What Actually Happens If Your Identity Is Stolen
Identity theft isn't one event — it's a cascade. Someone gets your Social Security number, and suddenly you're fighting fraudulent accounts, tax returns filed in your name, and credit damage you didn't cause. Here's the step-by-step response plan, the real timeline of recovery, and exactly how to protect yourself.
In 2023, the FTC received over 5.4 million identity theft and fraud reports, with total losses exceeding $10 billion. Identity theft ranges from a stolen credit card number (annoying but fixable in days) to full synthetic identity fraud — where someone builds an entire financial identity using your Social Security number (devastating and can take years to resolve). The good news: federal law heavily protects consumers from financial liability. The bad news: recovering your clean credit, time, and peace of mind takes real effort. Here's exactly what to do.
Hour 1–24: The Emergency Response
Speed matters enormously in identity theft. The faster you act, the less damage accumulates. Here's your priority checklist for the first 24 hours:
Step 1: Freeze Your Credit at All Three Bureaus
This is the single most important action. A credit freeze prevents anyone — including you — from opening new accounts until you lift it. It's free, it takes about 10 minutes per bureau, and it stops most identity theft damage immediately.
- Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 800-685-1111
- Experian: experian.com/freeze/ or call 888-397-3742
- TransUnion: transunion.com/credit-freeze or call 888-909-8872
Each bureau gives you a PIN or password to thaw the freeze later. Store these securely — you'll need them anytime you legitimately apply for credit. A credit freeze does not affect your credit score and does not impact your existing accounts.
A credit freeze blocks all new credit applications entirely — it's a hard stop. A fraud alert asks creditors to verify your identity before opening accounts, but doesn't guarantee they will. A freeze is stronger protection and what you want in an active identity theft situation. A fraud alert is useful as an additional layer. You can place both simultaneously.
Step 2: File at IdentityTheft.gov
Go to IdentityTheft.gov (the FTC's official identity theft site) and complete the reporting process. This generates two critical documents:
- A personalized recovery plan: Step-by-step instructions based on your specific type of identity theft
- An FTC Identity Theft Report: An official document you'll use to dispute fraudulent accounts with creditors and credit bureaus. This report carries legal weight — creditors are required to respond to disputes accompanied by an FTC report
Step 3: Contact Compromised Accounts
Call the fraud department of every financial institution where unauthorized activity has occurred. For each account:
- Request an immediate freeze or closure of the compromised account
- Ask for new account numbers and cards
- Request written confirmation of the fraudulent charges and the account closure
- Ask if the institution has an identity theft affidavit — fill it out and return it
Step 4: File a Police Report
While police rarely investigate individual identity theft cases, a police report creates an official record that some creditors and insurers require. File with your local police department — most now accept online reports for identity theft. Keep the report number and a copy of the report.
| Action | Time required | Priority |
|---|---|---|
| Credit freeze (all 3 bureaus) | 30 minutes total | CRITICAL — do first |
| IdentityTheft.gov report | 15–30 minutes | CRITICAL — do same day |
| Contact compromised accounts | 30–60 minutes | CRITICAL — do same day |
| File police report | 15–30 minutes | Important — do within 48 hrs |
| Change passwords / enable 2FA | 30–60 minutes | Important — do within 48 hrs |
Week 1–4: Damage Assessment and Dispute
With the emergency response complete, the next phase is understanding the full scope of the damage and beginning the dispute process.
Pull Your Credit Reports
Request free credit reports from all three bureaus at AnnualCreditReport.com (the only federally authorized source). Review every account, every inquiry, and every address listed. Mark anything you don't recognize. Fraudulent entries you might find include:
- Accounts you didn't open: Credit cards, personal loans, auto loans, or store accounts opened in your name
- Hard inquiries you didn't authorize: Each represents an attempt (successful or not) to open credit in your name
- Unfamiliar addresses: Thieves often change the address on your accounts to intercept statements and new cards
- Incorrect personal information: Name variations, unknown employers, or unfamiliar phone numbers
Dispute Fraudulent Items
For every fraudulent entry, file a dispute with the relevant credit bureau. Include your FTC Identity Theft Report. Under the Fair Credit Reporting Act (FCRA), the bureau must investigate within 30 days and remove items that are confirmed fraudulent. You can also dispute directly with creditors — send them your FTC report along with a dispute letter explaining which charges are fraudulent. Creditors must respond within 30 days.
Federal law heavily favors identity theft victims. The Fair Credit Reporting Act requires bureaus to block fraudulent information within 4 business days when you provide an FTC report. The Fair Credit Billing Act limits your credit card liability to $50 (and most issuers waive that). The Electronic Fund Transfer Act protects debit card transactions. Document everything, file your disputes in writing (not just by phone), and keep copies of all correspondence — but know that the law is on your side.
Types of Identity Theft — and Their Specific Impacts
Credit Card Fraud
The most common and usually the simplest to resolve. Someone uses your card number for unauthorized purchases. Your liability is capped at $50 by federal law, and virtually all major issuers have zero-liability policies. The card issuer typically resolves these within 1–2 billing cycles. Impact: temporary inconvenience, minimal financial damage.
New Account Fraud
Someone opens new credit cards, loans, or utility accounts using your personal information. This is more damaging because the fraudulent accounts can accumulate balances and missed payments that appear on your credit report. Resolution requires disputes with each creditor and each credit bureau — typically 30–90 days per account.
Tax Identity Theft
Someone files a tax return using your SSN to steal your refund. You'll discover this when the IRS rejects your e-filed return because one has "already been filed." This is increasingly common and frustratingly slow to resolve:
- File IRS Form 14039 (Identity Theft Affidavit) with your legitimate tax return by mail
- Resolution timeline: 6–18 months. The IRS identity theft unit is chronically backlogged
- Request an IP PIN: After resolution, the IRS issues an Identity Protection PIN — a unique 6-digit number you'll include on all future returns. This prevents repeat fraud. You can proactively request an IP PIN even if you haven't been a victim at irs.gov/ippin
Medical Identity Theft
Someone uses your identity to obtain medical care, prescriptions, or insurance benefits. This is dangerous beyond the financial impact — false medical records (wrong blood type, medications, conditions) can affect your future medical care. Request your medical records from providers and insurers, dispute inaccurate entries, and file a complaint with HHS if a HIPAA-covered entity was involved.
Synthetic Identity Theft
The hardest to detect. Thieves combine your SSN with a fake name and other fabricated details to create an entirely new identity. This "synthetic" identity builds its own credit history, and you may not discover the fraud until it affects your SSN record — sometimes years later. This is why regularly monitoring your credit (and your SSA earnings record at ssa.gov/myaccount) is critical.
Identity theft doesn't just affect your credit. If someone uses your SSN for employment, their earnings get reported to the Social Security Administration under your number — which can complicate your future benefits. Check your earnings record at ssa.gov/myaccount at least once a year and report any unfamiliar employers or earnings immediately.
Long-Term Protection: Preventing Future Theft
Once you've resolved the immediate crisis, these ongoing practices significantly reduce your risk of repeat victimization:
- Keep credit freezes active permanently. Only thaw when you need to apply for credit. A frozen credit file is the single strongest defense against new account fraud
- Use unique, strong passwords for every financial account. A password manager (1Password, Bitwarden, etc.) makes this manageable
- Enable two-factor authentication (2FA) on every financial account, email account, and social media account. Use an authenticator app — not SMS, which can be intercepted via SIM swapping
- Monitor your credit regularly. Free credit monitoring through Credit Karma, your bank, or your credit card issuer provides alerts when new accounts or inquiries appear on your report
- Request your free annual credit reports at AnnualCreditReport.com and review them for any unfamiliar entries
- Opt out of pre-screened credit offers at OptOutPrescreen.com — these mailers are an easy target for identity thieves who steal mail
Liability Limits: What You Actually Owe
| Account type | Your max liability | Key condition |
|---|---|---|
| Credit card | $50 (usually $0) | Report within 60 days of statement |
| Debit card (reported <2 days) | $50 | Report within 2 business days |
| Debit card (reported 2–60 days) | $500 | Report within 60 days |
| Debit card (reported >60 days) | Unlimited | Report ASAP — delay is costly |
| ACH/bank transfers | Varies | Report within 60 days for protection |
* Most major banks and card issuers offer zero-liability policies beyond these federal minimums.