Identity Theft Recovery Checklist: Step-by-Step Guide

Discovering Identity Theft: What Happens Next

An identity theft recovery checklist is one of the most useful documents you can have on hand, because identity theft tends to surface at the worst possible moment—when you are trying to get a loan, open a new account, or file your taxes. The damage it causes is rarely confined to one account, and fixing it requires working through a specific sequence of steps with multiple agencies and institutions. This guide walks through that process in a clear, logical order so you can act quickly and effectively.

First: Confirm It Is Actually Identity Theft

Before you panic, verify the problem. Common warning signs include:

• Unexplained charges on a bank or credit card statement
• A credit card or loan application denied for a reason you do not recognize
• Bills or collection notices for accounts you never opened
• A notice from the IRS that someone already filed a tax return using your Social Security number
• Unfamiliar accounts appearing on your credit report
• Medical bills for treatment you did not receive

If any of these apply, begin the steps below. Even if you are not yet certain, starting with a credit report pull costs nothing and reveals a great deal.

Step 1: Pull Your Credit Reports Immediately

Get free copies of your credit reports from all three major bureaus—Equifax, Experian, and TransUnion—at AnnualCreditReport.com, the only federally authorized source for free reports. Review each report carefully for:

• Accounts you did not open
• Hard inquiries from lenders you never contacted
• Addresses you have never lived at
• Incorrect personal information such as a different Social Security number listed

Make note of every suspicious item and the bureau that is reporting it. You will need this information for the steps that follow.

Step 2: Place a Fraud Alert or Credit Freeze

You have two main protective tools:

Fraud Alert

A fraud alert requires lenders to take extra steps to verify your identity before opening new credit in your name. You only need to place it with one bureau—that bureau is legally required to notify the others. An initial fraud alert lasts one year. Extended alerts (seven years) are available to confirmed identity theft victims.

Credit Freeze

A credit freeze is stronger: it prevents lenders from accessing your credit report at all, which effectively stops new accounts from being opened without your direct participation. You must freeze with all three bureaus separately. Freezes are free, and you can lift them temporarily when you legitimately need to apply for credit. This is the recommended option for most identity theft victims.

• Equifax: equifax.com/personal/credit-report-services/credit-freeze
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

Step 3: Report to the Federal Trade Commission

Go to IdentityTheft.gov, the FTC’s official recovery site. This step is essential for two reasons: it creates a formal Identity Theft Report that has legal weight with creditors and bureaus, and it generates a personalized recovery plan based on the specific type of theft you experienced. The site walks you through the process step by step and allows you to download your completed report, which you will need later.

Step 4: File a Police Report

Visit your local police department and file a report. Bring your FTC Identity Theft Report, a government-issued ID, proof of address, and any documentation of the fraudulent activity (statements, letters, etc.). A police report is not always required by creditors, but it strengthens your case significantly when disputing fraudulent accounts and can be required by some employers or agencies. Keep a copy of the case number.

Step 5: Contact Affected Financial Institutions

Call the fraud department of every bank, credit card issuer, or lender where fraudulent activity occurred. For each institution:

• Report the fraudulent activity specifically
• Request that the account be closed or the fraudulent transactions reversed
• Ask for written confirmation of your dispute and the outcome
• Request new account numbers or cards for legitimate accounts that may have been compromised

Keep a log of every call: the date, the name of the representative you spoke with, what was said, and any reference numbers. Follow up every phone call with a written letter sent by certified mail so you have a paper trail.

Step 6: Dispute Fraudulent Items on Your Credit Reports

Send a dispute letter to each bureau reporting a fraudulent item. Include:

• Your name, address, and Social Security number
• A clear identification of each fraudulent item
• A copy of your FTC Identity Theft Report
• A copy of your police report
• Copies (not originals) of any supporting documentation

Credit bureaus are required under the Fair Credit Reporting Act to block fraudulent information from your report within four business days of receiving your dispute along with your Identity Theft Report. They must also give you free copies of your report after making the block.

Step 7: Address Tax Identity Theft Separately if Needed

If someone filed a tax return using your Social Security number, the IRS process is separate. You will need to:

• File IRS Form 14039 (Identity Theft Affidavit)
• Continue filing your taxes on time, attaching the Form 14039 and a paper return if electronic filing is rejected
• Request an IRS Identity Protection PIN (IP PIN) once the matter is resolved to prevent future fraudulent filings

The IRS has a dedicated Identity Theft resource at IRS.gov that walks through these steps in detail. Resolving a tax identity theft case can take six months to a year, so starting early is important.

Step 8: Secure Your Accounts Going Forward

Once the immediate damage is addressed, take steps to prevent a recurrence:

• Change passwords on all financial accounts using unique, strong passwords for each
• Enable two-factor authentication on every account that offers it
• Set up transaction alerts on all bank and credit card accounts
• Consider enrolling in a credit monitoring service—many banks and credit card companies offer this free
• Keep the credit freeze in place until you need to apply for new credit
• Shred financial documents before discarding them

Your Recovery Checklist at a Glance

1. Pull credit reports from all three bureaus at AnnualCreditReport.com
2. Place a credit freeze with Equifax, Experian, and TransUnion
3. File an Identity Theft Report at IdentityTheft.gov
4. File a local police report and get the case number
5. Contact fraud departments at each affected financial institution
6. Send dispute letters to credit bureaus for each fraudulent item
7. Address any tax identity theft via IRS Form 14039 and request an IP PIN
8. Secure all accounts with new passwords and two-factor authentication

How Long Does Recovery Take?

Simple cases—a single fraudulent credit card—can be resolved in a few weeks. Complex cases involving multiple accounts, tax fraud, or medical identity theft can take one to two years of persistent follow-up. Document everything, follow up on unanswered disputes, and do not assume an issue is resolved until you have written confirmation. The FTC’s IdentityTheft.gov site allows you to track your recovery steps and generates follow-up letters automatically, which saves significant time throughout the process.

Identity theft is stressful and time-consuming, but it is recoverable. Systematic action, thorough documentation, and persistence are what move the process forward.