Stolen Identity Protection: What to Do in the First 24 Hours (And After)
10:04 p.m. You spot a charge you didn't make. Your stomach drops. The next hour matters more than the next month, and most guides skip straight to selling you something instead of telling you what to do right now.
This one doesn't. Here's the actual sequence, in order, based on the FTC's own recovery process.
Short answer: Call the company where fraud occurred, place a free fraud alert, then file your report at IdentityTheft.gov. That report becomes your official Identity Theft Affidavit for disputing fraudulent accounts. Add ongoing monitoring after the immediate fire is out, not before.
Key Takeaways
- A standard fraud alert is free, lasts one year, and only requires contacting one bureau.
- Federal law caps your credit card liability at $50 if you report before further unauthorized use.
- IdentityTheft.gov generates your official Identity Theft Report, which most creditors require for disputes.
- Tax, medical, and child identity theft each have their own separate process. One size doesn't fit all.
- Ongoing monitoring matters most after the fire is out, to catch a second wave months later.
What's Covered in This Guide
The First 24 Hours
Move in this order. Each step makes the next one easier.
- Call the company where fraud occurred. Explain that someone stole your identity. Ask them to close or freeze the account.
- Change your passwords and PINs. Do this on the affected account and anywhere you reused that password.
- Place a fraud alert with one credit bureau. It's free, lasts a year, and that bureau must notify the other two.
- Pull your credit reports. Placing a fraud alert entitles you to free copies from all three bureaus at AnnualCreditReport.com.
- Review every report line by line. Note anything you don't recognize before moving to the next step.
File Your Report at IdentityTheft.gov
IdentityTheft.gov is the FTC's own recovery tool, and it's free. Create an account and it walks you through each step, pre-fills letters, and tracks your progress.
The report you generate functions as your Identity Theft Affidavit. Most creditors require this document before they'll remove a fraudulent account from your file.
Fraud Alert vs Credit Freeze: The Real Difference
A standard fraud alert lasts one year and requires businesses to verify your identity before extending new credit. It's free and renewable.
A credit freeze blocks new accounts from opening at all, until you lift it. By federal law, bureaus must place a freeze within one business day and lift it within one hour of your request. It's free either way.
Once you have an official Identity Theft Report, you can request an extended fraud alert instead of the standard one. It lasts seven years and comes with two free credit reports over the following year. Ask each bureau directly about current terms.
Add Ongoing Monitoring Once You're Stable
See how Aura's three-bureau monitoring catches a second wave of fraud months down the line.
View Aura PlansWe may earn a commission if you sign up through this link, at no added cost to you.
What You Actually Owe
Under federal law, your liability for unauthorized credit card charges is capped at $50, and often reduced to zero if you report before further misuse.
Under most state laws, you're not responsible for debt on fraudulent new accounts opened without your permission. Document everything, and don't pay a disputed bill while it's under investigation.
Special Cases: Tax, Medical, and Child Identity Theft
Tax identity theft has its own process. File IRS Form 14039 through IdentityTheft.gov, or call the IRS Identity Theft line directly, if someone used your Social Security number to file a fraudulent return.
Medical identity theft means someone used your insurance information for treatment. Request your medical records and dispute incorrect entries directly with the provider.
Child identity theft often goes undetected for years, since kids rarely have existing credit files. Request a manual search of your child's Social Security number with each bureau if you suspect misuse.
A few other targets people forget. Notify your state DMV if a driver's license number was involved. Contact utility or phone providers if new service was opened in your name. Add your number to the National Do Not Call registry to cut down on follow-up scam calls.
The 5-Phase Recovery Sequence
Use this order, not a random mix of steps, to move through recovery efficiently.
1. Contain
Freeze or close the specific accounts affected, and change passwords immediately.
2. Report
File your Identity Theft Report at IdentityTheft.gov and, if needed, a local police report.
3. Document
Log every call, letter, and reference number as you go, not after the fact. If you have identity theft insurance, file your claim now. Most policies require it within 90 days.
4. Dispute
Send your Identity Theft Report to each affected creditor and bureau in writing. Our full walkthrough on how to dispute errors with every credit bureau covers Equifax, Experian, TransUnion, and the specialty bureaus (Innovis, ChexSystems, LexisNexis) most people forget.
5. Monitor
Add ongoing three-bureau monitoring to catch a second wave once the immediate fire is out.
Ready for Phase 5?
Check current pricing on three-bureau monitoring, dark web alerts, and insurance in one plan.
Compare Aura PlansWe may earn a commission if you sign up through this link, at no added cost to you.
Protecting Yourself After the Fire Is Out
Stolen data often resells on the dark web months after the original theft. That's exactly when a second wave of fraud tends to hit, once your guard is back down.
Three-bureau monitoring, not just a one-time freeze, is what catches that second wave. Look for a service that includes dark web scans and clear insurance terms, not just a headline number.
Common Mistakes People Make
Expert Tips From Aaron Bryce
Frequently Asked Questions
What's the very first thing I should do if my identity is stolen?
Call the company where the fraud occurred and ask them to close or freeze the account. Then place a free fraud alert with one credit bureau before doing anything else.
How much money am I responsible for if my identity is stolen?
Federal law caps credit card liability at $50, often reduced to zero if reported promptly. Most state laws protect you from debt on fraudulent new accounts entirely.
Do I need to file a police report?
Not always, but some creditors and extended fraud alert requests require one. It costs nothing and strengthens your case, so it's worth doing regardless.
What's the difference between a fraud alert and a credit freeze?
A fraud alert requires extra identity verification before new credit opens. A credit freeze blocks new accounts outright until you lift it. Both are free.
How long does identity theft recovery usually take?
Simple cases can resolve in weeks. Cases involving tax fraud or multiple accounts can take several months. Documentation from the start speeds up every step.
Should I still get identity theft protection after recovering?
Yes. Stolen data often resells months later, causing a second wave of fraud. Ongoing three-bureau monitoring catches what a one-time freeze can miss.
How long do I have to file an identity theft insurance claim?
Most policies require a claim within 90 days of discovering the fraud. Check your specific policy the same day you find the problem, since deadlines vary by provider.
The Bottom Line
The order matters more than any single tool. Contain the damage, file your report, document everything, dispute in writing, then add ongoing monitoring once the fire is out.
10:04 p.m. doesn't have to turn into a lost year. Move through the sequence above, and you'll be ahead of most people who freeze instead of act.
Cover Yourself Against the Next Wave
Start three-bureau monitoring, dark web alerts, and insurance once your immediate recovery is underway.
Compare Aura Plans NowWe may earn a commission if you sign up through this link, at no added cost to you.
Verified Sources
- Federal Trade Commission, "How to recover from identity theft," consumer.ftc.gov
- Federal Trade Commission, "Identity Theft: A Recovery Plan," IdentityTheft.gov
- Texas Attorney General, "What to Do If Your Identity Is Stolen," security freeze timing rules
- Internal Revenue Service, "Identity Theft Guide for Individuals," IRS Form 14039 and Identity Protection PIN program
- Fair Credit Billing Act, $50 consumer liability limit for unauthorized credit card charges
- Ramsey Solutions, "How to Freeze Your Credit"; Suze Orman, "Identity Theft" resource page
- Office for Victims of Crime, ovc.ojp.gov; AnnualCreditReport.com
Aaron Bryce
Senior Credit & Identity Protection Editor at UpTrendCredit. Aaron has spent more than a decade analyzing identity theft protection and credit monitoring products. He turns dense policy language into decisions readers can act on the same day.
Not a licensed attorney or financial advisor. This article is educational only and is not personalized legal, tax, or financial advice.
UpTrendCredit is not a law firm, financial advisory firm, or credit repair organization. This information is educational only, not legal, tax, or financial advice, and does not create any advisor-client or attorney-client relationship. Recovery timelines, liability rules, and provider terms vary and are subject to change; confirm current details directly with the FTC, your credit bureaus, and each provider.
Identity theft can take a real emotional toll. If it's weighing on you, the Office for Victims of Crime maintains a directory of support resources at ovc.ojp.gov, in addition to speaking with a counselor of your choice.