Identity Theft Recovery: The Step-by-Step Playbook

Discovering that someone has opened accounts in your name produces a specific kind of panic, and the panic tends to produce the wrong first moves — hours on the phone with the wrong departments, promises nobody wrote down, and no documentation of any of it. The recovery process is genuinely manageable, but it runs on a particular sequence and on one document most victims don't know exists: an official identity theft report, which unlocks legal rights an ordinary dispute doesn't have. With it, credit bureaus must block fraudulent information rather than merely investigate it. Without it, you're arguing. This guide is the sequence, in order, from the first hour through the rebuild.

The first 48 hours

Act in this order. The sequence matters because each step makes the next one easier.

1. Freeze your credit at all three bureaus. Free, immediate, and it stops the bleeding — no new accounts can generally be opened while a freeze is in place. Do this before anything else, because everything else takes time and the fraud may be ongoing. The mechanics are in our freeze guide.
2. Change passwords on financial and email accounts, starting with your primary email — it's the recovery channel for everything else, which is why it's the first target in the takeover patterns our account takeover report documents. Enable strong two-factor authentication, preferably app-based or a passkey rather than SMS.
3. Call the fraud department of each affected institution. Not customer service — fraud departments have different authority. Report the account, request closure, and ask what documentation they need.
4. Pull all three credit reports and identify every account, inquiry, and address you don't recognize. You need the complete picture before you start filing anything, because incomplete reporting means doing this twice.
5. Start the log. Date, time, who you spoke to, what was said, and any reference number, for every contact from this moment forward. This single habit is the difference between a recovery that takes weeks and one that takes months.

One thing not to do in the first 48 hours: pay anything on a fraudulent account to "stop the damage." Payment can be read as acknowledgment, and it isn't necessary — you're not liable for accounts you didn't open, and establishing that is what the next steps accomplish.

The identity theft report

This is the document that changes your legal position, and it's free.

Filing a report with the Federal Trade Commission produces an identity theft report and a recovery plan. In some circumstances — particularly if you know the perpetrator, if a creditor or agency requires one, or if criminal identity theft is involved — you should also file a police report and attach the FTC report to it.

What the report unlocks:

• Blocking rights. With an identity theft report, credit bureaus are generally required to block information resulting from identity theft, rather than running the ordinary reinvestigation process where a furnisher can simply verify the item and leave it in place. This is the single most important difference, and it's why the report should come before the disputes.
• Extended fraud alerts lasting several years rather than the shorter initial alert period.
• The right to obtain business records relating to fraudulent transactions — the application, the account records — which helps establish what happened and can support law enforcement.
• Obligations on debt collectors, who must generally stop collection activity on debts you've identified as the product of identity theft and provide information about them.
• The right to demand furnishers stop reporting information they've been notified resulted from identity theft.

Be accurate and complete when filing. The report is a formal statement, and it becomes the foundation of every subsequent letter you send.

Freezes, alerts, and the difference

Tool	What it does	When to use it
Credit freeze	Blocks access to your report, so new accounts generally can't be opened. Free, at each bureau separately, lift temporarily when needed.	Immediately, and as a permanent default afterward
Initial fraud alert	Requires creditors to take extra verification steps; one bureau must notify the others	Alongside a freeze; useful because it propagates automatically
Extended fraud alert	Longer duration, available with an identity theft report	After filing the report
Specialty bureau freezes	Blocks access at account screening, tenant screening, and other agencies	Often overlooked — see our specialty reports guide
Minor freezes	Protects a child's file, which typically has no legitimate activity	If children's information was exposed — a common synthetic identity target

The point most people miss: the big three credit bureaus aren't the only files that matter. Fraudulent bank accounts, rental applications, and check-writing all run through the specialty agencies our reporting analysis covers, and freezing there closes doors that otherwise remain open. Also worth doing: an opt-out from prescreened credit offers, which removes a channel fraudsters use.

Cleaning up fraudulent accounts

Work account by account, in writing, with the identity theft report attached to everything.

1. Notify the creditor in writing. Even after a phone call, send a letter: identify the account, state that it resulted from identity theft, attach the identity theft report, and request written confirmation that the account is closed and that you're not liable. Send it so you have proof of delivery.
2. Request the block from each bureau. With the identity theft report and proof of identity, ask that the fraudulent items be blocked. This is different from a standard dispute and should be labeled as such.
3. Ask creditors to notify the bureaus directly that the account was fraudulent, since source-level correction is what prevents the item from reappearing.
4. Address fraudulent inquiries as well as accounts. Hard inquiries from applications you didn't make should be removed, per the process in our inquiries guide.
5. Check for address changes and personal information you don't recognize on your reports — fraudsters often add an address first, and leaving it in place invites recurrence.
6. Verify across all three bureaus. An item blocked at one may remain at another; each bureau requires its own request, and confirmation at one is not confirmation anywhere else.

If a creditor refuses to accept that the account is fraudulent — which happens — escalate: a complaint to the federal consumer complaint channel compels a documented response, your state attorney general is a parallel lane, and the general escalation ladder in our error dispute guide applies here with the additional weight of the identity theft report behind it.

When fraudulent debt reaches collections

Fraudulent accounts frequently get charged off and sold before the victim even knows they exist — which means a collector may contact you about a debt from an account you never opened, holding nothing but the data file our debt buying analysis describes.

The process:

• Respond in writing immediately, stating the debt resulted from identity theft, attaching the identity theft report, and requesting validation. Do not ignore it — an ignored collection can become a lawsuit and then a judgment, which converts a fraud problem into the garnishment problem.
• Know the obligations you've triggered. A collector notified that a debt is the product of identity theft generally must cease collection activity pending verification and must provide information about the debt, and may not sell or transfer it while the claim is pending.
• Never pay to make it go away. Payment on a fraudulent debt can be treated as acknowledgment and complicates everything afterward.
• If you're sued, appear. Absolutely non-negotiable. A default judgment on a fraudulent debt is enforceable, and unwinding it afterward is far harder than defending it — the guidance in our collections guide applies with extra urgency here.

Other types: tax, benefits, medical, criminal

New-account credit fraud is the most common form, but several others require different channels and are easy to miss.

• Tax identity theft — someone files a return using your information to claim a refund, which you discover when your own return is rejected as a duplicate. Report to the IRS through their identity theft process, file a paper return if necessary, and request an identity protection PIN for future filings. Given the refund dynamics our refund analysis describes, this is a well-populated attack surface each filing season.
• Benefits fraud — unemployment or other benefits claimed in your name, often surfacing as an unexpected tax form for benefits you never received. Report to the issuing state agency and request a corrected form.
• Medical identity theft — someone receives care using your identity, which can corrupt your medical records as well as generate bills. Request records and an accounting of disclosures from providers, and correct the file; this one has safety implications beyond the financial, since incorrect medical information can affect your treatment.
• Criminal identity theft — someone gives your name during an arrest, producing a record in your name. This requires working with law enforcement and courts in the relevant jurisdiction and is the category where legal help is most clearly warranted.
• Synthetic identity fraud — your identifiers combined with fabricated details to create a new "person," per our synthetic identity report. Harder to detect because it may not appear on your file at all, and a common reason to freeze children's files, since unused identifiers are the preferred raw material.

The documentation system

Recovery is a records exercise more than an argument, and victims who set up a system on day one resolve dramatically faster. What to maintain:

• A contact log — date, time, organization, department, person's name, what was said, reference numbers, and what was promised.
• Copies of every letter sent, with proof of delivery. Certified mail with return receipt for anything consequential.
• Every response received, filed by institution.
• Your identity theft report and police report, ready to attach to anything.
• Dated copies of your credit reports at each stage, so you can demonstrate what changed and when — and catch items that reappear.
• A follow-up calendar. Bureaus and furnishers operate on defined timelines; note when a response is due and follow up the day it's late.

Two practical notes. Fraudulent items sometimes reappear after being removed, particularly when a furnisher re-reports through a channel that never got the correction — so re-check all three reports at intervals for at least a year. And you are entitled to help: the FTC's recovery plan generates prefilled letters, many states have identity theft victim assistance programs, and if the fraud is complex, legal aid or a consumer attorney can take over the parts that have stalled.

Rebuilding afterward

Once fraudulent items are blocked, what remains is the file damage and the collateral effects.

1. Verify your file is actually clean across all three bureaus, including inquiries, addresses, and name variants — leftover fraudulent addresses are how recurrence happens, and they also cause the file fragmentation our identity infrastructure analysis describes.
2. Keep the freeze on permanently. Lifting temporarily when you apply for credit is a minor inconvenience against a permanent protection, and there's no reason to leave it off between applications.
3. Rebuild score damage with ordinary mechanics. If legitimate accounts were closed or utilization was distorted during the episode, recovery follows the standard path — on-time payments, low utilization, and time, per our levers guide.
4. Re-establish tradelines if accounts were lost. Some victims close legitimate accounts during cleanup and find their file thinner afterward — thin files price poorly regardless of whether the thinness was someone else's fault.
5. Harden your accounts. Passkeys or authenticator apps rather than SMS, unique passwords in a manager, and heightened attention to the recovery pathways attackers actually use.
6. Monitor deliberately. Free bureau monitoring, account alerts, and periodic report checks. Paid monitoring services can be useful but rarely do anything you can't do free — and none of them prevent fraud, they detect it.

Frequently asked questions

---

This guide is educational and does not constitute legal advice. Identity theft rights and procedures derive from federal and state law and change over time; for complex cases, particularly criminal identity theft, consult a consumer attorney or a legal aid office.