What to do if someone stole your identity

Someone opened an account, took a loan, filed a tax return, or ran up a bill in your name. That is identity theft. A fraudulent charge on a card you already carry is the neighbouring problem, and it has its own first call. Use Scammed or fraudulent bank charge for money that left your account. Use this page for new accounts and new debts. The checklist is Someone is using your identity.

In the United States, the official path is IdentityTheft.gov, run by the Federal Trade Commission. The steps below follow that page. If you live somewhere else, skip the bureau steps. Those companies do not hold your file.

Call the company that has the fraud

IdentityTheft.gov says to call the fraud department of each business where you know fraud happened. Tell them your identity was stolen. Ask them to close or freeze the accounts so nobody can add charges unless you agree. Change logins and PINs on accounts that are actually yours.

Look up the number yourself. The number printed on a letter you do not recognise can belong to the person who opened the account. Use a statement you trust, or the company’s site, typed by you.

Write down who you spoke to and when. You will repeat this.

If a US Social Security number or a password leaked and nothing has been opened yet, you are a step earlier. That guide is What to do after a data breach notice. Come back here when an account exists that you did not open.

In the United States, alert the credit bureaus

Place a free fraud alert with one of the three nationwide bureaus. That bureau must tell the other two. The alert lasts one year, and you can renew it. With it on the file, a business has to verify your identity before it issues new credit. IdentityTheft.gov lists:

• Experian, 1-888-397-3742
• TransUnion, 1-888-909-8872
• Equifax, 1-800-685-1111

Then get your reports from AnnualCreditReport.com, or call 1-877-322-8228. The FTC says you can check every week for free. Note every account and enquiry you do not recognise. That list is what you report next.

A credit freeze is the stronger lock, and it is also free. You place it separately at each bureau. It lasts until you lift it. New credit that needs the report stops, including credit you want, until you lift the freeze at the bureau the lender will use. The CFPB says a phone or online request must be placed within one business day, and a mailed request within three business days. A freeze does not change your credit score. A paid credit lock is not more effective. Their explanation is What is a credit freeze?.

You can have an alert, a freeze, or both. The alert tells lenders to verify you. The freeze stops the pull until you say otherwise.

File the Identity Theft Report

Complete the form at IdentityTheft.gov, or call 1-877-438-4338. The site builds an Identity Theft Report and a recovery plan from what you enter. The FTC says that report is what you show businesses, and that it comes with specific rights.

If you create an account, you can update the plan later. If you do not, print or save the report before you leave the page. They say you cannot get back to it afterwards.

A police report is optional. If you file one, IdentityTheft.gov says to bring the FTC report, a government photo ID, proof of address, and the letters or bills you have. Ask for a copy. Some businesses want it. It is not step one.

Close the fake accounts with the report in hand

Call each business again. Ask them to close the account and to send a letter that says the account is not yours, you are not liable, and it will come off your credit report. Keep the letter. They may want the FTC report or their own form before they do it.

Tax, employment, and medical cases are called out on IdentityTheft.gov as special forms of identity theft. A credit freeze does not fix a fraudulent tax return. Say which kind you have when you fill in the form, and follow the branch they give you. We are not inventing an IRS phone tree here.

Outside the United States

Call the companies. Report it to your local police. Use whatever credit-reference or consumer agency your country actually operates, from their own website. The US freeze will not block a loan decision made against a file in another country.

If money moved from your real bank, that call is still the bank, on the number on your card, the same day. Country differences for refunds live in the fraud playbook, not in IdentityTheft.gov.

What finished looks like

Each fake account has a letter. In the US, the latest reports from all three bureaus show no new accounts you do not recognise, and the freeze or the alert is visible. Your email and your phone number are still yours, because this often starts with one of those. If either is shaky, do Personal email account hacked or Phone number stolen in a SIM swap in the same week.

Keep the letters. A closed account can reappear on a report later, and the letter is how you dispute it the second time.

Next, open Someone is using your identity. If you are in the US and you do nothing else after today, place the freezes while the reports are still fresh.

Related playbooks

• Someone is using your identity. Accounts, loans, tax filings, or bills are appearing in your name, and you did not open them.
• You received a data breach notice. A company wrote to say your personal information was exposed. Nothing else has gone wrong yet, and you need to cut off the ways it can.
• Scammed or fraudulent bank charge. Money left your account that you did not authorise, or you were talked into sending it and have just realised.