The Identity Theft Recovery Checklist: 7 Steps to Take Right Now

Quick summary

Just found accounts or charges that aren't yours? Start this identity theft recovery checklist now. The sooner you move, the less a thief can do with your information — and the good news is that recovery is a known, ordered process where every step is free. You never have to pay a company to do any of it for you.

Here's the whole checklist in order: (1) lock down the accounts where fraud already happened, (2) place a free one-year fraud alert, (3) pull and review all three credit reports, (4) report at IdentityTheft.gov to get your FTC Identity Theft Report, (5) freeze your credit at all three bureaus, (6) dispute and block the fraudulent items, and (7) lock in long-term monitoring. Two moves anchor everything else: the fraud alert, because it's fast, and the FTC Identity Theft Report, because it's the document that unlocks the rest.

The 7-step identity theft recovery checklist

Work these in order. The first three you can knock out in the first hour; the rest follow over the first day and week.

Step 1 — Lock down the accounts where fraud already happened

Start where you can see the damage. Call the bank, card issuer, or company tied to the fraudulent charge and ask them to close or freeze that specific account so no new charges can land. Then change the passwords and PINs on anything connected to it. The FTC's recovery guidance puts this first for a reason: it's the only step that protects accounts you already hold. Fraud alerts and freezes — which come next — guard against new accounts, not the ones a thief has already gotten into.

Step 2 — Place a free one-year fraud alert

Now make it harder for the thief to open anything new. A fraud alert is a single free phone call to any one of the three credit bureaus — Equifax, Experian, or TransUnion — and the one you contact has to notify the other two. Once it's on your file, a business must verify your identity before opening a new credit account in your name. An initial alert lasts one year, and per the (https://www.consumerfinance.gov/ask-cfpb/what-do-i-do-if-i-think-i-have-been-a-victim-of-identity-theft-en-31/) it also entitles you to a free credit report from each bureau — separate from your annual free reports.

Keep this in your back pocket: once you file your FTC report in Step 4, you can upgrade to a seven-year extended alert. More on that in Step 7.

Step 3 — Pull and review all three credit reports

Use the free report each bureau owes you and read all three line by line. You're hunting for anything you don't recognize — accounts you never opened, hard inquiries from lenders you never applied to, addresses that aren't yours. Pull from all three, because a thief's handiwork doesn't always land on every report.

As you go, write down every fraudulent item with its exact account number. You'll need that list — verbatim — for the block in Step 6, so getting it right now saves you a round of back-and-forth later.

Step 4 — Report at IdentityTheft.gov and get your FTC Identity Theft Report

This is the keystone step. File your report at IdentityTheft.gov, the FTC's one-stop site, and you'll walk away with two things: a free personalized recovery plan, and an official FTC Identity Theft Report. That report is the credential creditors and credit bureaus accept as proof you're a genuine victim — it's what powers the block in Step 6 and the extended fraud alert in Step 7. The (https://consumer.ftc.gov/consumer-alerts/2024/09/how-recover-identity-theft) also hands you printable checklists and pre-filled dispute and account-closure letters, so you're not drafting anything from scratch.

You don't always need a police report on top of this. File one when a creditor specifically demands it, when you know who the thief is, or when there's a related crime like a stolen wallet.

Step 5 — Freeze your credit at all three bureaus

A freeze is the stronger sibling of the fraud alert: it blocks new creditors from seeing your file at all, so no one can open an account until you lift it. It's free under federal law — both to place and to temporarily lift when you need to apply for credit yourself. The one catch, noted by both the (https://www.consumerfinance.gov/ask-cfpb/what-do-i-do-if-i-think-i-have-been-a-victim-of-identity-theft-en-31/) and (https://www.equifax.com/personal/education/identity-theft/articles/-/learn/fraud-alert-security-freeze-credit-lock/), is that you have to place it separately at each of the three bureaus. Our step-by-step on how to (/how-to-freeze-your-credit-at-all-three-bureaus) walks through each one.

Remember the limit: a freeze stops new accounts, not fraud on the ones you already have. That's exactly why Step 1 came first.

Step 6 — Dispute and block the fraudulent items

Here's where the fraud actually comes off your reports. Send each bureau three things: a copy of your FTC Identity Theft Report, proof of your identity, and a letter listing the fraudulent items with a clear statement that they aren't yours. Under (https://www.law.cornell.edu/uscode/text/15/1681c-2), the bureau must block that information within four business days of receiving those elements. And once the bureau notifies the company that supplied the fraudulent data, that company can't turn the identity-theft debt over to a debt collector.

This blocking right is one of the strongest tools you have, so it pays to understand (/fcra-basics-your-rights-under-the-fair-credit-reporting-act) before you send the letters. If a bureau drags its feet or rejects a valid request, you can (/how-to-escalate-a-credit-bureau-dispute-to-the-cfpb).

Step 7 — Lock in long-term monitoring

Recovery doesn't end when the disputes clear. Now that you have an FTC Identity Theft Report, convert your one-year fraud alert into the seven-year extended alert — it also gets you two free credit reports over the next twelve months and takes your name off pre-screened credit-offer lists. From there, keep a rotating credit-report check going across all three bureaus, and keep watching your existing-account statements, since those aren't covered by alerts or freezes.

How to put this into practice

Think of the checklist in three waves. In the first hour, do Steps 1–3: kill the active fraud, drop a fraud alert, pull your reports. Within the first day, file at IdentityTheft.gov (Step 4) so you have your report in hand. Over the first week, freeze all three bureaus, send your block letters, and set up monitoring (Steps 5–7).

Whatever you do, document everything. Log every call with the date, the name of the person you spoke to, and a confirmation number, and keep copies of your FTC Identity Theft Report and every letter you send. Disputes can run more than one round, and your paper trail is what carries you through them.

And hold on to the free principle. Every core step here — the fraud alert, the freeze, your reports, the FTC report, the sample letters — costs nothing. Any "recovery service" that pressures you to pay up front to do these exact steps is a warning sign; it's worth knowing the (/credit-repair-scam-red-flags-ftc-warns-about) the FTC flags. And if the damage ran deep and your score took a real hit, our 12-month credit recovery roadmap covers the rebuild once the fraud is gone.

If, after recovery, you decide you'd rather have a reputable firm help with the rebuilding phase, you can (/#top-companies) — and if you sign up through us, Credit Repair Review may earn a commission. Under the Credit Repair Organizations Act (CROA), any legitimate company can't charge you before the work is done, must give you a written contract, and must let you cancel within three days, so check for all three before you pay anyone.

Frequently Asked Questions

Is a fraud alert or a credit freeze better after identity theft?

They do different jobs, so most victims use both. A fraud alert is one free phone call that tells lenders to verify your identity before opening new credit, and the bureau you call notifies the other two. A freeze is stronger — it blocks new creditors from seeing your file entirely — but you must place it separately at all three bureaus. Neither one protects accounts you already have, which is why reviewing existing statements is its own step.

Do I have to file a police report for identity theft?

Not always. The FTC Identity Theft Report you generate at IdentityTheft.gov is the document creditors and credit bureaus accept as proof in most situations. File a police report on top of it when a creditor or collector specifically requires one, when you know the thief, or when there's a connected crime like a stolen wallet. Together they form the paper trail your disputes rely on.

How fast do credit bureaus have to remove identity-theft information?

Under FCRA §1681c-2, a credit bureau must block identity-theft information within four business days of receiving four things: proof of your identity, a copy of your identity theft report, identification of the specific items, and your statement that the items aren't yours. Once a creditor is notified of the block, it can't hand that identity-theft debt to a collector.

Does fixing identity theft cost money?

No. Every core step — the fraud alert, the credit freeze, your credit reports, the FTC report and recovery plan, and the sample dispute letters — is free. A company that charges you to do these steps is selling something you can do yourself in an afternoon. If a "recovery service" pressures you to pay up front, treat it as a red flag.

How long should I keep monitoring my credit after identity theft?

Plan for years, not weeks. Victims who file an FTC Identity Theft Report qualify for an extended fraud alert that lasts seven years, plus two free credit reports over the first twelve months. Keep pulling your reports from all three bureaus on a rotating schedule, watch existing-account statements, and save copies of every report and confirmation number in case fraud resurfaces.

Conclusion

Identity theft feels chaotic, but recovery isn't — it's an ordered, free process. Move fast on the fraud alert, file at IdentityTheft.gov to unlock everything else, freeze and block to stop the bleeding, then monitor for the long haul. The sooner you start working the checklist, the less a thief can do with what they took. Bookmark IdentityTheft.gov and our freeze guide, and when you're ready to rebuild, (/#top-companies).