What to do first if you’re a victim of identity theft
If someone has used your personal information without permission, act in this order: contact the companies where the fraud happened, place a free fraud alert with one credit bureau, file a report at IdentityTheft.gov, then file a police report. This order matters because each step produces documents you’ll need for the next one. This article explains each step under federal law and shows where the rules differ by state.
Step 1: Contact the companies involved
Call the fraud department at any bank, credit card company, or service provider where you see unauthorized activity. Ask them to close or freeze the account. Change your login passwords and PINs right away, including for accounts that were not affected, since thieves who get one password often try it elsewhere.
Step 2: Place a fraud alert
A fraud alert tells lenders to verify your identity before opening new credit in your name. Under federal law, a fraud alert is free and lasts one year. You only need to contact one of the three nationwide credit bureaus, and that bureau must notify the other two.
- Equifax: equifax.com/personal/credit-report-services
- Experian: experian.com/help
- TransUnion: transunion.com/credit-help
After placing the alert, get your free credit reports at annualcreditreport.com and look for accounts or charges you don’t recognize.
Step 3: File your report at IdentityTheft.gov
IdentityTheft.gov is run by the Federal Trade Commission. Filing there creates an FTC Identity Theft Affidavit and a personal recovery plan with pre-filled letters for disputing fraudulent accounts. Print and save the affidavit right away, since the site does not let you retrieve it later.
Step 4: File a police report
Bring the following to your local police department:
- Your FTC Identity Theft Affidavit
- A government-issued photo ID
- Proof of your address, such as a utility bill or lease
- Any evidence of the theft, such as fraudulent bills or notices
You may need to show proof that you’re a victim before an officer will take the report. If the department is reluctant, the FTC publishes a Memo to Law Enforcement that explains why the report matters. Ask for a copy of the completed police report. Combined with your FTC affidavit, this becomes your full Identity Theft Report, which you’ll use to dispute accounts, extend a fraud alert, and support a credit freeze.
Step 5: Freeze your credit
A credit freeze blocks new lenders from viewing your credit file at all, which stops most attempts to open new accounts in your name. Under federal law effective September 21, 2018, credit freezes are free nationwide. You must contact each of the three bureaus separately, since placing a freeze with one does not freeze the others.
Credit freeze timelines under federal law
- Requested online or by phone: bureau must place the freeze within one business day
- Requested by mail: bureau must place the freeze within three business days
- Lifting a freeze online or by phone: must happen within one hour
- Lifting a freeze by mail: within three business days
Freezing is different from a fraud alert. A freeze blocks new inquiries almost entirely, while a fraud alert only asks lenders to double-check your identity first. Identity theft victims with a completed Identity Theft Report can also request an extended fraud alert, which lasts seven years instead of one.
Quick reference checklist
- Call affected companies and freeze or close compromised accounts
- Change passwords and PINs
- Place a free fraud alert with one credit bureau
- Pull your free credit reports and review them
- File your report at IdentityTheft.gov and save your affidavit
- File a police report and request a copy
- Freeze your credit with all three bureaus separately
- Consider an extended fraud alert if you have a completed Identity Theft Report
Where the rules vary by state
The steps above come from federal law and apply the same way in every state. But some things do vary locally: which police department has jurisdiction to take your report, whether your state has its own identity theft passport or victim assistance program, and how state consumer protection agencies handle complaints. Contact your state Attorney General’s consumer protection office to confirm any state-specific programs or deadlines that may apply to your situation.
When to talk to a licensed attorney
This article explains the general process, not what to do in your specific case. Talk to a licensed attorney in your state if fraudulent debt is being pursued against you in court, if a business refuses to remove fraudulent charges after you’ve disputed them in writing, if your identity was used for something with legal consequences like a fraudulent tax return or criminal charge, or if you’re facing a filing deadline you don’t understand. An attorney can also tell you whether your state gives you added rights beyond the federal minimum described here.
Frequently asked questions
Do I have to file a police report even if I already filed at IdentityTheft.gov?
Yes, for full protection. Your FTC affidavit alone is often accepted by creditors, but combining it with a police report creates a complete Identity Theft Report, which some companies and an extended fraud alert require.
Is a credit freeze the same as a credit lock?
No. A freeze is a federally regulated free right under law. A lock is a product some bureaus sell that works similarly but may involve fees or different terms. Check the terms carefully before choosing a lock over a freeze.
How long does a fraud alert last?
An initial fraud alert lasts one year and is free. Identity theft victims with a completed Identity Theft Report can request an extended fraud alert lasting seven years.
Will freezing my credit hurt my credit score?
No. A freeze does not affect your credit score. It only blocks new lenders from viewing your file until you lift it.
Sources and further reading
This article is based on guidance from IdentityTheft.gov and the Federal Trade Commission’s consumer guidance on identity theft. See our Sources and Fact-Checking Policy and Editorial Standards for how we verify legal information.
This article provides general legal information only. It is not legal advice, does not create an attorney-client relationship, and should not be relied on as a substitute for advice from a licensed attorney familiar with your state’s laws and the facts of your situation. See our full Legal Information Disclaimer.