Identity stolen? What to do, in order

Start at IdentityTheft.gov, the reporting site of the Federal Trade Commission (FTC). You describe what happened, and it builds you a free recovery plan. Then call the companies where the fraud happened, freeze your credit, and check your credit reports. If a thief used your Social Security number, protect your tax account too. This guide puts those steps in order. It also covers what to do if your number leaked and nobody has used it yet.

What identity theft looks like

The FTC defines identity theft as someone using your personal or financial information without your permission. A thief can use it to buy things, open accounts, claim your tax refund, or get medical care.

The FTC lists these signs:

• A bill stops arriving. That can mean someone changed your billing address.
• You see charges or bills you did not expect.
• Money leaves your bank account and you did not take it out.
• Your credit reports show accounts you do not recognize.

USAGov adds debt collection calls about accounts you never opened, and denied loan applications.

You are not alone. In 2024, people filed about 1.1 million identity theft reports with the FTC. That was 18 percent of all the reports it received, according to its 2024 Data Book, published in March 2025. These are only the cases people chose to report.

What you need

• A notebook or a file where you log every call, letter and reference number. The Internal Revenue Service (IRS) tells victims to keep records of letters, phone calls and emails.
• A list of the accounts you think are affected.
• Your Social Security number, and about an hour for the first steps.
• Phone numbers and websites that you looked up yourself. The Consumer Financial Protection Bureau (CFPB) says to contact banks, police and the FTC “directly using official websites and phone numbers.” Scammers pretend to be the FTC, and they pretend to be your bank.

The steps, in order

1. Report it at IdentityTheft.gov. The FTC says to report identity theft there and get a personal recovery plan. Give as many details as you can. If you cannot use the website, USAGov lists the FTC’s number: 1-877-438-4338. The CFPB says the FTC never threatens you and never tells you to move your money to “protect it.” If a caller says otherwise, it is a scam.
2. Call the companies where the fraud happened. Ask for the fraud or security department. The CFPB says to close any affected accounts. Then change the password on any account that was compromised. The FTC advises strong passwords and two-factor authentication, which asks for a second proof that it is you. Our password generator can make a strong password, and Passkeys vs passwords explains a safer way to sign in.
3. Freeze your credit. The FTC says that while a credit freeze is in place, nobody can open a new credit account in your name, including you. It is free. You place it with each of the three credit bureaus: Equifax, Experian and TransUnion. Our guide shows how: How to freeze your credit. A fraud alert is a lighter option. It makes lenders verify your identity first. The FTC says an initial alert lasts one year, and you contact only one bureau, which must tell the other two. As a victim, you can ask for an extended alert, which lasts seven years. You need an identity theft report from IdentityTheft.gov or a police report.
4. Read your credit reports. The FTC says AnnualCreditReport.com is the only authorized place for free reports, and that all three bureaus let you check once a week for free. Review all three, because each can differ. Write down every account you do not recognize. The FTC says mistakes can signal identity theft.
5. Ask the bureaus to block fraudulent items. The CFPB says you can send each bureau three things: an identity theft report from IdentityTheft.gov, proof of your identity, and a letter that names the fraudulent debts or items. A bureau must block them within four business days after it receives your request, the CFPB says. It must also tell the company that supplied the information. After that, the creditor cannot turn the debt over to a debt collector. The CFPB says IdentityTheft.gov has a sample letter. Use this only for debts caused by identity theft.
6. Report it to your local police. The CFPB says to report the theft to your local police as well as at IdentityTheft.gov. Keep a copy of the police report with your other records.
7. Protect your tax account. See the next section.
8. Check your Social Security record. The IRS lists two warning signs here: wages you did not earn on your Social Security account, and a Form W-2 or 1099 from an employer you do not know. If you get such a form, do not put that income on your return, and contact the Social Security Administration. You can also lock your number in E-Verify, the system employers use to verify employment authorization. You need a myE-Verify account. E-Verify says that if an employer enters a locked number, the check comes back as a mismatch. You can unlock it when a new employer needs to run a check.

Protect your tax account

Tax identity theft is when someone files a return with your Social Security number to claim a refund. Two tools matter most.

An IP PIN. An Identity Protection PIN is a six-digit number that stops anyone else from filing a return with your Social Security number. The IRS says only you and the IRS know it. Anyone with a Social Security number or an ITIN (an individual taxpayer identification number) who can verify their identity can get one. The IRS says the fastest way is through your IRS online account. A new PIN is issued each year. The IRS will never ask you for it. Calls, emails or texts that ask for it are scams.

Form 14039, only when it fits. This is the IRS Identity Theft Affidavit. The IRS says most people do not need it. It says to file it only if:

• the IRS tells you to;
• you cannot use the IRS Identity and Tax Return Verification Service; or
• you want to tell the IRS about possible tax-related identity theft it does not have on file, such as after a data breach.

Do not file it if you already sent it, if you filed it through IdentityTheft.gov, or if the IRS already sent you a letter or notice. The FTC says IdentityTheft.gov can create the affidavit for the IRS.

A rejected tax return is one of the warning signs the IRS lists. If your dependent was already claimed on another return, the IRS says you can still e-file, or file on paper with supporting documents if you cannot. If a letter arrives, check that it is really from the IRS before you act. The IRS guide tells you to verify it.

Two special situations:

• A letter about unemployment benefits you never filed for. The FTC’s alert of February 17, 2026, calls this identity theft. It says to tell your employer and your state workforce agency, then report it at IdentityTheft.gov. It also suggests a credit freeze and an IP PIN.
• Someone used your number to get a job. The IRS says identity thieves can apply for jobs with your information, which can affect your taxes, Social Security benefits and work history.

If your Social Security number leaked but nothing has happened

Not every data breach leads to identity theft, the IRS says. Your tax account is most at risk when a breach exposes your Social Security number and financial data such as wages. A breach of credit card numbers alone will not touch it.

If a scammer got your number and you are not sure it was used, the FTC points you to IdentityTheft.gov/databreach. Then take these steps:

1. Freeze your credit at all three bureaus.
2. Get an IP PIN from the IRS.
3. Check your credit reports every week, and look at your bank and card statements.
4. Use any credit monitoring the company offers, if you want it. The IRS says some companies that lose data offer it.
5. Make it harder for strangers to find your details. See How to remove personal information from the internet.

Is my Social Security number on the dark web?

You do not need the answer to protect yourself. The steps are the same either way. If a company or agency tells you your number was exposed, act as if it was.

Monitoring services can help, but the FTC lists what they miss. It says credit monitoring will not alert you when someone withdraws money from your bank account, or files a tax return in your name to collect your refund. It says most identity monitoring services will not alert you to a tax refund claim, or to a benefits claim such as Medicaid, Social Security or unemployment. A freeze blocks new credit, and an IP PIN blocks a false tax return.

What can go wrong

• A freeze does not cover existing accounts. The CFPB says a freeze can stop new accounts, but it does not stop a thief from taking over accounts you already have. Watch those, and change their passwords.
• A fraud alert expires. An initial alert ends after a year, the FTC says, unless you renew it.
• Fake helpers. Scammers pose as the FTC, your bank, or a “recovery” company. The FTC says never to pay upfront for a refund, or for help getting one. The FBI’s Internet Crime Complaint Center (IC3) says it never directly contacts you for information or money, and that it does not work with law firms or crypto services to recover lost funds.
• Letters you ignore. The FTC warns that ignoring a letter about an unemployment claim you never filed could lead to problems like wage garnishment or tax identity theft. Open your mail, and answer it.
• A fix you never check. Read your credit reports again in a few weeks. The FTC says the weekly check is free.

If the theft began with a hacked account, read Am I hacked? to lock down your email first. If you think your phone is involved, see How to tell if your phone is hacked.

What to do now

1. Go to IdentityTheft.gov, or call 1-877-438-4338, and get your recovery plan.
2. Call the fraud department at each affected company, close or freeze the accounts, and change your passwords.
3. Freeze your credit at all three bureaus, and read your reports.
4. If your Social Security number was used or leaked, request an IRS IP PIN.
5. Keep a log of every call, letter and report number.