Identity Theft: What to Do in the First 24 Hours

Finding out that a scammer has your Social Security number, bank details or passwords is frightening. The good news: if you’re wondering what to do about identity theft, there are clear, free steps you can take today, and acting fast limits the damage. The FTC says to act quickly because it can help reduce the harm identity theft causes.

If you’ve just been scammed and also lost money, start with our first-hour checklist after a scam, then come back here.

What should you do first if your identity was stolen?

The FTC’s recovery steps start with the places where you already know there’s a problem:

1. Call the companies where fraud happened. Ask for the fraud department, explain that someone stole your identity, and ask them to close or freeze the affected accounts so no new charges can be added without your OK.
2. Change logins, passwords and PINs for those accounts, and for any account that used the same password.
3. Turn on two-factor authentication wherever it’s offered. It requires something more than a password to log in, such as a one-time code.
4. Freeze your credit and place a fraud alert (see below).
5. Report it at IdentityTheft.gov.

How do you freeze your credit?

A credit freeze is the single most powerful step. The FTC explains that while a freeze is in place, nobody can open a new credit account in your name, including you. It’s free to place and lift, it lasts until you lift it, and it doesn’t affect your credit score.

To freeze your credit, contact each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. When you need to apply for credit, a job or an apartment, you can lift the freeze temporarily and then put it back.

A fraud alert is a second layer. It tells businesses to check with you before opening a new account in your name. The FTC says:

• An initial fraud alert is free and lasts one year (and can be renewed). You only need to contact one bureau; it must tell the other two.
• An extended fraud alert lasts seven years. It’s for people who have filed an FTC identity theft report at IdentityTheft.gov or a police report.

You can place a fraud alert even if you already have a freeze.

What is IdentityTheft.gov?

IdentityTheft.gov is the federal government’s official site for reporting and recovering from identity theft, run by the FTC. When you report there, you get a free personal recovery plan with next steps based on what happened. You can report in Spanish at RobodeIdentidad.gov, and the FTC says you can call 877-438-4338 and press 3 to report in another language.

Use only the real site, which you type into your browser yourself. Scammers sometimes set up look-alike pages; see our guide to checking if a website is legit.

What if your information was in a data breach?

A data breach letter doesn’t mean your identity has been stolen yet, but it raises the risk. The FTC says a credit freeze is a good idea for anyone, and even more important if your Social Security number or other information has been exposed in a breach.

After a breach notice:

• Freeze your credit with all three bureaus.
• Change your password for the affected account, and anywhere else you used it.
• Be extra wary of calls, emails and texts about the breach. Scammers use breach news to send phishing messages. See phishing emails and fake websites.

How do you watch for misuse afterward?

Identity theft can show up months later, so keep checking. The FTC suggests:

• Review your credit reports. You can get free reports at AnnualCreditReport.com, and the FTC says the three bureaus let you check your reports once a week for free there. Look for accounts or transactions you don’t recognize.
• Review your bank and card statements. Withdrawals or charges you didn’t make are warning signs.
• Track your bills. If a regular bill stops arriving, someone may have changed your billing address.
• Guard your documents. Keep Social Security and Medicare cards and financial records in a safe place, and shred papers with personal information before you throw them away.

The FTC also lists other ways thieves use stolen information: opening phone or utility accounts, stealing a tax refund, getting a job, getting medical care, or pretending to be you if they’re arrested. If someone uses your Medicare number, see how to protect your Medicare number. For tax-related identity theft, see IRS scams.

If the theft started with a scam call, text or email, report that too. See how to report a phishing email or how to report a scam call.