How to
Someone stole my identity. What do I do right now?
Key points
- First
- Call the companies where the fraud happened, change your passwords and PINs, and report it at IdentityTheft.gov or 1-877-438-4338.
- Fraud alert
- Free and lasts one year. Contact one credit bureau; it must tell the other two.
- Freeze
- Free to place and lift. Contact each of the three credit bureaus. A phone or online request to lift it must be handled within one hour.
- Block
- With an FTC Identity Theft Report, the credit bureaus must block fraudulent information within 4 business days.
Act right away: call the fraud department of each company where the fraud happened, place a free fraud alert with one credit bureau, and report the theft to the Federal Trade Commission at IdentityTheft.gov or 1-877-438-4338. The FTC gives you an Identity Theft Report and a personal recovery plan.
Your Identity Theft Report proves to businesses that someone stole your identity, and federal law gives you rights that come with it, such as having fraudulent accounts blocked from your credit report. Below: the first steps, what to do in the first week and after, fraud alerts versus credit freezes, how to deal with banks and debt collectors, when you need a police report, and tax, Social Security, medical and child identity theft.
What to do right away
- Call the companies where you know fraud happened. Call the fraud department, explain that someone stole your identity, and ask them to close or freeze the accounts, so no one can add new charges unless you agree.
- Change your logins, passwords and PINs. Do it for your accounts. You might have to contact these companies again after you have your Identity Theft Report.
- Place a free fraud alert. Contact one of the three nationwide credit bureaus. That company must tell the other two. The alert lasts one year, and you can renew it.
- Get your credit reports. They are free from Equifax, Experian and TransUnion at AnnualCreditReport.com or 1-877-322-8228. Note every account or transaction you don't recognize.
- Report it to the FTC. Use IdentityTheft.gov or call 1-877-438-4338, and include as many details as possible. You'll get an Identity Theft Report and a recovery plan. If you don't create an account, print and save both before you leave the page.
- Equifax: Equifax.com/personal/credit-report-services · 800-685-1111
- Experian: Experian.com/help · 888-EXPERIAN (888-397-3742)
- TransUnion: TransUnion.com/credit-help · 888-909-8872
The first day, the first week and the months after
- The first day
Call the fraud departments where the fraud happened and ask them to close or freeze the accounts. Change your logins, passwords and PINs. Place a free fraud alert with one credit bureau and report the theft at IdentityTheft.gov. Save your Identity Theft Report and recovery plan.
- The first week
Get your free credit reports and mark every account or charge you don't recognize. Write to each credit bureau to block the fraudulent items. Ask each business to close accounts opened in your name and remove bogus charges, and to confirm in writing that you aren't responsible. Consider an extended fraud alert or a credit freeze.
- The months after
Check your credit reports often: you can get them free every week at AnnualCreditReport.com. Answer any collection letter in writing within 30 days. A fraud alert ends after one year unless you place another; an extended alert lasts seven years; a freeze stays until you lift it. Keep every letter and your record of calls.
Fraud alert, extended fraud alert or credit freeze?
| Fraud alert | Extended fraud alert | Credit freeze | |
|---|---|---|---|
| Who can get it | Anyone who believes they are, or are about to become, a victim of fraud or identity theft | Identity theft victims with an FTC Identity Theft Report | Anyone. Parents and guardians can place one for a child under 16 |
| What it does | Creditors must take reasonable steps to make sure it's you before opening new credit | A creditor must contact you, in person, by phone or another way you choose, before approving new credit | Stops new creditors from seeing your credit file until you lift it |
| How long it lasts | One year; you can place another | Seven years | Until you lift or remove it |
| Cost | Free | Free | Free to place and to lift |
| How to place it | Contact one bureau; it must tell the other two | Contact one bureau with your Identity Theft Report; it must tell the other two | Contact each of the three bureaus |
| Also | One free credit report from each bureau | Two free reports from each bureau over 12 months, and off prescreened credit and insurance offer lists for 5 years | Doesn't affect your credit scores, and doesn't stop misuse of accounts you already have |
Lifting a freeze. When you apply for credit, ask each bureau that has a freeze to lift it, for good or for a period you choose. It's free. A bureau must lift it within one hour of a request by phone or online, or within three business days of a request by mail.
- Fraud alert. A nationwide credit bureau must keep an initial fraud alert in your file for at least one year and refer it to the other nationwide bureaus.15 U.S.C. § 1681c-1(a)
- Extended alert. With an identity theft report, the alert lasts seven years, and you are left off prescreened offer lists for five years.15 U.S.C. § 1681c-1(b)
- Security freeze. Placed free within one business day of a phone or online request, or three business days by mail, and lifted free within one hour, or three business days by mail.15 U.S.C. § 1681c-1(i)
How to block fraudulent accounts from your credit report
If you have an FTC Identity Theft Report, the credit bureaus must block information that came from identity theft. Once it is blocked, it won't show up on your credit report. Write to each of the three bureaus and send:
- A copy of your FTC Identity Theft Report.
- Proof of your identity, such as your name, address and Social Security number.
- A letter that identifies the fraudulent information and says it does not relate to any transaction you made. IdentityTheft.gov has a sample letter.
- Blocked within 4 business days. A credit bureau must block the information no later than 4 business days after it receives your proof of identity, your identity theft report, the items you identify and your statement.15 U.S.C. § 1681c-2(a)
- The company is told. The bureau must promptly notify the company that supplied the information that it may be the result of identity theft and that a block was requested.15 U.S.C. § 1681c-2(b)
- The debt can't be sold or sent to collection. A company notified through this blocking process that a debt resulted from identity theft may not sell it, transfer it or place it for collection, apart from narrow exceptions.15 U.S.C. § 1681m(f)
- A block can be refused. A bureau may decline or remove a block if it was requested in error or based on a misrepresentation, or if you received goods, services or money from the transaction. It must tell you promptly.15 U.S.C. § 1681c-2(c)
Mail your letters to the addresses the FTC and the CFPB list:
- Equifax: P.O. Box 105069, Atlanta, GA 30348-5069
- Experian: P.O. Box 9554, Allen, TX 75013
- TransUnion: Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19016
When a bank or a debt collector says you owe the money
Call the fraud department of each business where an account was opened in your name. Explain that someone stole your identity and ask it to close the account. Ask for a letter confirming that the account isn't yours, that you aren't liable for it and that it was removed from your credit report, and keep it in case the account shows up again. The business may ask for a copy of your Identity Theft Report or a special dispute form.
If a debt collector contacts you, write to it within 30 days of getting the collection letter. Say that someone stole your identity and you don't owe the debt, and send copies of your Identity Theft Report and any other documents about the theft. Also tell the business where the account was opened that the debt is not yours, and ask it to stop reporting it to the credit bureaus.
- Collection pauses when you dispute. If you dispute the debt in writing within the 30-day period, the collector must stop collecting it until it mails you verification of the debt.15 U.S.C. § 1692g(b)
- The collector must tell the creditor. A collector told that a debt may be fraudulent or the result of identity theft must notify the creditor, and, if you ask, give you the information you would get to dispute the debt.15 U.S.C. § 1681m(g)
- Records about the fraud. A business that dealt with the identity thief must give you, free, copies of the application and transaction records within 30 days of your written request. It can first ask for proof of your identity and of the theft, which can include a police report.15 U.S.C. § 1681g(e)
What to say on the phone
“Our records show you opened this account.”
You can say: “I didn't open or authorize this account. Someone stole my identity. Please close it and send me a letter confirming I'm not responsible.”
“This balance has to be paid today.”
You can say: “This debt is not mine. It's the result of identity theft, and I'm disputing it in writing. Please tell the creditor.”
“How do we know this wasn't you?”
You can ask: “Please send me copies of the application and all the records for this account.”
“Can you confirm your Social Security number and date of birth?”
You can say: “I'll call you back at the number on your company's official website.”
Write down who you talked to, when, and what they said, and follow up in writing. IdentityTheft.gov has free sample letters for businesses, credit bureaus and debt collectors.
Do you need a police report?
Not always, but it can help. The FTC says your Identity Theft Report is enough to resolve issues with the credit bureaus and most companies, and that you'll want a police report if you have information about a suspect or a company asks for one as part of its dispute process. The CFPB suggests reporting to both your local police and IdentityTheft.gov.
Go to your local police office with:
- A copy of your FTC Identity Theft Report.
- A government-issued photo ID.
- Proof of your address, such as a mortgage statement, rental agreement or utility bill.
- Any other proof of the theft, such as bills or IRS notices.
Tell the police someone stole your identity and you need to file a report, and ask for a copy. You may need it for other steps.
Tax, Social Security, medical and child identity theft
| If… | What to do | Good to know |
|---|---|---|
| Someone filed a tax return with your Social Security number, or the IRS wrote to you about it | Follow the instructions in the IRS letter or notice. If it tells you to, use the IRS Identity and Tax Return Verification Service. If the IRS doesn't know about the theft yet, tell it with Form 14039, Identity Theft Affidavit. | Unless the IRS tells you to, don't file Form 14039 if it already sent you a letter or notice, or if you already filed the form, including through IdentityTheft.gov. Keep filing returns and paying tax as usual. An IRS Identity Protection PIN stops others filing with your number. IRS identity theft help: 800-908-4490. |
| Someone is using your Social Security number to work | Review your Social Security work history by creating a my Social Security account, and contact your local Social Security office if you find errors. A W-2 or 1099 from an employer you don't know: don't put that income on your tax return; contact the Social Security Administration. | You can lock your number with E-Verify Self Lock, through a myE-Verify account, so an E-Verify employer can't use it to confirm someone else's work eligibility. Generally, you can't get a new Social Security number without evidence that someone is misusing yours, and a new number likely won't solve all your problems. |
| Someone used your information to get medical care | Get copies of your medical records from each provider and health plan where the thief may have used your information. Report mistakes to the provider in writing with a copy of your Identity Theft Report, and send the report to your health insurer's fraud department. | Federal law gives you the right to know what's in your medical files. If a provider doesn't share your records within 30 days of your written request, you can complain to the U.S. Department of Health and Human Services. Medicare: 1-800-633-4227. |
| Someone used your child's information | Call the company where the fraud happened. Explain that your child is a minor who can't enter into legal contracts, and ask it to close the account and confirm in writing that your child isn't liable. Report it at IdentityTheft.gov. | Generally, children don't have credit reports unless someone is using their information. Ask each bureau for a manual search of your child's Social Security number, and place a free credit freeze for a child under 16. |
Signs someone may be using your identity
- Bills or charges for things you didn't buy.
- Debt collection calls about accounts you didn't open.
- Accounts on your credit report that you didn't open.
- Loan applications that are denied.
- Mail that stops coming or goes missing, or a bill that stops arriving.
- A rejected tax return, an IRS notice about a return you didn't file, or a W-2 or 1099 from an employer you didn't work for.
- A medical bill or Explanation of Benefits for care you didn't get.
Identity theft checklist: what to keep
- Your FTC Identity Theft Report and recovery plan, printed or saved in your IdentityTheft.gov account.
- A record of every call: who you contacted, when, and what they said.
- Copies of every letter you send, and proof of when you sent it, such as a certified mail receipt.
- Letters from businesses confirming a fraudulent account isn't yours and you aren't liable for it.
- Your credit reports, with every account or charge you don't recognize marked.
- The credit bureaus' confirmation letters for your fraud alert or freeze.
- A copy of the police report, if you filed one.
- Any IRS letters or notices about the theft.
Can I handle this on my own, or do I need a lawyer?
You can take these steps yourself: reporting at IdentityTheft.gov, fraud alerts and credit freezes are free, and IdentityTheft.gov gives you a recovery plan and sample letters. IdentityTheft.gov suggests considering a lawyer if someone is arrested or prosecuted under your name, or if a bankruptcy is filed in your name. If you have a problem with a credit bureau, you can submit a complaint to the Consumer Financial Protection Bureau.
Common questions
How long does a fraud alert last?
An initial fraud alert lasts one year, and you can place another when it ends. An extended fraud alert, for identity theft victims with an FTC Identity Theft Report, lasts seven years. For either one, contact one credit bureau; it must tell the other two.
Does a credit freeze cost money, and how do I lift it?
No. Freezing and unfreezing is free at Equifax, Experian and TransUnion, but you must contact each one. A bureau must lift a freeze within one hour of a phone or online request, or three business days after a request by mail, and you can lift it for a period you choose.
Do I need a police report for identity theft?
Not always. The FTC says your Identity Theft Report is enough for the credit bureaus and most companies, but file a report with your local police if you have information about a suspect or a company asks for one. The CFPB suggests reporting to both.
How fast must a credit bureau remove fraudulent accounts?
If you send your FTC Identity Theft Report, proof of identity and a letter identifying the fraudulent information, the bureau must block it within 4 business days and tell the company that reported it.
What should I do if someone filed a tax return in my name?
Follow the instructions in the IRS letter or notice. If the IRS doesn't know about it yet, tell it with Form 14039, Identity Theft Affidavit; don't file the form if the IRS already wrote to you or you filed it through IdentityTheft.gov. Keep filing your returns and paying tax as usual.
Can I get a new Social Security number after identity theft?
Generally not without evidence that someone is misusing your number. And a new number likely won't solve all your problems, because companies and government agencies will still have records linking you to your old number.
Official sources
- FTC IdentityTheft.gov: Recovery steps identitytheft.gov
- FTC IdentityTheft.gov: Know your rights identitytheft.gov
- FTC IdentityTheft.gov: Credit bureau contacts identitytheft.gov
- FTC IdentityTheft.gov: Identity theft letter to a debt collector identitytheft.gov
- FTC: Identity Theft, A Recovery Plan (PDF) ftc.gov
- FTC: Credit freezes and fraud alerts ftc.gov
- FTC: What to know about medical identity theft ftc.gov
- FTC: How to protect your child from identity theft ftc.gov
- CFPB: What do I do if I am a victim of identity theft? consumerfinance.gov
- CFPB: What is a credit freeze or security freeze? consumerfinance.gov
- CFPB: A debt collector contacts me about a debt I don't think I owe consumerfinance.gov
- IRS: Identity theft guide for individuals irs.gov
- IRS: Get an identity protection PIN irs.gov
- E-Verify: Self Lock e-verify.gov
- USAGov: Identity theft usa.gov
- 15 U.S.C. § 1681c-1: Fraud alerts and security freezes govinfo.gov
- 15 U.S.C. § 1681c-2 (FCRA § 605B): Block of information resulting from identity theft govinfo.gov
- 15 U.S.C. § 1681g(e): Records available to identity theft victims govinfo.gov
- 15 U.S.C. § 1681m(f)-(g): Identity theft debts and debt collectors govinfo.gov
- 15 U.S.C. § 1692g: Validation of debts govinfo.gov
Related
This page explains the law in general terms. It is not legal advice about your situation. Justice is not a law firm and is not affiliated with any court or government agency.