How to report identity theft: A step-by-step guide

Discovering that someone’s stolen your identity can feel overwhelming, like your whole life’s been turned upside down overnight. But you don’t have to face it alone, and you can take back control. The sooner you act, the easier it is to limit the damage and protect yourself from further harm.

In this guide, we’ll walk you through exactly how to report identity theft step by step, so you know what to do, who to contact, and how to start putting things right.

Please note: This information is for general educational purposes and not financial or legal advice.

How do I check to see if someone is using my identity?

Identity theft often leaves a trail of red flags. Here are some common signs to watch for:

• Suspicious charges or subscriptions: If you spot purchases you didn’t make or services you never signed up for on your credit card statement, someone may be using your payment details.
• Changes to your personal information: A thief might update the address, phone number, or email on your accounts to reroute mail, deliveries, and important notices.
• Missing or delayed bills: When statements stop arriving, it could mean they’re being stolen from your mailbox or redirected elsewhere.
• New credit activity you don’t recognize: This includes unfamiliar accounts, hard credit checks, or loans taken out in your name.
• Strange calls from creditors: Legitimate creditors may call or email you about approval (or denial) for credit that you didn’t authorize.
• Calls about debts you don’t owe: Creditors or debt collectors might contact you about overdue accounts that you never opened.
• Unexpected medical bills: Some thieves use stolen insurance details to get treatments or prescriptions, leaving you with the charges.
• Strange tax notifications: The IRS may flag unpaid taxes tied to your identity or reject your return because one has already been filed in your name. Find out more details in our comprehensive tax identity theft report.
• Sudden drops in your credit score: Fraudulent loans or missed payments under your name can quickly drag your score down.

What evidence should you prepare before reporting identity theft?

If you suspect (or have already confirmed) that your identity’s been stolen, the next step is to gather solid evidence. This will make it easier for authorities, banks, and credit agencies to act quickly, and it can help limit the fallout.

Here’s what to collect:

• Details of impacted accounts: Go through all your accounts (bank, credit cards, loans, insurance, etc.) and note which ones show suspicious activity. Write down every fraudulent transaction, along with dates, merchant names, amounts, and any other details.
• List of compromised personal data: Identify exactly what information was stolen, such as your driver’s license, Social Security number (SSN), bank account details, or insurance information.
• Relevant physical documents: Keep any official letters or notices, like IRS mail about duplicate tax returns or unpaid taxes.
• Medical records: If someone used your identity for medical services or prescriptions, request copies of your legitimate medical records to help separate real activity from fraud.
• Credit reports: Request your reports from Experian, TransUnion, and Equifax, and review them for suspicious accounts, unfamiliar addresses, or unusual activity. Highlight anything that looks off.

What is the process of reporting identity theft?

Once you’ve gathered your documents and evidence, don’t wait; report the theft as soon as possible to the right organizations. Acting quickly can help stop further damage and make recovery easier.

1. Notify the relevant company or agency

Identity thieves can do a lot with stolen information: make purchases, claim tax benefits, use your medical insurance, or even work under your name. Who you contact first depends on the type of identity fraud:

• Social Security Administration (SSA): Contact the SSA if your SSN has been stolen and used for work or synthetic identity theft.
• Department of Motor Vehicles (DMV): Notify your state DMV if your driver’s license or any other state-issued ID has been compromised.
• Internal Revenue Service (IRS): Let the IRS know if your identity was used to file fraudulent tax returns or work for another employer.
• The United States Postal Service (USPS): Report it if you suspect your mail is being stolen.
• Healthcare providers and insurers: Contact them if someone used your insurance for medical procedures, prescriptions, or benefits.
• Financial institutions: Inform your bank and other financial service providers if your details are being used for fraudulent transactions.

Note: Some agencies (like the DMV) may require you to provide a police report to verify your claim. We’ll cover how to get one later in this guide.

2. Place a fraud alert or credit freeze

Fraud alerts and credit freezes work in slightly different ways, but they share the same goal: stopping identity thieves from opening new accounts in your name.

• Fraud alert: Lets creditors know that your identity has been stolen, so they must take extra steps to verify it before approving new credit or services.
• Credit freeze: Blocks new creditors from accessing your credit report entirely, which usually results in new applications being denied.

Both are free to set up, but the process works a little differently. For a fraud alert, you only need to contact one credit bureau (such as TransUnion), and they’ll notify the other two on your behalf. A credit freeze, on the other hand, must be requested separately with all three major credit bureaus: TransUnion, Equifax, and Experian.

Tip: If you plan to apply for new credit later, remember to temporarily lift the freeze first. Otherwise, your application could be rejected because the lender can’t access your report.

3. Report to the FTC or your national agency

If you’re in the United States, you can report identity theft directly to the Federal Trade Commission (FTC). Filing this report is an important step, as:

• It may be required when filing a police report.
• It can strengthen your case when disputing fraudulent transactions.
• It gives you access to a personalized recovery plan from the FTC.

If you live outside the U.S., look for your country’s equivalent consumer protection or fraud reporting agency to file an identity theft report.

4. File a police report

Reporting identity theft at your local police station helps the police track local criminals and protect others in your community from similar scams and online fraud. Likewise, this gives you another official record (alongside the FTC report) that can be invaluable when dealing with credit unions, lenders, banks, and even legal proceedings.

When going to file a police report for identity theft, bring the evidence you collected, your government-issued ID, proof of address, and a copy of your FTC report. Share every detail you have, even if it seems small. Sometimes the smallest clues are the most useful. Once the report is filed, ask for a copy for your own records.

Learn more: Find out what someone can do with a stolen SSN and why it’s a serious problem.

How to report identity theft to credit bureaus

Reporting credit fraud to the major credit bureaus is an essential step in protecting your accounts and stopping further misuse of your information. It also gives you the chance to dispute any fraudulent accounts or transactions listed on your credit report.

The process for reporting credit fraud can vary slightly depending on the bureau, so make sure to follow each one’s specific guidelines.

How to protect yourself after reporting identity theft

Once you’ve reported the identity theft to the right authorities, it’s important to take extra steps to limit the damage and prevent it from happening again.

Dispute fraudulent charges

Contact the fraud departments of any financial institution, creditor, or other organization where your stolen information has been misused. This could include:

• Credit card companies for unauthorized purchases and other financial fraud,
• Phone carriers for accounts opened in your name.
• Airlines and supermarkets if loyalty points were redeemed without your consent.

When you make these disputes, provide copies of your FTC report and police report. Having these official records can speed up the process. Also, ask each organization to confirm in writing that they’re investigating your case, and keep those confirmations as part of your documentation.

Change passwords and enable MFA

If identity theft involves your financial accounts or other sensitive online accounts, changing your passwords right away is critical. Make sure to replace any reused passwords, too; otherwise, the thief could use the same login details to break into your other accounts in a tactic called credential stuffing.

Whenever possible, switch to passkeys for added protection. And don’t skip multi-factor authentication (MFA), which ensures that even if someone has your login credentials, they still need an extra factor (like a one-time password, biometric scan, or authentication app) to get in.

Monitor your accounts regularly

Sadly, once your information is exposed, cybercriminals may try to use it in many ways: opening new accounts in your name, changing your address, or even selling your details on the dark web. Keeping watch is essential.

With ExpressVPN’s Identity Defender, U.S. subscribers on eligible plans get built-in tools that make this much easier:

• Credit Scanner helps you track your Experian credit score, get alerts on new credit activity, and review detailed monthly reports.
• ID Alerts scans the dark web, monitors for unauthorized address changes, and flags suspicious SSN use; things you wouldn’t easily uncover on your own.
• Data Removal scours data-broker and people-search sites for your personal information, submits removal or opt-out requests on your behalf, and continuously monitors to ensure the data stays removed.

Together, these tools give you a head start on spotting problems early, so you can act before identity theft causes lasting damage.

Use a VPN to secure your data online

Monitoring is one part of protecting your identity; preventing your information from leaking in the first place is another. That’s where ExpressVPN’s encryption comes in. It shields your internet traffic, so even if hackers intercept it (like on public Wi-Fi), they can’t read or use it.

When combined with Identity Defender’s protection tools, you get a more complete safety net: encryption to keep your data private and monitoring to warn you if something slips through.

Learn more: Read more details about identity theft prevention.

Protections for identity theft victims

Recovering from identity theft can be stressful and costly, but there are tools and safeguards that can help, depending on your location and circumstances. For example, as part of ExpressVPN’s Identity Defender, U.S. subscribers on eligible plans receive ID Theft Insurance*, which can reimburse eligible expenses up to $1 million (subject to terms and conditions). This may cover costs related to restoring your identity, such as legal fees, lost wages, or credit bureau disputes.

How long does it take to recover from identity theft?

Recovery time depends on the type of identity theft and how quickly it’s caught. Some cases can be resolved in a matter of weeks, while others, especially those involving tax or criminal records, can take years to fully untangle. The table below offers a general guide, but keep in mind these timelines are only estimates:

*The insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company, under group or blanket policies issued to Array US Inc, or its respective affiliates for the benefit of its Members. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions. Review the Summary of Benefits.