The first hour after you confirm identity theft is the worst, because it feels like everything is on fire at once and you do not know where to point the hose. Take a breath. Recovery is not about doing everything; it is about doing a handful of things in the right order.
This checklist gives you that order. Work top to bottom, tick each box, and the panic gives way to a plan you can actually finish.
Key takeaways
- Recovery follows a clear sequence: contain the damage, report it officially, then repair your accounts and credit.
- Freezing your credit is the single most important first move, and it is free.
- An official report from the government and the police gives you legal weight to dispute fraudulent debts.
- Keep a written log of every call, name, and reference number; it saves hours later.
- Most fraudulent charges and accounts can be reversed when you report them promptly and in writing.
Before you start: set up your paper trail
Recovery involves a lot of phone calls, and memory fails under stress. Open a notebook or a document and use it for every step that follows.
For each contact, write the date, the company, the person’s name, what they told you, and any reference or case number. This log is what lets you say, three weeks later, “On the fourteenth I spoke to Maria, case number 88213, and she confirmed the account was closed.” That specificity gets things fixed.
Step 1: Contain the damage
Your first goal is to stop the bleeding, so a thief cannot open more accounts or drain existing ones while you work.
Freeze your credit at all three major bureaus right away. A freeze blocks anyone, including the thief, from opening new credit in your name, and it is free to place and lift. Our guide to freezing your credit to block fraud walks through each bureau, and it is genuinely the highest-value thing you can do in the first hour.
Next, change the passwords on your most important accounts, starting with your email, since email resets can open everything else. Turn on two-factor authentication anywhere it is offered, and check that your recovery phone and email have not been quietly changed to a stranger’s.
Do not simply reuse a password you changed elsewhere. If the thief got in through a reused password, changing one account to match another just hands them a second door. Give each critical account its own unique password.
Step 2: Make it official
Reporting the theft is not a formality. The official reports you generate give you the standing to erase fraudulent debts and accounts.
File a report with the authorities
In the United States, start at identitytheft.gov, the official government service. It walks you through the specifics of your case and generates a personalized recovery plan plus an official Identity Theft Report you can send to creditors.
Then file a report with your local police, especially if you know the thief or a company asks for one. Bring your government report, a photo ID, and your evidence. Ask for a copy of the police report and its number for your log.
Place a fraud alert too
Separately from a freeze, you can place a free fraud alert with the bureaus, which tells lenders to take extra steps to verify identity before granting credit. It is a useful second layer while you sort everything out.
Step 3: Repair your accounts and credit
With the damage contained and reports in hand, you can start reversing what the thief did. This is where your log earns its keep.
| What was hit | Who to contact | What to ask for |
|---|---|---|
| Fraudulent charges on your card | Your card issuer’s fraud line | Reversal of the charges and a new card number. |
| A new account opened in your name | The company that opened it | Closure of the account and removal from your record, using your Identity Theft Report. |
| Wrong entries on your credit file | Each credit bureau | Removal of fraudulent accounts and inquiries as a dispute. |
| A drained bank account | Your bank’s fraud department | Reversal of transfers and a fresh account number. |
| Stolen tax refund | The tax authority | An identity-theft affidavit and a protective PIN for next year. |
Contact each company by phone to get moving fast, then follow up in writing. A written dispute, sent with a copy of your Identity Theft Report, creates the record that forces action and protects you if the debt resurfaces later.
Send important disputes by a method that proves delivery, and keep a copy of everything you send. When I helped a neighbor through this, the certified-mail receipts were what finally got a stubborn lender to drop a fraudulent loan they kept “having no record of.”
Step 4: Watch for aftershocks
Identity theft has a long tail. A thief may have your details stashed and try again months later, or a debt you thought was cleared can reappear.
Keep monitoring your credit for new accounts and inquiries, which you can do for free. Our guide to monitoring your credit without paying shows how, and it pairs well with knowing the early signs of identity theft so a second attempt does not catch you off guard.
Keep your credit frozen until you have a specific reason to lift it, such as applying for a loan. A freeze that stays on quietly does its job for years, and you can thaw it temporarily whenever you need.
Recovery can take weeks, and that is normal, not a sign you are doing it wrong. The steps here connect to the wider plan in our overview of protecting your money and identity online, which helps you rebuild stronger habits once the fire is out.
Your afternoon checklist
- Start a written log for every call, name, date, and reference number.
- Freeze your credit at all three bureaus before doing anything else.
- Change your email password first, then your other critical account passwords, each one unique.
- Turn on two-factor authentication and confirm your recovery contacts are still yours.
- File your report at identitytheft.gov and save the Identity Theft Report it generates.
- File a police report if you know the thief or a company requests one.
- Call each affected company’s fraud line, then follow up every dispute in writing.
- Keep your credit frozen and keep monitoring for new accounts in the months ahead.
Nobody feels ready for this, and you do not need to be. Follow the sequence, keep your log, and you will be surprised how much of the damage simply reverses once the right reports are on file. The fire feels enormous in hour one and manageable by day three.
