Identity theft first steps: The move that protects your money

In the first 24 hours, do four things in this order: call the fraud department of each company where the theft happened, place a free fraud alert with one credit bureau, file a report at IdentityTheft.gov, and freeze your credit at Equifax, Experian and TransUnion. The first three are the FTC’s own “right away” steps; the freeze takes minutes online and costs nothing. The report from IdentityTheft.gov matters most, because it triggers your strongest legal right: a credit bureau must block fraudulent accounts from your report within 4 business days of receiving it with proof of your identity.

Hour one: call the companies where the fraud happened

Start with every account you know was misused: the card with charges you did not make, the bank account with a withdrawal you did not authorize, the phone line someone opened. Call the fraud department using the number on your card, your statement or the company’s website, never a number from a text or email you received. Say that someone stole your identity, and ask the company to close or freeze the affected accounts so no one can add charges. Then change the logins, passwords and PINs for those accounts.

Speed matters most for debit cards. Under the federal rules for electronic transfers, if you report a lost or stolen debit card within two business days of learning about it, your loss is capped at $50. Wait longer and it can reach $500, and unauthorized transfers you fail to report within 60 days of the statement showing them can leave you liable for later transfers with no cap. Credit cards are safer: your liability for unauthorized use is capped at $50 by law.

Write down whom you spoke to, when, and what they agreed to do. You will need that log later.

Hours one to three: fraud alert, then the FTC report

Place a fraud alert. Contact one of the three bureaus and ask for an initial fraud alert; that bureau must pass it to the other two. It is free, lasts one year, and tells lenders to verify your identity before opening an account in your name. It also entitles you to a free copy of your report from each bureau. Pull all three, at the bureaus or at AnnualCreditReport.com, and list every account, inquiry and address you do not recognize. That list feeds the next step.

Report it to the FTC. Go to IdentityTheft.gov, or call 1-877-438-4338, and describe what happened in as much detail as you can. The site produces two documents: your FTC Identity Theft Report and a personal recovery plan, with prefilled letters to bureaus, businesses and debt collectors. Create an account so you can come back to both; if you do not, print or save them before you leave the page.

The Identity Theft Report is an official report to law enforcement, and the FTC says it is enough for the credit bureaus and most companies. File with your local police as well if you know who the thief is or a company asks for a police report.

Before the day ends: freeze your credit

A fraud alert asks lenders to be careful; a freeze stops a new lender from pulling your file at all, so most new accounts cannot be approved. Place one at each bureau through the Equifax, Experian and TransUnion freeze pages. Unlike the alert, a freeze must be requested at each bureau separately.

Federal law makes it free to place and lift, and a request made online or by phone must take effect within one business day. A freeze does not lower your score. It does not stop you from seeing your own reports, and it does not cut off the companies where you already have accounts, which can still review them. What it does block is new credit for you too: before you apply for a loan or a card, lift it at the bureau that lender uses, which the bureau must do within one hour of an online or phone request. Our guide to credit freezes and locks covers the details, including the smaller bureaus worth freezing.

Within the week: block the fraudulent accounts

An ordinary dispute gives a bureau 30 days to investigate. Identity theft victims have a faster tool. Under section 605B of the Fair Credit Reporting Act, a bureau must block fraudulent information from your report within 4 business days of receiving:

1. proof of your identity, such as a copy of your driver’s license;
2. a copy of your Identity Theft Report;
3. a list of the accounts, inquiries or other items that resulted from the theft;
4. a statement that those items do not relate to any transaction you made.

Send that package to each bureau that shows the items; IdentityTheft.gov prefills the letter. The bureau must also notify the company that reported each item. It can refuse or reverse a block only on narrow grounds, such as a block requested in error, a material misrepresentation, or evidence that you received goods, services or money from the transaction. Once blocked, the information does not appear on your report, and the FTC notes that companies cannot try to collect that debt from you.

The same report lets you upgrade to an extended fraud alert. It lasts seven years, gives you two free reports from each bureau in the next 12 months, and removes you from prescreened offer lists for five years.

For the full dispute process when an item is not identity theft, see how to dispute a credit report error.

What to do next, by type of theft

Someone used an existing card or account. Dispute each unauthorized charge with the issuer or bank, ask for a new card or account number, and ask for written confirmation that the charges were removed. Keep checking statements for a few cycles for charges you missed the first time.

Someone opened new accounts in your name. Call the fraud department of each business with your Identity Theft Report in hand, ask it to close the account, and ask for a letter confirming the account is not yours, that you are not liable, and that it was removed from your credit reports. Under section 609(e) of the FCRA, the business must also give you copies of the application and transaction records within 30 days of a written request that includes proof of your identity and of the theft. If a debt collector contacts you about one of these accounts, write to it within 30 days of its first letter, say the debt resulted from identity theft and enclose the report (see your rights with a debt collector).

Someone used your Social Security number for taxes or work. If an IRS notice says a return was filed with your number, follow its instructions and file IRS Form 14039, the Identity Theft Affidavit, which you can also submit through IdentityTheft.gov. To stop it from happening again, get an IRS Identity Protection PIN: a six-digit number, issued each year, without which no one can file a return using your Social Security number. Anyone who can verify their identity can get one, fastest through an online IRS account. If you suspect someone is working under your number, check your earnings record in a my Social Security account at the Social Security Administration.

Recheck your three reports in a month or two to confirm the blocks held and nothing new appeared. Free weekly reports make that easy, and our guide to where to get free credit reports explains the options.