What to do if your identity is stolen: A complete recovery guide

When you discover your personal information has been compromised, the feeling can be overwhelming. However, taking immediate and deliberate steps can help limit the damage and begin the process of recovery.

Acting quickly is crucial for minimizing any further misuse of your information. The process involves three key steps: restricting access to your credit, filing official reports with authorities, and securing your personal accounts.

This guide outlines the series of actions you can take, from placing fraud alerts and security freezes on your credit files to reporting the crime to government agencies and local law enforcement.

Please note: This information is for general educational purposes and does not constitute financial or legal advice.

What is the first thing you should do if your identity is stolen?

If your identity is stolen, it’s important to block the thief’s access to your personal information and create an official record of the crime. Acting quickly helps limit the damage and gives you the paperwork you’ll need to dispute fraudulent charges later.

Why acting fast matters for damage control

Identity theft can escalate quickly. Once someone has your personal details, they can apply for loans, open credit cards, or even file false benefit claims using your name. Acting right away prevents further misuse and makes it easier to restore your credit record.

Who to contact first when you suspect identity theft

Once you’ve spotted suspicious activity, take action right away by contacting the key organizations below:

• A credit bureau to place a fraud alert: You can contact a single credit bureau (Equifax, Experian, or TransUnion) to place an alert, and that bureau must notify the other two. It’s free, and it ensures lenders take extra steps to confirm your identity before approving new accounts.
• All three credit bureaus to place a credit freeze: This requires you to contact each bureau individually. A freeze blocks anyone from opening new accounts in your name until you lift it.
• Your bank and credit card companies: Reach out to their fraud departments as soon as possible. They can freeze or close compromised accounts, stop new charges from going through, and help you set up new cards or account numbers to prevent further misuse.
• The FTC’s identity theft portal: Use the government portal IdentityTheft.gov to generate an official Identity Theft Report that you can use to dispute fraudulent charges and clear your credit file. You can also file a report with your local police.

How do I check if someone is using my identity?

The signs of identity theft aren’t always obvious at first. Sometimes it shows up quietly on a credit report, a bank statement, or even in government records. Checking these places regularly can help you spot problems early and stop them before they grow. Here’s what to look for:

• Suspicious activity on your credit reports: Your credit reports show the accounts, balances, and activity connected to your name, so checking them regularly is one of the clearest ways to spot identity theft. Look for accounts you don’t recognize, unexpected balances, or inquiries you didn’t make. Because each bureau may have slightly different information, it’s best to review all three.
• Unusual bank and investment account activity: Review your bank statements carefully each month to catch unfamiliar transactions, unexpected charges, or ATM withdrawals you didn’t make. If something looks wrong, call your bank’s fraud department immediately. Investment accounts need the same level of attention: watch for changes to your personal details, like a new email, phone number, or external banking link you didn’t authorize.
• Unfamiliar government records or benefit claims: Sometimes, the first identity theft red flag appears in government records. For example, you might try to file your taxes only to learn that someone else has already done it in your name, or your Social Security record may show strange details, like earnings from an employer you never worked for. Medical bills or insurance statements for services you never received are another warning sign. If you notice these issues, reach out to the agency involved right away.

Immediate steps to take after identity theft

Once you confirm suspicious activity tied to your identity, it’s important to move fast. The following steps are recommended by consumer protection agencies to contain the fraud and begin restoring control.

Note: These steps are provided for general guidance. For advice specific to your situation, consult with a financial institution, lawyer, or tax professional.

Place a fraud alert on your credit report

Adding a fraud alert makes creditors take extra steps to confirm it’s really you before approving new accounts. The good part is that you only need to contact one of the three credit bureaus, and it will notify the other two.

There are different types of alerts depending on your situation: an initial fraud alert lasts one year and can be renewed, while an extended fraud alert lasts seven years and requires proof of identity theft. There’s also an active duty alert that protects service members during deployment for one year.

Freeze your credit

Freezing your credit blocks new creditors from accessing your file until you lift the freeze. This helps prevent thieves from opening new accounts in your name, even if they have your information. You need to contact each bureau separately to freeze your credit, and you can unfreeze it anytime for free.

Contact your bank, credit card companies, and affected businesses

Call your bank and card issuers right away. Ask for the fraud department and report the incident. If other businesses are affected, let them know immediately so that they can close or flag compromised accounts.

Secure your online accounts and phone number

Change the passwords of sensitive accounts, such as email, banking, and social media, which could expose your personal information if compromised. Use strong, unique passwords or passphrases and enable two-factor authentication (2FA) where possible.

You should also contact your mobile provider to check if your number has been tampered with, as SIM swaps are a common way to hijack accounts.

Report the theft to the FTC and your local police

File a report with the FTC through the IdentityTheft.gov portal to generate your official Identity Theft Report. You can bring this document when contacting your local police department and requesting a police report. Together, these records can help you dispute fraudulent charges and clear your credit file.

How to place an electronic access block on your Social Security number?

When your Social Security number (SSN) has been exposed, one of the protections available is an access block on your SSN (also known as “lock”) through the Social Security Administration (SSA).

When you should consider an SSN lock

If you know your Social Security number has been compromised, you can request a block to prevent electronic or automated access to your record. This step is designed to reduce the chance of unauthorized use of your SSN.

Steps to request an SSN lock through the Social Security Administration

The SSA lets you request a block on your SSN by phone. Call the national helpline at 1-800-772-1213 (or 1-800-325-0778 if using TTY, a text telephone service for people with hearing or speech difficulties).

Once the block is active, no one, including you, can view or change your information online or through automated phone services. If you later want to remove the block, you’ll need to contact the SSA again and verify your identity.

How to protect your credit after identity theft

Once you’ve reported the theft and secured your accounts, the next step is protecting your credit from further damage.

Set up extended fraud alerts

If you’ve been a victim of identity theft, you can request an extended fraud alert from any one of the three credit bureaus. This alert lasts for seven years and requires you to send documentation, such as an FTC identity theft report or a police report, to prove the fraud. Because of the extra verification, it can only be requested by mail.

An extended alert gives you added protection: lenders must take additional steps to confirm it’s really you before approving new credit in your name.

Remove fraudulent information and dispute unauthorized accounts

If you find errors, suspicious accounts, or charges on your credit report, you have the right to dispute them for free. Disputes can be filed online, by phone, or by mail, but online submission is usually the quickest method. Before starting, gather documents that support your case, such as bank statements, utility bills, letters from creditors, or identity theft reports.

Once submitted, the credit bureau investigates the item with the company that reported it. The process generally takes about 30 days, or up to 45 if you provide additional documents. Depending on the bureau’s investigation, outcomes can vary: the item may be corrected, deleted, verified, or remain unchanged. If you disagree, you can request a statement of dispute be added to your file or resubmit your claim with more evidence.

Ongoing protection and prevention tips

Recovering from identity theft doesn’t end once you’ve disputed accounts or set up alerts. Staying protected requires ongoing security habits that help you spot problems early and reduce the chance of future misuse.

Check your credit and personal data regularly

Identity theft isn’t always obvious right away. Thieves can use your information to open accounts, make purchases, or file for benefits without your knowledge. That’s why regularly reviewing your credit reports, bank statements, and account activity is essential. Other warning signs can include bills for items you never bought, collection calls for debts you don’t recognize, missing mail, or loan denials you can’t explain. While these issues might not always appear directly in your credit reports, they’re red flags that something may be wrong. By checking your information often, you can detect these red flags early and take steps to stop further damage.

Use identity theft protection or credit monitoring services

Manually checking your credit is helpful, but it won’t always catch problems quickly enough. Third-party services provide an added layer of protection by automating the process. They continuously scan your credit files, send real-time alerts about unusual activity, and often detect issues sooner than you would on your own.

ExpressVPN Identity Defender provides U.S. users with identity theft protection and credit monitoring tools. It includes a Credit Scanner that tracks changes to your credit activity and alerts you to unusual patterns, along with features that check whether your personal details have appeared online. If your information is detected on the dark web, you’ll receive a notification so you can respond quickly.

Identity Defender even offers ID Theft Insurance* that may help cover eligible expenses should you fall victim to identity theft. Coverage limits and terms apply.

Practice safe online and offline data security

Protecting your identity requires caution both online and in daily life:

• Be wary of unsolicited contact: Calls, texts, emails, or social media messages from people you don’t know can be attempts to steal your personal information.
• Avoid sharing sensitive details: Never give out your bank account number, Social Security number, or date of birth unless you know it’s legitimate and necessary.
• Remove your data from data brokers: These companies gather and sell your details to third parties. ExpressVPN’s Identity Defender includes a Data Removal service that scans data broker lists and helps remove your personal details from them. Cutting off this supply of information reduces the chances that criminals exploit your data and helps you regain control over your digital footprint.
• Collect your mail every day and place a hold on it if you travel: Thieves may target unattended letters. Consider installing a locked mailbox as well, which makes it harder for someone to steal sensitive documents like bank statements or tax forms.
• Store important documents like your Social Security card securely: Don’t carry them around in your wallet.
• Shred any sensitive documents before throwing them out: This helps to prevent criminal “dumpster divers” from getting hold of your details.
• Understand how ATM skimming works: Look out for suspicious devices at machines or pumps.
• Be cautious with unsecured public Wi-Fi: Criminals may use open networks to capture your information. Using a VPN like ExpressVPN adds an extra layer of privacy by encrypting your connection.

Strengthen your logins with passwords and 2FA

Use strong, unique passwords or passphrases for each account, and update security questions if available. Enabling two-factor authentication (2FA) or multi-factor authentication (MFA) adds another safeguard, making it much harder for attackers to break into your accounts even if they have your password.

With the ExpressVPN Keys password manager, you can create and store credentials securely, reducing the risk of reusing weak passwords. You can also generate 2FA codes for compatible accounts, adding an extra layer of protection.

Protect your identity internationally

Spending time abroad can put your personal information at greater risk. Before leaving, place a hold on your mail so it doesn’t accumulate at home, where it could be stolen. Clear out your wallet and carry only what’s essential, leaving extra cards or IDs safely stored at home or in your hotel. Make copies of your passport or ID and keep them in a separate secure place in case the originals are lost or stolen.

You should also stay alert to unfamiliar calls, texts, or messages, as scammers can target people who are travelling. Use secure internet connections whenever possible, and avoid oversharing your location or travel updates on social media, since this can signal that your home is unattended and increase the risk of theft or fraud.

*The insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company, under group or blanket policies issued to Array US Inc, or its respective affiliates for the benefit of its Members. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions. Review the Summary of Benefits.