What to Do When Your Identity is Stolen (2026 Checklist)

You check your mail and find a welcome letter for a credit card you never applied for. Or worse, you check your bank account and see a $500 charge at an electronics store halfway across the country.

Identity theft is violating, terrifying, and unfortunately, extremely common. In 2026, data breaches are a weekly occurrence, meaning your Social Security Number is likely already floating around the dark web.

If you suspect your identity has been stolen, you must act within the first 24 hours to prevent thousands of dollars in fraudulent debt from ruining your credit score. Here is the exact checklist to lock down your life.

---

Step 1: Call the Fraud Department Immediately

If you see a fraudulent charge on an existing account (like your debit card) or receive a letter for a new account you didn't open, call the company immediately.

• Tell them: "This is a fraudulent charge/account. I am a victim of identity theft."
• Have them freeze or completely close the account.
• Ask them to change your login passwords and PINs.

By law, you are not responsible for fraudulent charges on a credit card (your liability is capped at $50, but almost all banks waive even that). For debit cards, you must report the fraud within two business days to cap your liability at $50.

---

Step 2: Place a Fraud Alert on Your Credit Reports

A fraud alert tells lenders that they must take extra steps to verify your identity before opening any new accounts in your name.

You only need to contact one of the three major credit bureaus (Equifax, Experian, or TransUnion). By law, the bureau you contact must notify the other two.

• Initial Fraud Alert: Lasts for 1 year.
• Extended Fraud Alert: If you have an identity theft report (see Step 4), you can upgrade this alert to last for 7 years.

Note: A fraud alert does not stop you from using your current credit cards; it only makes it harder to open new ones.

---

Step 3: Check Your Credit Reports for Other Damage

Once the fraud alert is placed, go to AnnualCreditReport.com and pull all three of your credit reports.

You are looking for the collateral damage:

• Inquiries from auto dealerships or banks you didn't visit.
• Unknown addresses or phone numbers listed under your personal information.
• New credit cards or personal loans that you did not authorize.

Write down every single piece of fraudulent information you find. You will need it for the next step.

---

Step 4: File an Identity Theft Report (Crucial)

To legally force credit bureaus and banks to delete fraudulent accounts, you need an official paper trail. You must create an Identity Theft Report.

1. Go to IdentityTheft.gov (the federal government's official site run by the FTC).
2. Fill out the details of the theft. The site will generate an official FTC Identity Theft Affidavit.
3. Print the Affidavit.
4. Call your local police department's non-emergency line. Tell them you need to file a report for identity theft and that you have an FTC Affidavit. (Some police departments will tell you they can't do anything; insist on filing the report simply to have the official police record).

Your FTC Affidavit combined with the Police Report creates your official "Identity Theft Report." This document is your golden ticket to repairing your credit.

---

Step 5: Freeze Your Credit

A fraud alert asks lenders to be careful; a Credit Freeze legally locks your credit report in a vault.

If your credit is frozen, no one (not even you) can open a new credit card or loan because the lender cannot access your FICO score. It is the strongest protection against identity theft.

Unlike a fraud alert, you must contact each of the three bureaus separately to place a freeze. It is 100% free by federal law. When you need to apply for a loan later, you simply log into the bureau's app and "thaw" your credit for 24 hours.

---

Step 6: Dispute the Fraudulent Accounts

Now that the bleeding has stopped, it is time to clean up the mess.

Send a physical letter (via Certified Mail) to the credit bureaus and the specific companies where the fraudulent accounts were opened.

• Include a copy of your Identity Theft Report (the FTC Affidavit and Police Report).
• List the specific accounts and inquiries that are fraudulent.
• State clearly: "Under the FCRA, I demand you block and remove this fraudulent information from my credit file immediately."

Under federal law, if you provide a valid Identity Theft Report, the credit bureaus must block the fraudulent information from appearing on your report within 4 business days.

---

First 24 Hours: Hour-by-Hour Breakdown

The first day after discovering identity theft is the most important. Here is a practical, hour-by-hour breakdown of what to do.

Hour 1 ' Contain the damage. If you spot a fraudulent charge on a card, call the issuer immediately and have them freeze or close the account. Change your online banking password and PIN right now ' not after dinner, now. If a new account was opened in your name, call that creditor's fraud department, tell them the account is fraudulent, and ask them to close it. Write down every representative's name, the time of the call, and what they said.

Hour 2 ' Place a fraud alert. Contact one bureau (Equifax, Experian, or TransUnion) and place an initial fraud alert. By law, they must notify the other two within one business day. While you're at it, request your free credit reports from AnnualCreditReport.com ' you need to see the full picture of what's been opened or inquired in your name.

Hour 3 ' Review your credit reports line by line. Look for accounts you don't recognize, addresses where you've never lived, and inquiries from lenders you didn't contact. Take screenshots and notes. You'll need this list when filing your Identity Theft Report.

Hour 4 ' Freeze your credit with all three bureaus. A fraud alert is helpful, but a credit freeze is the real lock. You need to contact Equifax, Experian, and TransUnion separately to place a freeze. Do it online or by phone ' it's free and takes about 15 minutes per bureau.

Hour 5 ' File your Identity Theft Report. Go to IdentityTheft.gov and fill out the FTC Identity Theft Affidavit. Print it. Then call your local police department's non-emergency line to file a police report. You now have the two documents needed to dispute fraudulent accounts and force removal.

Hour 6 ' Contact any other affected institutions. Check your bank accounts, insurance policies, and any other financial accounts for unauthorized activity. If your Social Security number may have been compromised, consider creating an account at SSA.gov to prevent someone else from filing a tax return in your name.

Evening ' Secure your digital life. Change passwords on your email, banking, and any financial accounts. Enable two-factor authentication wherever possible. If your phone was involved (SIM swap fraud), contact your carrier immediately.

Before bed ' Make a plan for tomorrow. You'll need to send dispute letters by certified mail to the credit bureaus and any company where fraudulent accounts were opened. Draft those letters tonight using your Identity Theft Report as documentation. Tomorrow, send them.

Tax Identity Theft

Tax identity theft happens when someone files a fraudulent tax return using your Social Security number to claim your refund. By the time you file your own return, the IRS has already processed one ' and rejects yours.

Signs of tax identity theft:

• The IRS sends you a notice saying more than one return was filed with your SSN.
• You receive a tax transcript you didn't request.
• You're told online that your e-file was rejected because of a duplicate return.
• You receive IRS income information from an employer you didn't work for.

Immediate steps:

1. File IRS Form 14039 (Identity Theft Affidavit) with your paper tax return if your e-file was rejected.
2. Respond to any IRS notice within the timeframe specified ' usually 30 days.
3. Request an IRS Identity Protection PIN (IP PIN) at irs.gov/ippin. This six-digit number prevents anyone else from filing a return with your SSN. You'll need to enter it each year when you file. Once you opt in, you must use the IP PIN every year ' you cannot skip it.
4. Report the theft to the FTC at IdentityTheft.gov.
5. Check your credit reports for any other fraud ' tax identity theft often accompanies broader financial identity theft.

Prevention: The IP PIN is the single most effective tool. Even if you're not currently a victim, you can voluntarily opt in at irs.gov/ippin. The IRS will issue you a new PIN each year, delivered through their online portal or by mail. Without the PIN, no one can e-file a return using your SSN.

Medical Identity Theft

Medical identity theft occurs when someone uses your health insurance information or personal details to receive medical services. It's dangerous beyond the financial impact ' incorrect medical information in your records can affect treatment decisions, insurance coverage, and even your eligibility for life insurance.

How to detect it:

• You receive a bill for medical services you didn't use.
• Your health insuranceExplanation of Benefits shows services you never received.
• You're denied coverage because your records show a condition you don't have.
• You find unknown medical providers, diagnoses, or prescriptions in your records.
• You receive a call from a debt collector about a medical bill you don't recognize.

Steps to fix it:

1. Contact your health insurer and report the suspected fraud. Ask for a full accounting of claims filed under your policy.
2. Request your medical records from every provider you've used. Under HIPAA, you have the right to access your records and request corrections. Review them for entries that aren't yours.
3. Send a written dispute to each provider with incorrect information. Include your identity theft report and specify which entries are fraudulent. Ask them to flag your file to prevent further unauthorized access.
4. Request an accounting of disclosures from your insurer and providers. This is a HIPAA right ' they must provide a record of who has accessed your health information.
5. File a complaint with the HHS Office for Civil Rights if a provider refuses to correct your records.
6. Update your insurance ID card and change any online portal passwords for your health insurance account.

Medical identity theft can go undetected for months or years because people don't regularly review their medical records. Set an annual reminder to request and review your records, especially after receiving care at a new provider.

Protecting Your Children's Credit

Children are attractive targets for identity theft because they typically have clean credit files that won't be monitored for years. By the time they apply for their first credit card or student loan, the fraud may have been running undetected for a decade.

How to check if your child's SSN has been compromised:

1. Visit AnnualCreditReport.com and attempt to pull a credit report for your child using their SSN and date of birth.
2. If a report exists, your child's SSN has been used to open accounts ' that's fraud.
3. If no report exists, that's the expected result for a child with no credit history, and you should take preventive steps now.

How to freeze a minor's credit: Each bureau has its own process for placing a credit freeze on a minor's report. Unlike adults, minors may not have an existing report, so some bureaus will create one specifically to freeze it.

• Equifax: Submit a request online or by mail with the child's SSN, birth certificate or Social Security card, and proof of your identity as the parent or guardian.
• Experian: Submit a written request with the child's SSN, proof of your identity, and proof of your authority (such as a birth certificate or court order).
• TransUnion: Submit a written request with the child's SSN, proof of your identity, and proof of your authority.

Some bureaus process minor freezes immediately; others may take several weeks. Keep confirmation of each freeze in a secure location.

Additional protective steps:

• Do not share your child's SSN unless absolutely required (school enrollment, medical care, tax filing). Ask why it's needed and how it will be protected.
• Shred documents containing your child's SSN before discarding them.
• Check your child's credit report annually starting when they're around 10'12 years old, or earlier if you suspect compromise.
• When your child turns 18, help them freeze their own credit immediately, even if they have no plans to borrow.

The Ongoing Defense

Identity theft is rarely a one-time event. Once your SSN is compromised, scammers may try to use it again years later. Keep your credit frozen permanently, only thawing it when you explicitly need to apply for a loan. Review your credit reports annually, and change your banking passwords every six months to keep the thieves locked out.

Sources and further reading

• FTC: identity theft recovery
• CFPB: credit reports and fraud alerts
• AnnualCreditReport.com

Reviewed September 2026. This article is general education, not individualized financial or legal advice.