A collections call about a card you never opened. A loan denial that makes no sense. A data-breach letter offering you free monitoring. However you find out, the moment you suspect your identity has been stolen, the clock matters — and the playbook has gotten meaningfully better than it was a decade ago. Nearly everything below is free, and federal law is on your side at every step.

Step 1: Freeze your credit at all three bureaus

A security freeze blocks lenders from pulling your credit file for new applications, which stops most new-account fraud cold. Freezes have been free nationwide by federal law since 2018, they last until you lift them, and lifting one for a legitimate application takes minutes online. Unlike a fraud alert, a freeze must be placed with each bureau separately — Equifax, Experian and TransUnion all have to hear from you. Do this first; everything else can happen with the doors already locked.

Step 2: Place a fraud alert — one call covers all three

An initial fraud alert tells lenders to take extra steps to verify identity before opening credit in your name. It is free, lasts one year (it was a mere 90 days before the law changed in 2018), and is renewable. Here the rule is the reverse of freezes: place it with any one bureau and that bureau must notify the other two. Victims with a completed identity-theft report can later upgrade to an extended alert lasting seven years.

Step 3: Report it at IdentityTheft.gov

The FTC's IdentityTheft.gov generates two things you will need: a personalized recovery plan and an official FTC Identity Theft Report. That report is the document that unlocks your federal rights — including the power to make bureaus block fraudulent accounts and inquiries from your file rather than merely dispute them, and to force businesses to hand over records about accounts the thief opened. A police report is no longer required in most cases; it is still worth filing if you know the thief, the theft involves a crime you witnessed, or a creditor demands one.

Step 4: Pull your reports and hunt line by line

You can now get your credit report from each bureau free every week at AnnualCreditReport.com — the old once-a-year limit is gone for good. Pull all three and go line by line: accounts you did not open, balances that are wrong, hard inquiries you do not recognize, addresses and employers that are not yours. Dispute each item in writing with the bureau and the business involved, attaching your FTC report. Under the blocking process, bureaus generally must remove properly documented fraudulent items within days, not months.

Step 5: Contain the accounts you already have

  • Call the fraud department of any company where an account was opened or misused. Close or freeze the account, get new card numbers, and change logins — starting with your email, which is the master key to everything else.
  • Turn on two-factor authentication everywhere it is offered, and prefer an authenticator app over text messages.
  • Protect your phone number: ask your carrier for a port-out or SIM-swap lock, since thieves who hijack your number can intercept verification codes.
  • Get an IRS Identity Protection PIN at irs.gov if there is any chance of tax-refund fraud — it stops anyone from filing a return in your name without the PIN.
  • Watch your bank accounts and dispute unauthorized transactions promptly — the sooner you report, the stronger your legal protection against losses.

Step 6: Keep records, and keep watching

Log every call — date, company, person, what was agreed — and keep copies of every letter and report. Recovery is mostly a paperwork war, and the side with the paper trail wins. Then keep the habit: with weekly free reports and a standing freeze, the ongoing cost of vigilance is about twenty minutes a month. Most people should simply leave the freeze on permanently and thaw it only when they actually apply for credit — it is the single most effective free protection that exists.