Identity Stolen? Here’s What
to Do in the First 24 Hours

Take a breath. Grab paper and a pen.

The first thing to know about what to do if your identity is stolen is that you are going to be on the phone a lot today. For every call, write down the date, time, company name, the representative’s name, and what was said. This written record is what protects you later if anyone says a fraud report was never filed.

Place a fraud alert with one of the three big credit bureaus

A fraud alert is free and lasts one year. It tells any lender checking your credit that they must verify your identity before opening new accounts in your name. Pick one of the three big bureaus below and contact them. By law, that bureau is required to notify the other two within 24 hours, so a single call protects you at all three.

Call your bank and any affected credit card issuers

Use the phone number on the back of your card. Never use a number that came in a suspicious email or text. Ask for the fraud department directly. Report fraudulent charges, close and reissue any compromised cards, and ask for new account numbers if a checking account was touched.

Change passwords on your primary email account first

Step 3 was a phone call to your bank’s fraud team. Step 4 is on the web. If the thief has your email, they can reset passwords on every other account you own, so change your email password before any other web account. Turn on two-factor authentication using an authenticator app, not SMS, which can be intercepted via SIM swap. Once your email is locked, change passwords on banking websites, social media, and any other accounts you can think of.

File a report at IdentityTheft.gov

This is the official FTC identity theft reporting site. The report itself is free, takes about 15 minutes, and generates an Identity Theft Report plus a personalized recovery plan. More importantly, businesses are legally required to accept this report when you dispute fraudulent charges. This is not optional paperwork. It’s your most powerful document for the weeks ahead.

Place a credit freeze at all five bureaus

A fraud alert just slows new credit down. A credit freeze completely blocks new credit from being opened in your name.

The freeze does not replace the fraud alert from Step 2. Both can stay active at the same time, and together they give you stronger protection than either one alone.

Freezes are free at every bureau, and you can lift one temporarily when YOU want to apply for credit. The “one call notifies the others” rule does not apply to freezes. You have to contact each bureau on its own.

Pull your free credit reports from all three bureaus

Go to AnnualCreditReport.com, which is the only federally authorized source, and pull all three reports today. Specifically, look for accounts you didn’t open, inquiries you didn’t authorize, and addresses that aren’t yours. Circle anything suspicious. You will dispute these in the coming days.

Get an IRS Identity Protection PIN

Tax-related identity theft is one of the most common follow-on attacks. An IP PIN is a six-digit code that prevents anyone from filing a tax return using your Social Security number. Request one through your IRS online account. You will need this year’s number even if you have already filed.

Lock your Social Security online record

Create or log into your my Social Security account and block electronic access to your record. As a result, no one can fraudulently claim benefits or change direct deposit information in your name.

Call your mobile carrier and set an account PIN

SIM swap attacks are often the second phase of an identity theft. Once a thief has your info, they try to take over your phone number to intercept two-factor codes.

Call your carrier’s fraud line, add a separate account PIN that must be provided before any SIM change, and enable Number Lock or Port Freeze.

File a police report if you know the thief or suffered a financial loss

You don’t need a police report for a stolen credit card alone. Your bank’s fraud process handles that.

But if you know the person who stole from you, lost more than a trivial amount, or need the report for an insurance claim, file one with your local police department. Bring your IdentityTheft.gov report, a government ID, and proof of your address.

Report to the FBI’s Internet Crime Complaint Center

If the theft happened online, through email, or via a website, file a report at IC3.gov. Additionally, the FBI uses these reports to track patterns and take down larger operations. Your individual report won’t trigger an investigation, but it adds to the pattern.

Set up USPS Informed Delivery

Identity thieves often redirect mail to hide their activity. Notably, Informed Delivery emails you a preview of every piece of mail arriving at your address each day, so you’ll notice immediately if bills, statements, or new cards go missing.

Organize every document you’ve generated today

Create a folder labeled with today’s date, either physical or digital. Inside it goes your written call log, your IdentityTheft.gov report, screenshots of fraudulent charges, confirmation numbers from every freeze and alert, and copies of your credit reports. You will be referring to this folder for months to come.

Tell someone. Eat something. Sleep.

Identity theft is genuinely traumatic, and you’ve just spent a day in crisis mode. Call a trusted friend or family member and tell them what happened. Not for help, just so someone knows. Then make yourself dinner. Go to bed. The cleanup continues tomorrow, but your part of Day One is done. You did it.