What to Do if You’re a Victim of Identity Theft
Identity theft can be a frightening experience, and with so much of our lives accessible online, even the most cautious people can become victims. The key to recovering from identity theft is to act quickly once you detect fraud. The Federal Trade Commission (FTC) reported over 1 million identity theft cases in 2023, more than any other type of consumer complaint. But by taking immediate steps, you can regain control and prevent future incidents.
Immediate Steps to Take
The most frequent form of identity theft involves using your Social Security number to open new accounts. Of the 1 million identity theft complaints the FTC received, approximately 37% concerned unauthorized new credit card accounts, while 10% involved new bank accounts. Here’s how to protect yourself:
Step 1: File a Report with the FTC and Your Local Police Department
The first thing you should do after discovering identity theft is report it to the FTC. This will help expedite your recovery process. As David Burroughs, partner at StoneTurn, a global risk and compliance consulting firm, explains, “The information can be used by the FBI and other law enforcement agencies to identify or track down the perpetrator, as well as provide the individual with a personal recovery plan.”
You can file an identity theft report with the FTC at IdentityTheft.gov. After completing a questionnaire, you will receive a recovery plan based on your situation. This plan guides you through recovering from identity theft, tracks your progress, and provides templates for the necessary forms and letters.
- Note: While you can report the theft to the FTC over the phone, you will not receive an identity theft report this way. This report is extremely helpful when recovering your identity.
Next, file a police report with your local police department. According to the FTC, you’ll need the following documents:
- A copy of your FTC Identity Theft Report
- A government-issued ID with a photo
- Proof of your address (e.g., mortgage statement, rental agreement, or utility bill)
- Evidence of identity theft (e.g., bills, IRS notices, credit reports)
Step 2: Place a Fraud Alert and Freeze on Your Credit Reports
“If you suspect fraudulent activity or think you may be a victim of identity theft, contact the three major credit bureaus to notify them and request a fraud alert or credit freeze to prevent any further unauthorized activity,” says Burroughs. A fraud alert requires lenders to verify your identity before issuing a new credit account. A credit freeze restricts lenders from accessing your credit report if you or someone else opens an account under your name. “These alerts can help catch any unauthorized access, such as opening credit cards or taking out loans,”
Contact TransUnion, Experian, or Equifax to activate a fraud alert. The credit agency will then inform the other two bureaus to add a fraud alert to your credit file. The alert stays on your file for a year. However, you can extend this for up to seven years by filing an identity theft report with the police or the FTC.
Request a fraud alert online, by phone, or by mail:
- Equifax:
- Website: Equifax Fraud and Active Duty Alert
- Phone: (800) 525-6285
- Mail: Equifax Information Services LLC, P.O. Box 105069, Atlanta, GA 30348-5069
- Experian:
- Website: Experian Fraud Alert Center
- Phone: 888-397-3742
- Mail: Experian, P.O. Box 9554, Allen, TX 75013
- TransUnion:
- Website: Transunion Fraud Alert
- Phone: 800-916-8800
- Mail: Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19016-2000
You can place a credit freeze on your file by contacting all three credit bureaus, which will prevent anyone from opening new accounts in your name. With an account freeze, you can continue using your existing credit cards. A credit freeze will stay on your file until you lift it, so if you apply for a new credit card or a loan, you must contact each bureau to temporarily lift the freeze.
Step 3: Contact the Institutions Where the Fraud Occurred
“Be sure to alert any companies or accounts that may have been impacted by fraudulent transactions on your behalf, including bank accounts, credit cards, and health insurance, among others,” says Burroughs. If you find fraudulent activity on your credit or debit card, ask your issuer or bank to freeze or close the account and send you a new card with an updated account number. The Fair Credit Billing Act and the Electronic Fund Transfer Act protect consumers from liability for fraudulent charges, so be sure to dispute them to receive a refund.
- Note: There are time limits to dispute errors or unauthorized charges. Notify each company immediately.
As a general rule, you usually have about 60 days to dispute credit card charges. You can also report Social Security number theft to the Social Security Administration’s hotline at 1-800-269-0271 or by filing a report at oig.ssa.gov/report.
Step 4: Dispute Unauthorized Activity with Credit Bureaus
Fraudsters may use your identity to open a new credit account or take out loans. It’s important to check your credit file for this activity. AnnualCreditReport.com provides a free credit report from all three credit reporting agencies. Once you receive your credit reports, check your file for any unauthorized activities or errors, and then notify the credit bureaus in writing by sending supporting documentation (identity theft affidavits, copies of your FTC and police reports, any evidence of the fraud, etc.). You can contest any errors via phone or their website. After you submit this information the credit bureaus have approximately 30 days to respond. When the credit agencies verify the error, they will rectify the issue on your file and send you a free credit report.
- Note: In the wake of the COVID-19 pandemic, credit bureaus have taken longer to respond to these disputes. The FTC website offers a template for dispute letters.
Contact information:
- Equifax:
- Website: Equifax Credit Dispute
- Phone: 1-888-378-4329
- Mail: Equifax Information Services, LLC, P.O. Box 740256, Atlanta, GA 30374-0256
- Experian:
- Website: Experian Dispute Center
- Mail: Experian, P.O. Box 4500, Allen, TX 75013
- TransUnion:
- Website: TransUnion Dispute Center
- Phone: 800-916-8800
- Mail: TransUnion Consumer Solutions, P.O. Box 2000, Chester, PA 19016
Step 5: Secure Your Online Accounts
“It is likely you will be impacted by a data breach more than once and have your information exposed and stolen multiple times over your lifetime,” cautions Michael Bruemmer, VP and head of global data breach resolution and consumer protection at Experian. Therefore, take steps to protect your digital identity as follows:
- Activate multi-factor authentication (MFA)
- This technique requires two or more forms of authentication beyond a password to prevent fraudsters from accessing your accounts.
- Update your Passwords
- If one of your passwords has been compromised, hackers may try using those credentials to access your other accounts (a technique known as credential stuffing). If your accounts have been compromised, change your passwords immediately. Experts recommend changing your passwords every three months, and they should be strong, unique, and hard to guess.
Step 6: Change Your Passwords and Monitor Your Accounts Regularly
People who have been victims of identity theft are more vulnerable than those who have not. That is because once your private information has been uncovered, it may become easily available for purchase on the dark web. As a result, to protect your identity, you will have to stay vigilant months, or even years, after the initial incident. Fortunately, you can get one free credit report from each of the three bureaus yearly via AnnualCreditReport.com. You can also enroll in an identity theft protection service that monitors the dark web and provides identity theft insurance, usually up to $1 million. The best services offer personalized expert assistance if you experience more identity theft incidents.
Repairing the Damage
Recovering from identity theft may not be on your radar, but acting quickly and effectively can stop bad actors from using your personal information to cause further damage. “Identity theft can occur in other areas, including medical records, tax filings, social media accounts, employment history, and even criminal records,” notes Josh Amishav, founder and CEO of Breachsense, a data breach monitoring platform. “Recovery often involves multiple facets of your life.”
This means reporting the fraud to the necessary authorities, fortifying your online security with password changes and multi-factor authentication, changing your online habits, and keeping a watchful eye on your credit report. You may also need to seek legal advice to assist with disputing fraudulent activity. As Burrough states, “In a digital world, the opportunity, frequency, and sophistication of scams are increasing. Recognizing common schemes and proactively identifying red flags are critical to mitigating risks of identity theft scenarios and scams.”
Frequently Asked Questions about Identity Theft Recovery
- How long does it take to recover from identity theft?
- The recovery time varies, but it can take several months to resolve all the issues and to restore your credit.
- Should I hire an identity theft protection service?
- While not strictly necessary, these services can provide monitoring and other assistance, which can alert you to fraud more quickly and simplify recovery.
- What legal protections are available for identity theft victims?
- Identity theft victims have legal rights under the Identity Theft and Assumption Deterrence Act. They have the right to be recognized as victims, to seek compensation from the perpetrators, and to make the FTC the central point of contact for filing complaints.
