The Short Answer
If you believe someone has used your personal information without permission, the federal government’s official recovery tool is IdentityTheft.gov, run by the Federal Trade Commission (FTC). Reporting there is free, does not require hiring a paid recovery service, and produces two things you’ll need later: an Identity Theft Report and a personalized, step-by-step recovery plan. You do not need to pay a company to start this process, and you should be cautious about giving your Social Security number or account numbers to anyone except the credit bureaus, your own creditors, and official government sites you type in directly.
Where This Information Comes From
This guide is built directly from two federal sources: the FTC’s IdentityTheft.gov recovery plan materials and the FTC’s consumer-education article What To Know About Identity Theft. Where a fact comes from one of these sources, it’s stated as verified. Where the outcome depends on your state, your bank’s policies, or your local police department, that’s flagged clearly so you don’t mistake general guidance for a promise about your specific situation.
Verified: What the FTC’s Own Materials Confirm
- IdentityTheft.gov lets you report identity theft and generates a free, personalized recovery plan based on what you enter.
- If you create an account on the site, it walks you through each recovery step, tracks your progress, and pre-fills letters and forms you can send to creditors, debt collectors, and credit bureaus.
- If you don’t create an account, the site warns that you must print and save your Identity Theft Report and recovery plan immediately — once you leave the page, you cannot get back to them.
- You can also report by phone at 877-438-4338; interpreters for other languages are available by pressing 3, from 9:00 a.m. to 5:00 p.m. ET.
- A Spanish-language version of the reporting tool is available at RobodeIdentidad.gov.
- IdentityTheft.gov includes guidance for more than 30 specific types of identity theft, including tax, medical, and child identity theft, plus advice for data breaches.
Where Outcomes Vary
- Whether your local police department will take a standalone identity theft report varies by department and by state.
- How quickly a business or credit bureau responds to your dispute varies by company.
- Whether a specific debt is legally your responsibility depends on your state’s laws and the type of account involved — this is a legal determination, not something a general guide can settle for you.
The Official Recovery Path, Step by Step
The FTC’s own recovery plan materials describe this general sequence. Your personalized plan from IdentityTheft.gov may add or reorder steps based on what type of identity theft you report.
Step 1: Limit Further Damage to Your Credit
You have two related tools, and you can use either or both:
- Credit freeze: Blocks anyone, including you, from opening new credit in your name until you lift it. Freezes are free to place and free to lift. You must contact each of the three major credit bureaus separately: Experian, TransUnion, and Equifax.
- Fraud alert: Tells businesses to verify your identity before opening a new account. An initial fraud alert is free and lasts one year. You only need to contact one credit bureau — by law, that bureau must notify the other two.
Step 2: File Your Report at IdentityTheft.gov
Go to IdentityTheft.gov and describe what happened, including any suspicious activity you found on your credit reports or account statements. The site uses your answers to generate your Identity Theft Report and a recovery plan. Save or print both right away, especially if you did not create an account.
Step 3: Consider a Local Police Report
The FTC’s materials note that you may also choose to file a report with your local police department. Some businesses or creditors may ask for one in addition to your FTC Identity Theft Report. If a business later tries to hold you responsible for a fraudulent debt, our Consumer Rights section covers how consumer protection laws and dispute processes generally work.
Step 4: Work Through Your Personalized Plan
Depending on what happened, your plan may direct you to close new accounts opened in your name, dispute fraudulent charges on existing accounts, correct errors on your credit reports with each bureau, and keep monitoring your credit reports for new problems. Because these steps are generated from what you personally report, treat your own plan — not a generic list — as the authoritative sequence for your case.
Your Dated Recovery Record
Every call, letter, and online submission you make during recovery is easier to act on later if you log it the same day. Businesses and bureaus may ask you to repeat information, and having a written record helps you answer quickly and shows you acted promptly. For each contact, note:
- The date and time of the contact
- The business, bureau, or agency you contacted, and the department if known
- How you reached them (phone, mail, online form) and any reference or confirmation number given
- The name of the person you spoke with, if provided
- What they told you would happen next, and by when
- A follow-up date so nothing sits unresolved
Keep copies of your Identity Theft Report, your recovery plan, and any letters or forms you send or receive in one place — a folder or a dedicated email label works well. If your recovery plan includes pre-filled letters, keep a copy of each one you actually send, along with proof of mailing if you send it by certified mail.
Before You Consider a Paid Service
Credit monitoring, identity monitoring, and identity theft insurance products exist, and some people find them convenient. But the FTC’s consumer materials are direct on this point: no service can prevent your information from being stolen in the first place, and much of what recovery services do — writing dispute letters, placing a freeze, gathering documents — you can do yourself at no cost through IdentityTheft.gov and the credit bureaus directly. If you’re weighing a paid service, our Legal Scam Awareness section covers how to check whether a company’s claims and fees are legitimate before you pay for anything.
Be cautious about any company, email, or caller that asks for your Social Security number, account numbers, or payment before you’ve verified who they are. The FTC notes that organizations that legitimately need your Social Security number — like the IRS, your bank, or your employer — will not call, email, or text you to ask for it.
Disclaimer
This article provides general legal information for educational purposes only. It is not legal advice, does not create an attorney-client relationship, and is not a substitute for advice from a licensed attorney familiar with your state’s laws and the specifics of your situation. LegalHelpOnline.org is an independent publication and is not affiliated with the Federal Trade Commission or any government agency. For guidance specific to your case, consult a qualified attorney or contact the agencies referenced above directly.
By LegalHelpOnline.org Legal Research & Editorial Team. Last updated: September 2026.