What to Do Immediately After Identity Theft

If you’ve already confirmed it, a credit card you didn’t open, a tax return that wasn’t yours to file, a charge that turned out not to be a billing error, the questions that matter now aren’t “what is identity theft” or “how do I know.” You’re past that. What matters now is speed, sequence, and knowing which deadline you’re racing against, because more than one clock is running at the same time and they don’t all work the same way. [How to Know If Your Identity Was Stolen]

That last part trips people up more than anything else. A debit card and a credit card have completely different liability rules. Tax fraud and medical fraud don’t get resolved by the same phone call. And the order you do things in, freeze first or alert first, contact the bank first or file the police report first, actually changes how much protection you get. This is the sequence, broken down by exactly what kind of identity theft you’re dealing with.

Fraud Alert vs. Credit Freeze: Get This Right First

Before anything else, you’ll run into a choice that a lot of recovery advice glosses over: should you place a fraud alert, a credit freeze, or both? They’re not the same tool, and picking the wrong one, or picking one and stopping there, leaves a gap.

For	Fraud Alert (Initial)	Fraud Alert (Extended)	Credit Freeze
Who can place it	Anyone who suspects fraud, no proof required	Confirmed victims with a police report or FTC Identity Theft Report	Anyone, no proof required
What it does	Tells lenders to verify your identity before opening credit	Same, but stronger, creditors must contact you personally	Blocks lenders from accessing your credit file at all
How long it lasts	1 year	7 years	Indefinitely, until you lift it
Cost	Free	Free	Free
Bonus	—	Removes you from prescreened credit offers for 5 years; two free credit reports per bureau in the following year	—

The practical answer: if your identity theft is confirmed, do both. File your FTC Identity Theft Report first at IdentityTheft.gov, since that report is what unlocks the extended, 7-year fraud alert. Then freeze your credit at all three bureaus on top of it. A freeze blocks new-account access outright; an extended alert adds a second layer that follows you even if a freeze is temporarily lifted for a legitimate application. 

Neither one substitutes for the other, a freeze without an alert leaves you exposed the moment you unfreeze for something real; an alert without a freeze still allows access, just with an extra verification step a rushed employee might skip.

The Steps That Apply No Matter What Type of Theft This Is

Four things come first regardless of what kind of fraud you’re dealing with, before you branch into the type-specific steps below.

1. Contain what you already know about: Call the specific bank, card issuer, or account provider involved and report the fraud directly. Ask them to freeze or close the account, reverse unauthorized charges, and issue new account numbers or cards. Get a reference number for the call.

2. File your FTC Identity Theft Report: Go to IdentityTheft.gov and file directly, not through a search result, not through a link in a text message claiming to be the FTC. You’ll get a personalized recovery plan and an official report that most creditors and agencies will ask for during disputes.

3. Place the extended fraud alert and a credit freeze: using the report from step 2, per the table above.

4. Document everything from this point forward: Every call gets a date, a name, and a reference number. Every letter gets sent in a form you can prove was received, certified mail with return receipt for anything involving a formal dispute. This isn’t paranoia; disputes that later go to a second review often hinge on exactly this kind of paper trail.

Once those four are done, the next steps depend entirely on which type of identity theft actually happened to you.

If It’s Financial Fraud (Existing Card or New Account)

This is where the liability rules get specific, and where a lot of people accidentally cost themselves money by not knowing the difference between a debit card and a credit card.

Debit card/bank account fraud is governed by Regulation E, and the deadlines are unforgiving and the reporting timelines can affect your potential liability. Under federal rules, if you notify your financial institution within two business days after learning that your access device was lost or stolen, liability is generally limited to the lesser of $50 or the unauthorized transfers before notification. If unauthorized transfers appear on a statement, you generally have 60 days from the statement being sent to notify the institution before additional liability can arise.(CFPB)

• Report within 2 business days of discovering it: your liability caps at $50
• Report within 60 days of your statement being sent: your liability caps at $500
• Report after 60 days: you can be liable for the full amount, with no cap at all

Credit card fraud is different: under federal law, your liability is capped at $50 regardless of when you report it, and in practice, most major card issuers voluntarily waive even that $50 for fraud reported promptly.(CFPB)

The takeaway: if you’re deciding which account to call about first and you’re dealing with both a debit card and a credit card, call about the debit card first. The clock on that one is actively costing you money the longer you wait; the credit card clock effectively isn’t.

For a new account opened in your name: (a card or loan you never applied for): dispute it directly with the creditor, referencing your FTC Identity Theft Report, and separately dispute the entry with each credit bureau reporting it. Under the Fair Credit Reporting Act, bureaus generally have 30 days to investigate a dispute once you file one, if that window passes without resolution, follow up in writing rather than letting it sit.

If It’s Tax Identity Theft

If your e-filed return was rejected as a duplicate, or you got an IRS notice about a return or income you don’t recognize, the process runs through the IRS, not your bank or the credit bureaus.

File IRS Form 14039 (Identity Theft Affidavit) as soon as you suspect fraudulent use of your SSN on a tax return. If you already tried to e-file and it was rejected, you’ll likely need to paper-file your actual return along with the affidavit(IRS). Enroll in the IRS’s Identity Protection PIN program once your case is resolved, so it can’t happen again on a future filing, the six-digit code becomes mandatory on any return filed under your SSN going forward(IP PIN).

Expect this one to take longer than financial fraud. The IRS has historically taken several months to fully resolve identity theft cases involving fraudulent returns, partly because it has to untangle which return is legitimate before releasing your actual refund.

If It’s Medical Identity Theft

Request a copy of your medical records from the provider where the fraudulent care occurred, and specifically flag the entries that aren’t yours in writing, this creates a paper trail distinct from just calling and mentioning it. Contact your insurer’s fraud department to dispute the claim and request that your Explanation of Benefits history be corrected(HHS).

This is the one type of identity theft where “resolved” doesn’t just mean the financial side is fixed, you also want written confirmation that incorrect information (wrong medications, wrong diagnoses, wrong blood type) has actually been removed from your chart, not just that the billing dispute closed. A billing department closing a dispute doesn’t automatically mean the clinical record got corrected too; ask for both separately.

If It’s Criminal Identity Theft

This is the type most people don’t know how to start on, because there’s no bank or bureau to call first. If someone used your name during an arrest or citation, contact the law enforcement agency or court where the incident occurred and request to file a complaint clarifying your identity was used without consent. You may need to be fingerprinted to establish that you’re not the person on the record, this feels backwards, but it’s how the record actually gets corrected.

Ask specifically about getting a certificate of release or similar clearance document from that jurisdiction once it’s resolved, this is what you’ll show a future employer or landlord if the record surfaces again in a background check, since the underlying record doesn’t always disappear cleanly on its own.

If It’s Your Child’s Identity (or a Family Member’s)

Everything above still applies, but the credit bureaus each have a slightly different process for minors, since children generally don’t have an existing credit file to freeze. You’ll typically need to submit proof of the parent-child relationship (birth certificate) along with proof of your own identity to each bureau separately, since there’s no existing file to attach the freeze to automatically(FTC).

What Each Recovery Step Actually Solves, and What It Doesn’t

Action	What It Solves	What It Doesn’t Solve
FTC Identity Theft Report	Gives you documentation creditors and agencies require; unlocks the extended fraud alert	Doesn’t itself remove fraudulent accounts or reverse charges
Credit freeze	Blocks new-account access outright	Does nothing for fraud on accounts you already have
Extended fraud alert	Adds a verification requirement lenders must follow for 7 years	Not a total block, a determined or careless lender can still bypass it
Disputing with the creditor directly	Can reverse the specific fraudulent charge or account	Doesn’t clear your credit report, that’s a separate dispute with the bureau
IRS Form 14039	Starts the process of correcting your tax record	Doesn’t speed up the IRS’s investigation timeline
Police report	Provides documentation some creditors and agencies require	Doesn’t guarantee an investigation or an arrest

None of these steps is optional if it applies to your situation, they solve different, non-overlapping problems, which is exactly why skipping one because “I already did the important one” tends to leave part of the fraud unresolved.

Common Mistakes People Make During Recovery

1. Paying a fraudulent collections account to “make it go away:” Paying it doesn’t remove it from your credit report, and can sometimes be read as acknowledging the debt is legitimately yours. Dispute it first, in writing, before any payment ever changes hands.

2. Closing an account instead of disputing the specific charge: Closing a compromised account can sometimes make it harder to dispute the fraudulent transaction on it after the fact, since some processes are easier to run on an open account. Ask the institution which order they recommend before closing anything yourself.

3. Treating a phone call as the whole process: A phone call gets things started, but verbal confirmations aren’t documentation. Follow every important call with something in writing, an email summary, a formal dispute letter, so there’s a record if the case needs to be escalated later(IRS).

4. Missing the 60-day debit card window because you assumed it worked like a credit card: This is the single most expensive mistake on this list, and it happens because the two liability rules genuinely aren’t intuitive. If you don’t know which type of card was compromised, find out before you decide reporting can wait.

5. Stopping after the first successful step: Freezing your credit feels like the job is done. It isn’t, if the fraud also touched your taxes, your medical records, or an existing account balance. Each type of fraud needs its own resolution path, they don’t clear each other.

FAQs: What to Do Immediately After Identity Theft

Should I Freeze My Credit or Place a Fraud Alert First?

Do both, in that order: file your FTC Identity Theft Report first since it enables the extended fraud alert, then place both the extended alert and a credit freeze at all three bureaus. They solve different problems, and neither replaces the other.

How Long Do I Have to Report Identity Theft Before I Lose Protection?

It depends entirely on what was compromised. Debit card fraud has a hard 2-day window for maximum protection and a 60-day cutoff after which you can lose all protection. Credit card fraud caps your liability at $50 regardless of timing. There’s no single universal deadline, check which type of account was affected.

Conclusion: What to Do Immediately After Identity Theft

Identity theft recovery is not one single task you complete and forget about. It is a sequence of actions, and the right response depends on what was actually compromised. Start by containing the immediate damage, report the theft, protect your credit, and document every interaction. From there, follow the specific recovery process for the affected account, tax records, medical records, or other systems.

The most important thing is **not to wait for every detail to become clear before acting**. If a debit account is involved, reporting time can affect your liability. If a fraudulent account appears on your credit report, dispute it rather than assuming the debt is yours. If your SSN was used for tax fraud, follow the IRS process. And if medical or criminal records are involved, those require separate recovery steps that a credit freeze alone cannot fix.

Knowing what to do immediately after identity theft gives you a much better chance of containing the damage before it spreads. Once the immediate response is underway, continue monitoring your credit, financial accounts, tax records, and other affected systems until you have confirmation that each part of the identity theft has actually been resolved.

What to Do Next

Recovery is only half the picture, once the immediate fraud is contained, the more useful question becomes how to make sure the specific gap that let this happen doesn’t stay open. If you’re not sure which of your exposed information matters most or which protections actually address it, our guide to identity theft basics breaks down the full picture. [What Is Identity Theft? Meaning, Types, and Warning Signs]