What to Do If Someone Steals Your Identity: A Step-by-Step Guide

If someone has stolen your identity, the first few days matter more than any other stretch of time that follows. The steps you take now determine how quickly fraudulent accounts come off your credit report, how much of the damage you can undo, and whether you preserve the federal rights that let you make the responsible parties fix what they broke. This guide walks through the process in the order it should actually happen: stop the bleeding, document the theft, activate your rights under the Fair Credit Reporting Act, and review what comes next.

Step 1: Place a Fraud Alert on Your Credit File (Same Day)

A fraud alert is the fastest thing you can do, and it costs nothing. It is a notation on your credit file that tells any creditor pulling your report to take additional steps to verify your identity before opening a new account in your name. You only need to contact one of the three major credit bureaus; under federal law that bureau must notify the other two, so a single phone call or web request covers all three files.

An initial fraud alert lasts one year and can be placed by anyone who suspects they may be a victim of identity theft. Once you have filed a formal identity theft report (Step 2), you become eligible for an extended fraud alert lasting seven years under 15 U.S.C. § 1681c-1(b). The extended alert gives you stronger protection and requires creditors to actually contact you at a phone number you designate before opening new credit.

A fraud alert does not freeze your credit file. It simply flags it. If the fraud is ongoing or substantial, consider moving directly to a credit freeze, which is covered in Step 4.

Step 2: File an Identity Theft Report With the FTC

Go to IdentityTheft.gov and file a formal identity theft report with the Federal Trade Commission. This is not optional paperwork. A completed FTC identity theft report is the document that activates your most powerful rights under the FCRA, including the right to have fraudulent accounts blocked from your credit report within four business days. Without this report, you lose the fastest legal path to clearing your file.

The report will ask you to describe what happened, list the accounts or transactions you believe are fraudulent, and confirm your identifying information. The system generates an affidavit you can download and a recovery plan tailored to your situation. Save a PDF copy of the completed report. You will send it to credit bureaus, banks, creditors, and potentially to your attorney.

An FTC identity theft report carries legal weight because it is a sworn statement. Filing a false report is a crime, which is part of why federal law treats the completed report as sufficient proof to trigger mandatory blocking obligations.

Step 3: File a Police Report

File a report with your local police department. Bring a copy of the FTC identity theft report, any fraudulent account statements, and government-issued identification. The police report, combined with the FTC report, is sometimes referred to collectively as an "identity theft report" under the FCRA. Some credit bureaus and creditors will insist on seeing both before they act.

The police report also protects you on the criminal side. If the thief used your identity to commit fraud, pass bad checks, or even commit other crimes, the police report establishes a documented record that you were the victim, not the perpetrator. That record can matter years later if a warrant or charge is mistakenly attached to your name.

Step 4: Place a Credit Freeze on All Three Bureau Files

A credit freeze goes further than a fraud alert. It restricts access to your credit report entirely, which prevents most new accounts from being opened in your name because creditors cannot pull a report to make an approval decision. You must place a freeze with each of the three major credit bureaus individually. All three freezes are free under federal law. A freeze stays in place until you temporarily lift it (for example, when you apply for a new loan or rent an apartment) or remove it permanently.

A freeze does not affect existing accounts, your credit score, or your ability to check your own credit. It simply blocks new credit activity, which is exactly what you want when someone is opening accounts in your name.

Step 5: Request and Review Your Credit Reports

You are entitled to free copies of your credit reports. Pull reports from all three major credit bureaus and read them carefully. Look for:

• Accounts you did not open. New credit cards, loans, utility accounts, or phone contracts.
• Hard inquiries you did not authorize. Every inquiry is a fingerprint of where the thief tried to open credit. Some inquiries turn into accounts; others are attempts that were declined.
• Wrong addresses or employers. Thieves often add alternate addresses to your file to redirect billing statements away from you.
• Collections on accounts you never had. Fraudulent accounts that went unpaid will eventually show up in collections.

Make a list of every fraudulent item, with the account number, the creditor name, the date opened, and the reported balance. This list becomes the attachment to every dispute you send and is the specific identification of fraudulent items required by the FCRA blocking statute.

Step 6: Invoke Your Section 605B Blocking Rights

This is the step most victims never take, and it is the single strongest right the FCRA gives you. Under 15 U.S.C. § 1681c-2, once a credit reporting agency receives (1) your identity theft report, (2) proof of your identity, and (3) a specific list of items that resulted from identity theft, it must block that information from appearing on your credit report within four business days. Once blocked, the information cannot be reported to anyone pulling your file.

Send each of the three major credit bureaus a written request that includes the FTC identity theft report, a copy of your police report, a copy of your government-issued ID and proof of address, and your list of specific fraudulent items. Send everything by certified mail with return receipt requested, or use the bureau's secure online upload if one is available. Keep copies of everything. The four-business-day clock starts when the bureau receives your complete package.

If a bureau fails to block the fraudulent information within that four-business-day window, or if it reinstates the information without meeting the statute's narrow reinsertion requirements, it may have violated Section 605B. That is an FCRA violation that gives rise to a private right of action.

Step 7: Notify the Creditors and Furnishers Directly

Every creditor, bank, or company that extended credit or reported an account in your name based on the stolen identity is called a furnisher under the FCRA. Send each one a written dispute that includes the FTC identity theft report, the police report, and your identification. Furnishers have their own obligation under 15 U.S.C. § 1681s-2(b) to conduct a reasonable investigation once they receive notice of a dispute from a credit bureau. They also cannot continue to report information they know, or have reason to know, is false.

For fraudulent accounts that have not yet been sent to collections, contact the creditor's fraud department directly and ask for the account to be closed as fraud and removed from your credit report. Ask for written confirmation. For accounts already in collections, the fraud response is typically handled by the original creditor's fraud department, not the collector.

Step 8: Protect the Rest of the Attack Surface

Identity theft rarely stops at credit accounts. Thieves may also target your tax return, your medical insurance, your Social Security benefits, and your existing bank and brokerage accounts. A few additional steps close these doors:

• IRS Identity Protection PIN. Request a six-digit IP PIN from the IRS to prevent someone from filing a fraudulent tax return in your name.
• Social Security Administration. Create your my Social Security account before a thief does. Review your earnings record for employment that is not yours.
• Medical insurance. Request an explanation-of-benefits history from your insurer and flag any services you did not receive. Medical identity theft can be particularly hard to untangle later.
• Change passwords and enable two-factor authentication. Start with email, banking, and any account that holds payment information. Assume any password reused across sites is compromised.

What Damages May Be Available

When a credit bureau or furnisher fails to follow the rules, the FCRA provides real remedies. For willful violations under 15 U.S.C. § 1681n, you may recover:

• Statutory damages of $100 to $1,000 per consumer per action, even without proof of specific out-of-pocket loss.
• Actual damages for financial harm, out-of-pocket costs, emotional distress, and harm to your reputation.
• Punitive damages with no statutory cap.
• Attorney's fees and costs.

For negligent violations under 15 U.S.C. § 1681o, you may recover actual damages and attorney's fees. The FCRA's fee-shifting provision is the reason most consumer protection attorneys handle identity theft cases at no out-of-pocket cost to the client. If you win, the defendant pays your attorney.

How Long You Have to Act

The FCRA statute of limitations is two years from the date you discover the violation, or five years from the date the violation occurred, whichever comes first. For identity theft victims, the discovery date is usually what matters because the fraud often predates the moment you notice it. Even so, moving quickly after you discover the fraud preserves evidence, strengthens your documentation, and keeps the statutory windows open on both the credit bureaus and the furnishers.

When to Talk to a Consumer Protection Attorney

Some identity theft cases resolve cleanly once the bureaus and creditors do what the law requires. Many do not. If a bureau misses the four-business-day blocking deadline, reinstates fraudulent information without proper notice, or treats a legitimate identity theft report as a routine dispute, you may have a claim under the FCRA. The same is true if a furnisher continues to report an account it knows is fraudulent, or if a debt collector continues to pursue you for an account you never opened. You can learn more about these rights on our identity theft practice page and our credit report errors practice page.

At Rausa Russo Law, we represent identity theft victims whose credit bureaus or furnishers did not follow the rules. The consultation is free, and for most consumer protection cases there is no out-of-pocket cost to you. Prior results do not guarantee a similar outcome.