How to recover from identity theft in 5 steps.
Last verified July 7, 2026The direct answer. Go straight to IdentityTheft.gov, the FTC's recovery site, and file: the process generates your official identity theft report, the document that unlocks every other fix, plus a personal recovery plan with pre-filled letters. Freeze your credit at Equifax, Experian, and TransUnion the same day to stop new damage. Then work the disputes: with the FTC report attached, bureaus must block fraudulent items within four business days, and creditors' fraud departments close fake accounts without billing you. Harden every login, add the IRS Identity Protection PIN, and keep watching, because stolen data gets reused.
File the official report at IdentityTheft.gov.
The FTC's site takes the details and produces two powerful things: an identity theft report with the legal weight of a police report for most purposes, and a step-by-step recovery plan with letters pre-drafted for your exact situation. Add a local police report when a creditor demands one or you know the thief. Twenty minutes here organizes the entire recovery.
Freeze all three bureaus and set fraud alerts.
Freeze Equifax, Experian, and TransUnion online, free, effective within the hour, which stops every new account the thief might try. Add an extended fraud alert, seven years with an identity theft report, requiring lenders to verify identity before extending credit. Freeze Innovis and ChexSystems to close the side doors, and the thief's toolkit is empty.
Dispute everything fraudulent with the report attached.
Pull all three credit reports and list every account, inquiry, and address that belongs to the thief. Send each bureau the identity theft report with the disputed items; federal law requires them to block confirmed fraud within four business days. Call each creditor's fraud department in parallel to close fake accounts and reverse charges. Certified mail and a log of every call build the file that finishes this.
Harden the accounts you keep.
New passwords everywhere, unique per site, from a password manager. App-based two-factor authentication on email and banking first, since email resets everything else. New account numbers on compromised cards and bank accounts, transaction alerts on all of them, and an IRS Identity Protection PIN so tax refund fraud is off the table. The same afternoon covers all of it.
Monitor the long tail.
Stolen identities get resold, so the tail needs watching: weekly credit reports free at AnnualCreditReport.com for the first months, then a monthly rhythm, plus bank and card alerts running permanently. Watch for collection letters on unfamiliar debts, denied benefits claims, and duplicate tax filings. Each new incident replays the same playbook: report, dispute with the FTC document, done. The freeze from step two stays on for good; thaw it briefly whenever you apply for credit.
Five things to do this week.
- File at IdentityTheft.gov and save the identity theft report.
- Freeze Equifax, Experian, TransUnion, Innovis, and ChexSystems.
- Send dispute letters with the report to every bureau and creditor.
- Reset passwords, add app-based 2FA, and get an IRS IP PIN.
- Calendar weekly report checks for the first 90 days.
Questions readers ask most often.
Am I liable for accounts a thief opened in my name?
No. Fraudulent accounts and charges are the creditor's loss once you report and document, and the identity theft report is your documentation. Federal law caps card fraud liability at $50 and issuers waive even that; genuinely fraudulent new accounts bill you nothing.
Do I need a police report?
IdentityTheft.gov's report suffices for most disputes and blocks. Add a police report when a creditor insists, when you know who did it, or when the theft involves a crime beyond credit, like a stolen wallet or burglary. Bring your FTC report to the station; it does the explaining.
How long does identity theft recovery take?
The containment happens in the first 48 hours: freeze, report, first disputes. Blocks of confirmed fraud run on a four-business-day federal clock, creditor investigations take days to weeks, and complex cases with many accounts stretch a few months. The monitoring tail runs a year to be safe.
Should I pay for identity theft protection services?
The core protections are free: freezes, alerts, IdentityTheft.gov, and credit reports now available weekly at no cost. Paid services add convenience monitoring and insurance, worth it for some, optional for most. The freeze does the heavy lifting either way.
How did they get my information, and can I stop the next one?
Breaches, phishing, and mail theft lead the list, and the honest answer is that your data is likely already circulating. The durable defense is structural: permanent freezes, unique passwords, app-based 2FA, and the IP PIN. With those standing, stolen data has nowhere to go.
The next True North guide for you.
Use this format when quoting.
Source: True North by Competitive Compass. "How to Recover from Identity Theft in 5 Steps". Published 2026-07-07.
URL: https://competitive-compass.com/true-north/how-to-recover-from-identity-theft-in-5-steps.html