Identity Theft Recovery: A Step-by-Step Action Plan
Key takeaways
- Contact the fraud department of each affected company through a trusted website, app or statement.
- Secure compromised accounts and the email account used to recover them.
- US credit freezes and fraud alerts serve different purposes. A freeze does not secure an existing bank account.
- Keep a private recovery log, dispute fraudulent records and follow the official process where you live.
1. Confirm what happened and stop ongoing harm
Identity theft means someone is using your personal information without permission, for example to open an account, obtain a service or make a financial transaction. A breach notice or unfamiliar marketing message alone does not establish that this has happened.
If you find an account or charge you do not recognise, contact the provider's fraud department using its official app, website or the number on a statement. Explain what you found and ask how to block further use, dispute the activity and secure the affected account. If money is moving, make your bank the first call. Do not wait until every possible problem has been investigated.
- Save the date, account name and relevant notice or transaction reference.
- Ask whether a compromised card, account or login needs to be blocked or replaced.
- Request a case reference and written confirmation of the next steps.
2. Secure email, logins and recovery access
Use a trusted device to change compromised passwords and passwords reused on other accounts. Start with email because access to your inbox can be used to reset other logins. Use a different password for every service and enable multifactor authentication or a passkey where the provider supports it.
Review recovery email addresses, phone numbers, connected apps and active sessions. Remove unfamiliar access and check email forwarding rules. If you cannot sign in, use the provider's official account-recovery process. Never give a caller a one-time code or approve a sign-in request you did not initiate.
3. Report identity theft using the right local process
In the United States, IdentityTheft.gov helps you create an FTC Identity Theft Report and a recovery plan based on what happened. Save the report and follow the plan's instructions for the affected organisations. A report records your account of the incident; it does not automatically close fraudulent accounts or guarantee a refund.
Outside the US, use your country's official fraud-reporting and consumer-protection guidance, alongside the affected institution's process. In the UK, the NCSC directs victims who have lost money to their bank and Report Fraud, with separate police reporting in Scotland. Do not assume that US credit-freeze rules apply in another country. If an identity document was misused, also consult its issuing authority.
4. Protect your credit file, where applicable
For US consumers, a free credit freeze restricts access to your credit report and can help prevent new-credit fraud. Contact Equifax, Experian and TransUnion separately to freeze each report. You may need to lift a freeze temporarily when applying for credit. It does not change your credit score or stop misuse of an existing account.
A US fraud alert asks lenders to verify your identity before opening new credit. An initial alert lasts one year and can be renewed. Contact one of the three bureaus to place it; that bureau must notify the other two. Review your credit reports for accounts and enquiries you do not recognise, and follow the bureau's dispute instructions.
5. Dispute fraudulent records and track each case
Contact every organisation holding an account, charge or record you believe is fraudulent. Ask what evidence it needs and how to submit a dispute securely. Keep copies of your reports and correspondence, but send identity documents only through a verified channel when required.
For each case, record the organisation, reference number, action taken, response date and next follow-up. Ask for confirmation when an account is closed or a record is corrected. Recovery times and dispute rules depend on the institution, country and type of harm, so do not treat a single deadline as universal.
6. Keep checking and separate recovery from privacy cleanup
Continue checking financial statements, security notices and relevant credit reports. Return to the provider if a new problem appears. Medical, tax, benefits or child identity misuse may require a specialist process through the relevant organisation rather than a general credit dispute.
Public-profile removal is a separate privacy task. It can limit what people find on broker websites, but it does not recover stolen money, repair a credit file, remove criminal copies of breached data or replace the account and reporting steps above.
What should a useful recovery record contain?
Keep a private list of affected accounts, evidence, case references and next steps. An account reference and a description of the problem are usually more useful for your own log than a full card number or an image of an identity document. Do not post the evidence publicly.
Use a separate entry for each organisation. Record what you asked it to do, what it agreed to do and when to check back. This helps distinguish a report being received from a fraudulent account actually being closed or a record being corrected.
Why is there no single identity-theft recovery deadline?
Recovery depends on the harm, the number of affected organisations and their dispute processes. Ask each provider about its deadlines and escalation options rather than assuming that a general blog timeframe applies to your case.
At a glance
| Issue | Primary contact | Supporting action |
|---|---|---|
| Unauthorized financial account | Bank or creditor | Document dispute and secure login |
| Compromised online account | Service provider | Reset credential and recovery controls |
| Identity misuse in US | IdentityTheft.gov | Follow tailored recovery steps |
| Public broker listing | Profile operator | Separate opt-out and verification |
Organize identity-theft recovery
- Verify the suspicious activity with the affected institution.
- Secure accounts and change exposed or reused credentials.
- Report US identity theft through IdentityTheft.gov when applicable.
- Contact bureaus or creditors about credit-file concerns.
- Keep a private log and handle broker exposure as a separate task.
Frequently asked questions
What should I do first if my identity is stolen?
Contact the fraud department of the affected company using a trusted route. If money is moving, contact your bank promptly. Secure compromised access, document what happened and use the official reporting process where you live.
Do I need to pay for an identity-theft recovery plan?
In the US, IdentityTheft.gov provides an FTC report and recovery plan for free. That does not guarantee reimbursement or replace the dispute process of a bank, creditor or other affected organisation.
What is the difference between a credit freeze and a fraud alert?
For US consumers, a freeze restricts access to a credit report and is placed separately at each nationwide bureau. A fraud alert asks lenders to verify your identity; contact one bureau, which must notify the other two. Neither secures an existing bank account.
Does a data breach mean my identity has been stolen?
Not necessarily. A breach means information was exposed or accessed without authorisation. Identity theft means someone is using your information without permission. Respond to the exposed data, and report confirmed misuse through the appropriate process.
Can removing broker profiles reverse identity theft?
No. Broker-profile removal is a separate public-privacy measure. It does not recover money, correct a credit file or replace official reporting and account-recovery procedures.
Sources
Related privacy guides
- what to do after a data breach
If you have an exposure notice but no confirmed misuse, start with the breach-response checklist.
- warning signs of identity theft
Understand the account and record changes that may need verification.
- protecting family data online
Review household privacy after dealing with urgent recovery steps.
- data-broker opt-out guides
Handle publicly searchable profiles as a separate privacy task.
More on Consumer Protection
- How Exposed Personal Data Leads to Identity Theft
The connection between data brokers and identity theft is well-documented. When your name, address, phone number, and email are freely available online, criminals can piece together enough information to open accounts in your name. Learn how removing your data dramatically reduces your risk.
- The Ultimate Social Media Privacy Settings Guide for 2026
Every major social platform collects far more data than you realize. This comprehensive guide walks through the privacy settings for Facebook, Instagram, TikTok, LinkedIn, and X to lock down your accounts.
- VPNs Don't Protect Your Privacy the Way You Think They Do
While VPNs encrypt your traffic, they don't remove your personal information from data broker databases. Many people think they're protected but their names, addresses, and phone numbers are still publicly searchable.
About the author
Consumer Protection Reporter. Amara reports on consumer-facing privacy risks, scams, unwanted contact, and the steps people can take to protect their identity and personal information.