Identity Theft Recovery Plan: 10 Steps for the First 72 Hours

The plan by day

When	Do this	Time	Cost	Why it comes now
Hour 0 to 1	Fraud alert at one bureau; credit freeze at all three	40 min	Free	Stops new accounts being opened while you do everything else
Hour 1 to 2	Change the password and enable 2FA on email, then bank, then everything else	45 min	Free	Email resets every other account; lock it before the thief does
Day 1	File at IdentityTheft.gov; file a police report; call each affected company's fraud line	2 to 3 hours	Free	The FTC report triggers federal rights; creditors want a report number
Day 2	IRS IP PIN; my Social Security account; pull all three credit reports	90 min	Free	Blocks tax refund fraud and benefit hijacking; shows the full damage
Day 3	Written disputes to bureaus and creditors with the FTC report attached; bank alerts on	2 hours	Postage	Starts the legal clocks: bureaus must block within 4 business days
Week 2 to 6	Follow up on every dispute; request an extended 7-year alert; check mail and email for new accounts	1 hour a week	Free	Creditors resolve most disputes in 30 to 45 days
Month 3 and 12	Re-pull reports; keep the freeze on permanently; renew the IP PIN each January	30 min	Free	Stolen data gets resold; the freeze is the long-term fix

Hour 0 to 1: stop the bleeding

1. Place a fraud alert (10 min, free). Do it online at one bureau; by law that bureau must notify the other two. An initial alert lasts one year and tells any lender pulling your file to verify your identity before opening credit. Equifax: equifax.com/personal/credit-report-services or 800-685-1111. Experian: experian.com/fraud or 888-397-3742. TransUnion: transunion.com/fraud-alerts or 888-909-8872.
2. Freeze your credit at all three bureaus (30 min, free). An alert asks lenders to be careful; a freeze stops them from seeing your file at all, so nobody can open a card, loan, or phone contract in your name. Create an account at each bureau (the same three sites), place the freeze, and save the PIN or login each gives you. Federal law makes freezes free, requires the bureau to place one within one business day of an online or phone request, and to lift one within one hour when you ask. Lift it temporarily only when you apply for credit, and only at the bureau the lender names. Our credit freeze walkthrough has screenshots. Freeze your children's files too; a minor's clean SSN is worth more to a thief than yours.

Hour 1 to 2: lock the accounts you still control

3. Reset passwords, email first (45 min). Email is the master key: whoever controls it can reset everything else. Change it from a device you trust, sign out all other sessions, check for forwarding rules and recovery addresses you did not add, and turn on two-factor with an app or a passkey, not SMS, since SIM swapping is a known follow-on. Then banks, then the retailer and utility accounts. Use a password manager so every new password is unique.

Day 1: paperwork that creates rights

4. File at IdentityTheft.gov (30 min, free). The FTC's site asks what happened and produces three things: an official Identity Theft Report (an affidavit with a report number), a personal recovery plan you can track online, and pre-filled dispute letters for bureaus, creditors, and debt collectors. Under the Fair Credit Reporting Act, that report plus proof of identity obliges a credit bureau to block the fraudulent items within four business days, and obliges the businesses involved to give you the records the thief created. Print the report and keep a PDF. Phone help is at 877-438-4338, or file in Spanish at RobodeIdentidad.gov.
5. File a police report (60 min). Bring the FTC report, a government photo ID, proof of address, and any evidence (collection letters, statements). Ask for the report number and the officer's name. Some departments file identity theft online. You need the police report for the seven-year extended fraud alert, some creditors demand it before closing an account, and it protects you if the thief was arrested using your name.
6. Call every affected company's fraud department (60 min). For accounts the thief opened: ask them to close the account, confirm you are not liable, and send written confirmation. For charges on your real accounts: dispute them. Federal limits protect you: credit card liability is capped at $50 and usually waived; debit card liability is $50 if you report within two business days, up to $500 within 60 days, and potentially unlimited after that. Follow each call with a letter (the FTC's templates) sent by certified mail, and log the date, name, and reference number.

Day 2: the government accounts thieves file first

7. Get an IRS Identity Protection PIN (20 min, free). An IP PIN is a six-digit number the IRS requires on any return filed with your SSN, so a thief cannot file a fake refund claim in January before you do. Anyone who can verify their identity can opt in. The fastest route is the IP PIN section of your IRS online account at irs.gov; if you cannot verify online and your income is under $84,000 ($168,000 joint), Form 15227 gets one mailed in four to six weeks, or a Taxpayer Assistance Center can issue one in about three weeks. The IRS issues a new PIN every January; if you enrolled online, retrieve it from your account each year. If you already filed a return and it was rejected as a duplicate, file Form 14039 with the paper return.
8. Claim your my Social Security account (15 min, free). Create it at ssa.gov/myaccount before a thief does, check the earnings record for jobs you never held, and turn on the option that blocks electronic changes to direct deposit. Report benefit fraud to the SSA Office of the Inspector General.
9. Pull all three credit reports (30 min, free). AnnualCreditReport.com now provides free weekly reports from all three bureaus. Read every account, inquiry, address, and employer. Anything you do not recognize goes on the dispute list; a wrong address often marks where the thief had cards mailed.

Day 3: disputes in writing and the watch

10. Send written disputes and set the alarms (2 hours). To each bureau: the FTC's block letter, your Identity Theft Report, ID, and the list of fraudulent items. To each creditor: the dispute letter plus the report. Certified mail with return receipt for all of it. Then turn on push alerts for every transaction over $1 on your bank and card accounts, sign up for USPS Informed Delivery to watch for redirected mail, and set a calendar reminder for day 30 to chase anything unresolved.

Your rights, in one table

Right	What you need	What it does	Deadline for them
Initial fraud alert	Nothing; contact one bureau	Lenders must verify you before new credit; free reports	Lasts 1 year, renewable
Extended fraud alert	FTC Identity Theft Report or police report	Verification required for 7 years; off prescreened offers for 5	Lasts 7 years
Credit freeze	Account at each bureau	Nobody can pull your file for new credit	Placed in 1 business day online; lifted within 1 hour
Block fraudulent items	Identity Theft Report plus ID	Bureaus remove the thief's accounts from your report	4 business days after receipt
Business records	Identity Theft Report plus ID	The company must give you the application and transaction records	30 days
Debt collector stop	Identity Theft Report	Collector must stop until it verifies the debt is yours	On receipt
Card liability caps	Report promptly	Credit: $50 max. Debit: $50 within 2 business days, $500 within 60 days	Your deadline, not theirs

Mistakes that make it worse

• Paying a "recovery service." Everything above is free. Anyone charging to do it, or calling to offer it, is selling you nothing or scamming you again.
• Lifting the freeze and forgetting it. Set a lift with an end date; the bureaus let you schedule it.
• Disputing by phone only. The legal clocks start when a bureau or creditor receives your written dispute. Calls are for speed; letters are for rights.
• Skipping the IRS step because it is September. Refund fraud is filed in the first weeks of the season. Enroll now so the PIN is in your account by January.
• Buying monitoring instead of freezing. Monitoring tells you after an account opens; a freeze prevents it. Take any free monitoring a breached company offers, but the freeze is the protection.

Quick answers

What is the first thing to do if your identity is stolen?

Place a free one-year fraud alert with one credit bureau, which must tell the other two, then freeze your credit at Equifax, Experian, and TransUnion. Both are free and take under an hour online. The alert forces lenders to verify you; the freeze stops them from pulling your file at all, which blocks most new-account fraud outright.

Do I need a police report for identity theft?

Usually yes. The FTC Identity Theft Report from IdentityTheft.gov is what federal law requires for most disputes, but a police report is needed for the seven-year extended fraud alert, some creditors ask for one before closing a fraudulent account, and it helps if the thief committed crimes in your name. Bring your FTC report, photo ID, and proof of address; ask for the report number.

How long does identity theft recovery take?

The lockdown takes one afternoon. Cleaning up takes longer: bureaus must block fraudulent items within four business days of receiving your Identity Theft Report, creditors typically resolve disputes in 30 to 45 days, and a case with several fraudulent accounts or tax fraud can run three to six months. Victims who freeze and file within 72 hours consistently recover fastest and lose the least.

More guides

• 
  Guides

  How to Freeze Your Credit

  All three bureaus, step by step.

• 
  Guides

  What to Do After a Data Breach

  The 48-hour checklist.

• 
  Guides

  How to Spot Phishing in 2026

  The red flags that survive AI.