Identity Theft Recovery Plan: What to Do in the First 48 Hours

Discovering that someone used your identity is stressful, but a clear sequence of steps limits damage. Acting quickly on the first two days matters most, and most of the steps are free.

The first hours

1. Place a credit freeze at all three credit bureaus, which is free and blocks new accounts.
2. Contact the fraud department of any company where fraud occurred and ask them to close or freeze the account.
3. Change passwords and enable multi-factor authentication on email, banking and phone accounts.
4. Report the theft to the Federal Trade Commission at IdentityTheft.gov to get a recovery plan and an identity theft report.
5. Save every notice, account number and reference number in one folder.

Why the FTC report matters

An FTC identity theft report is an official statement that creditors and credit bureaus often accept as proof when you dispute fraudulent accounts. It can also support a police report if one is needed, and it gives you letter templates for disputes.

Fraud alerts versus freezes

• A freeze blocks most new credit checks until you lift it.
• A fraud alert asks lenders to verify your identity before opening credit.
• Extended fraud alerts may be available to confirmed victims.
• You can use both at the same time.

Disputing fraudulent accounts

Send written disputes to both the credit bureau and the company that reported the account. Include your FTC report, a copy of ID and proof of address. Federal law limits what victims owe for fraudulent credit card charges, and bureaus generally must investigate and block information resulting from identity theft once you provide proper documentation.

Police reports

A police report is not always required, but some creditors ask for one. Bring your FTC report, ID and evidence. Ask for a copy and a report number, and keep it with your records.

Tax, medical and benefits identity theft

If someone files a tax return in your name, contact the IRS and use its identity theft procedures. For medical identity theft, request your records and correct errors with providers and insurers. For stolen benefits, contact the agency involved. Each type has its own form and timeline.

Tracking and long-term monitoring

Keep a log of calls with dates, names and outcomes. Check your credit reports regularly, since you can get free reports at AnnualCreditReport.com. Watch for new accounts, collection letters and unexpected mail. Recovery can take months, so persistence matters.

Real-life scenarios

1. A person finds an unknown credit card on their report and freezes credit the same day.
2. A taxpayer learns their return was already filed and follows IRS identity theft steps.
3. A parent discovers a child's Social Security number was misused and places a freeze for the minor.

Common mistakes to avoid

• Waiting to see if it resolves itself.
• Paying a fraudulent debt to make a collector go away.
• Not keeping copies of letters.
• Using unofficial recovery services that charge fees.
• Forgetting to secure email accounts.
• Ignoring collection letters on fraudulent accounts.

Questions to ask a professional

• Do I need a police report for this creditor?
• Which accounts should be closed?
• How do I fix my credit reports?
• Should I contact the IRS?
• Are there deadlines for disputes?

A practical action plan

1. Freeze credit and secure accounts.
2. Report to the FTC and get a recovery plan.
3. Dispute fraudulent accounts in writing.
4. File a police report if needed.
5. Monitor credit and keep records.

Terms you may hear

• Credit freeze: blocks access to your credit file for new accounts.
• Fraud alert: a flag asking lenders to verify identity.
• Identity theft report: an official FTC statement of the theft.
• Dispute: a written challenge to inaccurate information.
• Synthetic identity: a fake identity built from real and invented data.

Building your recovery file

Create one folder, paper or digital, with your FTC report, police report if any, copies of disputes and replies, account statements showing fraud and a log of every call. Send important letters by certified mail and keep the receipts. This file is your proof if a creditor or bureau later disputes what you did.

Securing the accounts attackers use first

Email and phone accounts are often the key to everything else. Change those passwords first, enable multi-factor authentication and review forwarding rules and recovery options for changes you did not make. Ask your mobile carrier to add a port-out PIN to prevent SIM swapping.

Watching for the second wave

Stolen data is often reused months later. Keep your credit frozen, check reports regularly, read every medical and benefit statement and be cautious with calls or messages claiming to help you. Consider an IRS Identity Protection PIN to protect your tax return.

Frequently asked questions