Someone used your identity. Here's how to recover.
Checked
Maybe it's a charge you didn't make, an account you never opened, a debt collector contacting you about a debt you don't owe, or an IRS notice saying someone used your Social Security number to get a tax refund. IdentityTheft.gov, the FTC's (Federal Trade Commission) identity theft site, has recovery steps for each. It's stressful, but you can begin today, and reporting it is a good place to start. If your data was only exposed, start with our guide What to do after a company says your data was breached.
Talk about it at home: jump to the Table Talks
1. Report it and get a recovery plan
Report the theft at IdentityTheft.gov, online or at 1-877-438-4338. The site uses your answers to create your FTC Identity Theft Report and a recovery plan: IdentityTheft.gov: identity theft recovery steps. It says the report proves to businesses that someone stole your identity. With an account, the site tracks your steps and pre-fills letters. Without one, print and save your report and plan right away, because you can't get back to them later.
Filing a police report is your choice. If you do, IdentityTheft.gov says to bring your FTC report, a photo ID, and proof of your address, and to ask for a copy, since you may need it for other steps.
Prefer to watch? The full video walks through the recovery steps in this guide.
2. Stop new damage
A credit freeze or fraud alert makes it harder to open new credit in your name. A freeze, unlike an alert, is placed at each bureau, the CFPB says; see our lesson Your credit file is a lock you can close.
An FTC report or a police report also unlocks an extended fraud alert, the FTC says. IdentityTheft.gov says it's free, lasts seven years, and means a company must contact you before granting new credit in your name. Contact one credit bureau, which must tell the other two, and send a copy of your report.
IdentityTheft.gov also says to change logins, passwords, and PINs. Our advice: start with accounts the thief touched, use new passwords, and turn on multifactor login.
3. Secure the doors they used
Our advice: make your email a priority, because password resets go there. Remove forwarding rules or recovery addresses you didn't add.
Your phone number matters too. The FCC (Federal Communications Commission) says scammers who hijack your number can intercept the texts businesses use to verify you and get into your financial and social media accounts. In a port-out scam, a thief cons your phone company into moving your number. The FCC suggests asking your phone company about adding a PIN or password: FCC: port-out fraud targets your private accounts. It says losing service is typically the first sign. If that happens, contact your phone company and your bank.
Do this now: Add a PIN or password to your phone account today.
4. Dispute fraudulent charges and accounts
Call the fraud department at each bank or card company involved, and close affected accounts, including any you did not open. The FTC says: "Follow up immediately in writing." The FTC and the CFPB (Consumer Financial Protection Bureau), the federal agency that enforces consumer financial laws, explain your limits: FTC: lost or stolen credit, ATM, and debit cards.
Credit cards. The Fair Credit Billing Act sets the dispute process. If the card was used before you reported it missing, the CFPB says "the most you will owe for unauthorized charges on the card is $50." The FTC says your written dispute should reach "the issuer within 60 days after the first bill with the error was sent to you."
Debit cards and other electronic transfers. The Electronic Fund Transfer Act and Regulation E apply. Report a lost or stolen card "within two business days of discovering the loss or theft," and the CFPB says you owe at most "the amount of any unauthorized transactions or $50, whichever is less." After that, "you could be responsible for up to $500." And "you must notify your bank within 60 days after your bank or credit union sends your statement showing the unauthorized transaction."
Our advice: report fast; waiting can cost you more.
Do this now: Call about every charge you don't recognize, and send a written follow-up.
5. Clean up your credit reports
Pull your free reports at AnnualCreditReport.com, "the only website authorized by federal law," and look for accounts you don't recognize.
To fix a mistake, the FTC says "You should dispute with each credit bureau that has the mistake," and contact the business that reported it. "However you filed your dispute, the credit bureau has 30 days to investigate it."
For identity theft debts and accounts, you can ask each bureau to block them under section 605B of the Fair Credit Reporting Act. The CFPB says to send "An identity theft report, which can be done through IdentityTheft.gov," "Proof of your identity" and "A letter identifying the fraudulent debts and information on your credit report." Bureaus "must block fraudulent information from your credit report within four business days after receiving your request": CFPB: what to do if you're a victim of identity theft.
Our advice: check all three bureaus' reports.
Do this now: Mark every account and debt on your reports that isn't yours.
6. If the thief used your identity for taxes
The IRS says: "We send a letter or notice when we suspect identity theft on a return." If you get one: "Verify it's from us." and "Follow our instructions."
Of Form 14039, the Identity Theft Affidavit, the IRS says: "Most people don't need to file this form." Don't file it if "You already sent it to us or filed it through IdentityTheft.gov," if "We already sent you a letter or notice," or if "The identity theft isn't tax-related." The IRS guide also lists when you should file: IRS: identity theft guide for individuals. Meanwhile, "File returns and pay tax as usual."
An identity protection PIN (IP PIN) helps protect your tax account; how to get one is in our breach guide.
Our advice: check any IRS letter on IRS.gov, not through links in unexpected emails or texts.
Do this now: If you got an IRS letter, verify it and follow it. Don't file Form 14039 unless the IRS tells you to.
Keep a recovery log, and check back
IdentityTheft.gov repeats one instruction: write down who you contacted and when, and keep copies of letters you send. Our advice: one notebook or file with the date, company, person, what they said, and your next step.
AnnualCreditReport.com offers free weekly reports. Our advice: check monthly for the next year.
Recovery takes calls and paperwork, but each step is one you can finish.
Teach it this week
Identity theft recovery: where do you start when someone uses your name?
Big idea: Recovering from identity theft is a checklist, not a crisis. Report it, stop new damage, secure the accounts that unlock the others, and write everything down.
Background for parents and grandparents: IdentityTheft.gov: identity theft recovery steps.
Table Talks (10 minutes)
- Start (2 min): Share a made-up story with your family: "Sam gets a letter about a new phone account Sam never opened." Ask: where could Sam start?
- Try it (5 to 7 min): Kids and grown-ups sort step cards by what each helps with (reporting, blocking new accounts, locking logins, record keeping): report it at IdentityTheft.gov, get a recovery plan, place a fraud alert or freeze, change passwords and turn on multifactor login, add a PIN to the phone account, write down who you contacted. Talk about why email and phone matter.
- Wrap-up (1 min): Everyone names the free government site for reporting identity theft, and one thing a recovery log should include.
Talk it over
- What would you do if an app said someone logged in to your account from a new place?
- Why might your email or phone number be the key to your other accounts?
- Who would you tell if an account felt off?
- Why does writing things down help when you're fixing a problem?
- Screens off, draw a paper recovery log together: date, who we contacted, what they said, next step. Fill in one made-up example.
- Tonight's action: whoever manages the family phone plan asks the phone company about adding a PIN or password. Nobody says the PIN out loud.
Use only made-up examples, never a real account. Free to use; please keep the source credit.
Education only, not financial, legal or tax advice. Not a registered investment adviser.
Sources
Primary sources
- IdentityTheft.gov: identity theft recovery steps, FTC, "Recovery Steps," no publish date shown, date checked: Oct 22, 2026
- CFPB: what to do if you're a victim of identity theft, CFPB (Consumer Financial Protection Bureau), "What do I do if I am a victim of identity theft?," last reviewed Jul 30, 2026, page last modified Aug 3, 2026, date checked: Oct 22, 2026
- IRS: identity theft guide for individuals, IRS, "Identity theft guide for individuals," page last reviewed or updated Jun 4, 2026, date checked: Oct 22, 2026
Supporting links
- FCC: port-out fraud targets your private accounts, FCC consumer guide, "Port-Out Fraud Targets Your Private Accounts," page updated March 4, 2025, date checked: Oct 22, 2026
- FTC: lost or stolen credit, ATM, and debit cards, FTC consumer advice, "Lost or Stolen Credit, ATM, and Debit Cards," page dated January 2022, updated Dec 18, 2025 (page metadata), date checked: Oct 22, 2026