-swap attacks specifically target SMS codes on financial accounts. If your carrier supports a number-lock or port-out PIN, enable it - this prevents a thief from transferring your phone number to their device, which would intercept SMS codes. Save every confirmation number, representative name, and call date in a single document with timestamps. You will need this evidence repeatedly over the next several weeks when disputing transactions, removing fraudulent accounts, and dealing with collection agencies that may surface months later. A simple spreadsheet or notes document is enough; what matters is that you can produce it on demand.
File the FTC Report and a Police Report
Go to IdentityTheft.gov, the FTC's official identity theft portal, and complete the identity theft report. The site walks you through a customized recovery plan based on the specific accounts affected and produces an FTC Identity Theft Report, which is the document creditors and bureaus will ask for repeatedly. Print it and save the PDF in multiple places - cloud storage and a local copy at minimum. This single document, paired with a government-issued ID, unlocks most of the consumer protections in the Fair Credit Reporting Act and Fair Credit Billing Act. Without it, you are still entitled to dispute fraudulent items, but the process is significantly slower and creditors are not required to block the information from being re-reported.
Next, file a report with your local police department. Many people skip this step because the police rarely investigate identity theft cases directly, but the report number itself is valuable - some creditors and debt collectors will not remove fraudulent accounts without one. Bring the FTC report, a photo ID, proof of address, and any evidence you have (statements showing the fraud, letters from creditors, a credit report flagging the unfamiliar accounts). Ask for a copy of the report and the case number. Keep both on file. If you later get sued by a collection agency over a fraudulent debt, this paper trail is what makes the case go away quickly. Some jurisdictions allow you to file the police report online, which is faster than going in person and produces the same documentation.
Place a Fraud Alert or Credit Freeze
You have two main tools at the credit bureaus, and they serve different needs. A fraud alert is free, lasts one year (or seven for an extended alert if you have an FTC report), and tells lenders to verify your identity before opening new credit. You only need to contact one of the three bureaus - Equifax, Experian, or TransUnion - and that bureau is required to notify the other two. Fraud alerts do not stop you from using your existing credit, which is convenient if you are mid-purchase on something legitimate.
A credit freeze is stronger. Under the Fair Credit Reporting Act, freezes are free at all three bureaus and must be placed within one business day if requested online or by phone. A freeze blocks new credit applications entirely until you lift it. You will need to freeze at each bureau individually, and you should also freeze with the smaller specialty bureaus - ChexSystems for bank accounts, LexisNexis for insurance and certain lenders, and the National Consumer Telecom and Utilities Exchange for phone and utility accounts. Save the PIN or login for each. When you need new credit, you lift the freeze temporarily, then it goes back into place. For most identity theft victims, a freeze is the right choice.
Dispute Fraudulent Accounts and Monitor for Months
Pull all three credit reports at AnnualCreditReport.gov (free weekly under current rules) and circle every account, inquiry, and address you do not recognize. Send a written dispute to each bureau by certified mail, with return receipt, including a copy of your FTC report, the police report, your ID, and a clear list of what is fraudulent. Under the FCRA, bureaus generally have thirty days to investigate and respond. Also contact each creditor directly using their fraud department address (not the regular billing address) and submit the same documentation. Federal law requires creditors to block fraudulent information from being furnished to bureaus once you submit a valid identity theft report.
Then settle in for several months of monitoring. Identity thieves often sit on stolen data for weeks or months before using it, and a quiet first month does not mean you are clear. Check your reports monthly for at least a year, watch for unfamiliar mail (especially card welcome packets and collection letters), and review bank and card statements line by line. If a new fraudulent account appears, repeat the dispute process - it is repetitive, but it works. Also check the specialty bureaus: ChexSystems for new bank account fraud, LexisNexis for insurance and certain employment screenings, and the National Consumer Telecom and Utilities Exchange for utility and cell phone fraud. Identity thieves often target these less-watched bureaus precisely because consumers do not monitor them. Filing a tax return early (as soon as possible after January) is another defensive move - it locks out tax-related identity theft for the year.
