Identity theft recovery, step by step, in the order that works

The most common recovery mistake is starting in the wrong place. People find a strange account, open a dispute with a credit bureau online, and wait 30 days for an answer that comes back “verified.” They skipped the one document that changes how bureaus and lenders have to treat them: the Identity Theft Report.

The FTC’s recovery plan at IdentityTheft.gov has a specific order for a reason. Each step produces something the next step needs, and the law behind each one explains why skipping ahead costs you time.

The sequence at a glance

These steps come from the FTC’s own recovery guide. Do them in this order.

1. Call the fraud department at each company where you know fraud happened. Ask them to close or freeze the affected accounts, then change those logins, passwords and PINs.
2. Place a free fraud alert with one credit bureau. That bureau must notify the other two.
3. Get your credit reports from Equifax, Experian and TransUnion and mark every account, inquiry and address you don’t recognize.
4. Report the theft to the FTC at IdentityTheft.gov or 1-877-438-4338. Your answers generate your Identity Theft Report and a recovery plan.
5. Close the fraudulent accounts and remove bogus charges, using the report.
6. Correct your credit reports, ideally with a block request under FCRA section 605B.
7. Add longer protection: an extended fraud alert, freezes at every bureau, or both.

Steps 1 through 4 are the first-day work. Steps 5 through 7 take longer, sometimes weeks.

Why the Identity Theft Report comes before disputes

Step 3 is where you find the damage. Step 4 is what gives you the legal tools to remove it. Without an Identity Theft Report, you can still dispute errors, but the FTC says that route takes longer and isn’t guaranteed. With one, specific legal duties kick in.

The FTC’s sample letters for credit bureaus, businesses and debt collectors all enclose the Identity Theft Report, not a police report. If you don’t create an account on IdentityTheft.gov, print or save the report and recovery plan before leaving the page, because the FTC says you can’t get back to them afterward.

Alerts, freezes and the reports themselves

The fraud alert in step 2 is quick and keeps your report visible to lenders with a flag asking them to verify your identity. It lasts one year. Once you have the Identity Theft Report, you qualify for an extended alert, which lasts seven years and requires lenders to contact you before approving credit (15 U.S.C. 1681c-1).

A freeze is the stronger lock on the front door, and anyone can place one free at each bureau. It can wait until after you’ve pulled your reports, since you’ll need access to them anyway. Freezing the specialty agencies too, like ChexSystems for bank accounts and NCTUE for phone and utility accounts, is covered in freezing every bureau.

When you review your reports, look past the account list. Check the addresses, employers, name spellings and inquiries. An unfamiliar address is often how a thief redirected mail. You can get free weekly reports from all three bureaus at AnnualCreditReport.com.

Clearing each fraudulent account

For each account a thief opened, call the business’s fraud department and ask them to close it. Then ask for a letter saying three things: the account isn’t yours, you aren’t liable for it, and it has been removed from your credit reports. The business may want a copy of your Identity Theft Report or its own dispute form. For fraudulent charges on a real account of yours, ask the company to remove them and confirm in writing.

Then deal with the reports. The FTC’s model letter to the bureaus asks them to block the fraudulent items under section 605B and notify the furnishers. The bureau has 4 business days from receiving your identity proof, the Identity Theft Report, the list of items and your statement that they aren’t your transactions (15 U.S.C. 1681c-2). How that block works, and when a bureau can refuse it, is in the 605B identity theft block. The free letter builder can help you lay out the items.

If a debt collector contacts you about a fraudulent debt, the FTC advises writing to the collector within 30 days of getting its collection letter, saying the debt isn’t yours and enclosing your Identity Theft Report. Ask the original business to stop reporting the debt as well. For inquiries and accounts in more detail, see fraudulent accounts and inquiries on your report.

How much of the stolen money you owe

On credit cards, the FTC says your liability for unauthorized use is capped at $50, and it’s $0 if only the card number was stolen, not the card itself. Report the charges to the issuer anyway, in writing, so the dispute is on record.

Debit cards and bank accounts are different, and timing matters. The FTC lays out the tiers for a lost or stolen debit card:

Example: say your wallet is stolen on a Friday and the thief drains $1,200 from checking with your debit card. If you report the loss by Tuesday, two business days later (assuming no holiday), the most you can lose is $50. If you notice on day ten and report it then, your exposure rises to as much as $500 of the $1,200. Wait past 60 days after the statement showing the withdrawals and the FTC says you could lose everything taken, and possibly more.

Theft that doesn’t show up on a credit report

Some identity theft never touches Equifax, Experian or TransUnion. The FTC’s plan covers these separately:

• Tax identity theft: respond to the IRS notice, file IRS Form 14039 (it can be submitted through IdentityTheft.gov), and file your own return and pay what you owe. The IRS identity theft line listed by the FTC is 1-800-908-4490.
• Social Security number misuse: review your work history at ssa.gov/myaccount and contact your local Social Security office about errors.
• Checking accounts: request your ChexSystems report, stop payment on stolen checks and close the account.
• Phone and utility accounts: request your NCTUE report and close fraudulent service with the provider.
• Medical identity theft: request records from each provider involved, report errors in writing with your Identity Theft Report, and notify your insurer’s fraud department.
• A child’s identity: tell each company the child is a minor who can’t legally enter contracts, ask for a closing letter, request a manual search for the child’s credit report, and request a freeze for the child at each bureau.
• Criminal records in your name: contact the agency that arrested the thief, file an impersonation report, and ask for a “clearance letter” or “certificate of release” to carry with you.

Several of these run on specialty reports. Specialty consumer reports explains how to request and dispute them.

Keep a recovery file

You’ll repeat the same facts to a dozen people. Keep one folder, paper or digital, with:

• Your Identity Theft Report and recovery plan
• Copies of every letter you send, with the date and the tracking number if mailed
• A call log: date, company, name of the person, what they agreed to do
• Every confirmation letter you receive saying an account was closed or removed
• Your freeze PINs and the dates each freeze was placed

When a block or account closure stalls, this file is what you’ll attach to a follow-up letter or a complaint. It also helps if the same fraudulent debt resurfaces months later with a new collector, which happens. Pull your reports again after each round of fixes to confirm the items are gone.