Finding out someone has used your name to open an account, file a tax return or run up charges is stressful. The fix is rarely quick, but it is a known process, and the federal government has built free tools to walk you through it. This guide covers how to spot identity theft, what to do in the first hour, and how to clean up afterward.
Signs Your Identity May Have Been Stolen
The Federal Trade Commission (FTC) lists several warning signs worth taking seriously:
- Bills you expect stop arriving, which can mean someone changed your billing address.
- Statements show charges you didn’t make, or you get a bill for something you never bought.
- Your bank account shows withdrawals you don’t recognize.
- Your credit reports list accounts you never opened.
Tax-related identity theft often shows up differently: an IRS letter about a return you didn’t file, or a rejected e-file because a return was already submitted under your Social Security number.
Step 1: Report It at IdentityTheft.gov
Start at IdentityTheft.gov, the FTC’s official site. You answer questions about what happened, and the site builds a free, personal recovery plan with your next steps. It also lets you track progress and print pre-filled letters to send to credit bureaus, businesses and debt collectors.
- The site is in English; Spanish speakers can use RobodeIdentidad.gov.
- For help in another language, the FTC says to call 877-438-4338 and press 3. Interpreters are available 9 a.m. to 5 p.m. Eastern.
Completing the report also gives you an FTC Identity Theft Report. Keep a copy: it unlocks some protections, including the seven-year extended fraud alert described below.
Step 2: Lock Down Your Credit
Place a Credit Freeze
A credit freeze stops anyone, including a thief, from opening new credit in your name. It is free to place and free to lift, and it stays in place until you remove it. You have to contact each of the three bureaus separately: Equifax, Experian and TransUnion. When you need to apply for credit yourself, you can lift the freeze temporarily with the bureau your lender uses. Our step-by-step guide on how to freeze your credit has the details for each bureau.
Add a Fraud Alert
A fraud alert asks businesses to verify your identity before opening a new account. You can use one alongside a freeze.
- Initial fraud alert: free, lasts one year and can be renewed. Contact any one bureau, and it must tell the other two.
- Extended fraud alert: free, lasts seven years. You need an FTC Identity Theft Report from IdentityTheft.gov or a police report. It also takes you off prescreened credit and insurance offer lists for five years unless you ask otherwise.
Step 3: Check Your Credit Reports
Pull your free reports from all three bureaus and read them line by line. Look for accounts, addresses, employers or hard inquiries you don’t recognize. Write down anything suspicious, along with the creditor’s name and the account number shown. Our guide on checking your credit reports for free explains where to get them safely.
Step 4: Contact the Companies Involved
Go through your bills and statements, then call the fraud department of each company where a fake account was opened or a charge was made. Ask them to close the account and remove the charges, and follow up in writing. The pre-filled letters from IdentityTheft.gov are made for exactly this.
A few habits make this stage much easier:
- Keep a log of every call: the date, the person you spoke with and what they agreed to do.
- Send important letters by certified mail and keep copies.
- Change the passwords and PINs on any account that was touched, and turn on two-factor sign-in where it is offered.
Step 5: Deal With Tax-Related Identity Theft
If the theft involves your taxes, the IRS has its own process. Its guidance for individuals boils down to this:
- Don’t engage with anyone claiming to be the thief, and don’t send money or information.
- If you have an IRS Online Account, change its password to a strong, unique one.
- If you got an IRS letter or notice, first confirm it is real, then follow its instructions. If it points you to the Identity and Tax Return Verification Service, use that.
- Report the theft and follow your recovery plan at IdentityTheft.gov.
- Keep filing your returns and paying your taxes as usual.
- Check with your state tax agency for any extra steps.
Do You Need Form 14039?
Probably not. The IRS says most people don’t need to file Form 14039, the Identity Theft Affidavit. Skip it if you already filed one, already reported through IdentityTheft.gov, already received an IRS letter about the problem, or were told to use the verification service. The IRS says to file it only if it asks you to, if you can’t use the verification service, or if you want to flag possible tax identity theft it doesn’t know about yet, such as after a data breach.
Get an Identity Protection PIN
An IP PIN is a six-digit number that stops anyone else from filing a federal return with your Social Security number. The fastest way to get one is through the IP PIN section of your IRS Online Account. If you can’t create or access an account, the IRS says you can file Form 15227 instead. See our guide on getting an IRS Identity Protection PIN for the full walkthrough.
Useful IRS Phone Numbers
- 800-908-4490: to verify your identity and tax return. This line can’t give refund status.
- 800-829-1040: general account questions, or to check whether a letter is real.
- 800-908-9946: to request a copy of your tax return.
Keep a Recovery File
Identity theft cleanup can stretch over weeks or months, so put everything in one place: your FTC report, copies of letters, your call log, dispute confirmations and any IRS notices. If a debt collector contacts you later about a fraudulent account, this file is your proof.
A First-Day Checklist
If you just discovered the problem and feel overwhelmed, this is the short version. You don’t have to finish everything today, but getting these done first limits the damage:
- File your report at IdentityTheft.gov and save the recovery plan and Identity Theft Report it gives you.
- Freeze your credit at Equifax, Experian and TransUnion.
- Call the fraud department at any bank or company where you’ve already spotted suspicious activity.
- Change the password on your main email account first, since it’s the key to resetting everything else, then move on to banking and shopping accounts.
- Start your recovery file and your call log.
Tomorrow, pull your credit reports and go through them carefully. Later in the week, send dispute letters and, if taxes are involved, work through the IRS steps above. Breaking it into small pieces makes the process far less daunting.
After Things Settle Down
Once the immediate damage is handled, a few low-effort habits help keep it from happening again:
- Leave your credit freezes in place and lift them only when you apply for credit.
- Check your credit reports regularly, not just after a scare.
- Watch your bank and card statements every month, and set up transaction alerts in your banking app.
- Use a password manager so every account has its own password, and fix any that have shown up in a data leak.
None of this makes you immune. But the faster you spot a problem and start the process, the less damage a thief can do.
More on Contoh
- How to Freeze Your Credit (and Unfreeze It When You Need To)
- How to Get an IRS Identity Protection PIN Before Tax Season
- How to Check Your Credit Reports for Free (Every Week)