Identity Theft Recovery: Reporting Steps, Credit Freezes and Available Legal Remedies

What to Do the Moment You Suspect Identity Theft

Identity theft recovery starts with three actions: contact the companies where fraud happened, place a fraud alert or credit freeze with the credit bureaus, and file a report at IdentityTheft.gov to get a personalized recovery plan. From there, federal law gives you specific rights to dispute errors, block fraudulent information from your credit file, and in some cases sue for damages. This guide walks through each step in order, using current guidance from the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB).

This article is educational information, not legal advice. Laws, deadlines, and procedures can vary by state and change over time, so verify current details with an official source or a licensed attorney before relying on them.

Warning Signs of Identity Theft

Act quickly if you notice any of the following:

Charges or accounts you don’t recognize on a bank or credit card statement
A bill, collection notice, or tax notice for something you never bought or filed
A sudden drop in your credit score or unfamiliar hard inquiries on your credit report
Missing mail, or notices that your address was changed without your request
A denial of credit, a job, or insurance based on information you don’t recognize
An IRS notice about a tax return you didn’t file, or a health insurance statement for care you didn’t receive

Step 1: Call the Companies Where Fraud Happened

Contact the fraud department of each affected bank, card issuer, or account provider right away. Ask them to close or freeze the fraudulent account and remove any charges you didn’t make. Then change the logins, passwords, and PINs on the accounts involved. Keep notes of who you spoke with and when, since you’ll need these details later.

Step 2: Place a Fraud Alert and Get Your Credit Reports

Contact just one of the three nationwide credit bureaus to place a free fraud alert. That bureau is required to notify the other two.

Equifax: equifax.com/personal/credit-report-services, 1-800-685-1111
Experian: experian.com/help, 1-888-397-3742
TransUnion: transunion.com/credit-help, 1-888-909-8872

Once the alert is in place, get your free credit reports from all three bureaus at AnnualCreditReport.com and review each one for accounts or transactions you don’t recognize.

Step 3: File a Report at IdentityTheft.gov

IdentityTheft.gov, run by the FTC, walks you through building an Identity Theft Report and a personal recovery plan. If you create an account, the site pre-fills letters and forms for creditors and credit bureaus and tracks your progress. If you skip the account, you must print and save your report immediately, since you can’t retrieve it later. You may also choose to file a report with your local police department, which some remedies below require.

Credit Freeze or Fraud Alert: Which One Do You Need?

Both tools are free and don’t affect your credit score. The right choice depends on how much protection you need and how often you apply for new credit.

A fraud alert may fit if:

You want lenders to verify your identity before opening new credit, without blocking access outright
You apply for credit often and don’t want the extra step of lifting a freeze each time
An initial alert lasts one year and can be renewed; an extended alert for confirmed identity theft victims lasts seven years and requires a police report or an FTC identity theft report

A credit freeze may fit if:

You want the strongest available protection, since a freeze blocks new lenders from viewing your credit file entirely
You’re not planning to apply for new credit soon, since you’ll need to lift the freeze temporarily to do so
You want protection that doesn’t expire until you remove it yourself

You can place a freeze or alert with each bureau, and you can use both tools together. Placing or lifting a freeze is free at all three bureaus, and by law it must be lifted within one hour of an online or phone request, or within three business days for a mailed request.

Fixing Errors on Your Credit Report

The Fair Credit Reporting Act (FCRA) gives you the right to dispute inaccurate, incomplete, or unverifiable information on your credit report. Here’s how the process generally works:

Identify the disputed item and gather supporting documents, such as your Identity Theft Report or account statements
Submit a written dispute to the credit bureau reporting the error, and consider disputing directly with the business that furnished the information as well
The credit bureau generally must investigate within 30 days of receiving your dispute, or 45 days in some cases, and forward your evidence to the furnisher
If the information can’t be verified as accurate, it must be corrected or removed
If a bureau finds your dispute frivolous, it must notify you in writing and explain why

If you disagree with the outcome, you have the right to add a statement to your credit file explaining your side.

Legal Remedies Available Under Federal Law

Recovery isn’t limited to phone calls and paperwork. Federal consumer protection law gives you several formal paths if a business, credit bureau, or debt collector mishandles your case:

File a complaint with the CFPB at consumerfinance.gov/complaint if a credit bureau or creditor fails to properly investigate a dispute or continues reporting inaccurate information after being notified
File a complaint with the FTC at ReportFraud.ftc.gov for fraud, scams, or identity theft, in addition to your IdentityTheft.gov report
Dispute debt you don’t owe with the collector in writing; under the Fair Debt Collection Practices Act, collectors must generally stop contacting you about a debt until they verify it
Consider legal action — the FCRA allows consumers to sue credit bureaus or furnishers for willful or negligent violations in some circumstances, and separate deadlines apply to different claims, so confirm current limits with an attorney or official source before filing

Evidence limit: the specific damages available, filing deadlines, and procedural requirements for a lawsuit depend on the facts of your case and the state where you live. This article does not cover every possible claim or deadline, and a consumer law attorney can evaluate options a general guide cannot.

Special Situations: Tax, Medical, and Child Identity Theft

Some forms of identity theft need extra steps beyond the core process above.

Tax identity theft: file your tax return as early as possible, respond promptly to any IRS notice, and never assume a caller demanding immediate payment is really the IRS
Medical identity theft: review your medical records for errors, write to the healthcare provider to correct mistakes, and notify your health insurer’s fraud department
Child identity theft: minors generally don’t have a credit file until someone opens one in their name; contact the credit bureaus directly if you suspect this has happened to your child

IdentityTheft.gov provides detailed, situation-specific checklists for these and more than thirty other types of identity theft.

Extra-Caution Groups

Older adults, active-duty service members, and people who have experienced a data breach notification face some different rules and options. Active-duty alerts, protections for “protected consumers” under age 16, and breach-specific guidance all have their own requirements, so check the official FTC and CFPB pages linked below for the version that applies to your situation.

Where State Law Applies

The reporting steps above are required by federal law and apply nationwide. However, some details vary by state, including:

Whether your state requires a police report for certain remedies
State-specific consumer protection laws that may provide additional rights beyond the FCRA
Court procedures and deadlines if you pursue a claim through a state court

To confirm the rule in your state, check your state attorney general’s consumer protection page or speak with a licensed attorney in your jurisdiction. See our Court and Agency Resources section for help finding the right agency.

When to Contact a Lawyer

Consider speaking with a consumer protection attorney if a credit bureau or furnisher won’t correct a clear error after a formal dispute, if a debt collector is pursuing you for a debt tied to identity theft, if you’re facing a lawsuit connected to fraudulent accounts, or if the identity theft involves large financial losses. Many consumer attorneys offer free initial consultations, and some cases may qualify for fee-shifting under federal law, meaning the responsible party may have to cover attorney costs if you win.

Frequently Asked Questions

Does a credit freeze or fraud alert hurt my credit score?

No. Neither tool affects your credit score. A freeze restricts who can view your report, and an alert requires additional identity verification, but neither affects your score nor prevents you from using existing accounts.

Do I have to pay to freeze or unfreeze my credit?

No. Placing and lifting a credit freeze is free at all three nationwide credit bureaus.

How long does an identity theft investigation take?

Timelines vary by business and by the number of accounts involved. Credit bureau disputes generally must be investigated within 30 days, or up to 45 days in some cases, but resolving every affected account can take longer depending on your situation.

Do I need a police report to recover from identity theft?

Not always. Many steps only require your FTC Identity Theft Report. However, an extended fraud alert and some other protections require either a police report or a completed IdentityTheft.gov report, so check the specific requirement for the remedy you’re pursuing.

Educational Disclaimer

This article provides general legal information for educational purposes only. It is not legal advice and does not create an attorney-client relationship. Laws, deadlines, dollar limits, and procedures discussed here are based on federal guidance current as of publication and may vary by state or change over time. Verify current requirements with the official source linked, your state attorney general’s office, or a licensed attorney before making decisions about your case.