What to Do in the First 24 Hours After Identity Theft
This is general information, not legal advice. For your specific situation, talk to a lawyer.
Finding out your identity's been stolen is a gut-punch. A charge you didn't make, a letter about an account you never opened, a bank calling to confirm a purchase from across the country. Your instinct is to panic. Don't. The first 24 hours matter — but what matters more is doing the right things in the right order, calmly, and with a record of every step.
Here's exactly what to do, in order.
1. Freeze and alert the credit bureaus
Your very first move is to cut off new credit in your name. Contact the three major credit bureaus — Equifax, Experian, and TransUnion — and place a fraud alert (it's free, and one bureau is required to tell the other two). Better still, place a credit freeze at each one, which blocks new accounts from being opened until you lift it. A freeze is the single most effective thing you can do to stop the bleeding, and it costs nothing.
2. Contact the banks and card companies affected
Call the fraud department of every bank or card where you see unauthorized activity. Report the fraud, close or lock the compromised accounts, and ask for new cards and numbers. Most charges a thief makes aren't your responsibility once you report them quickly — but "quickly" is the operative word, which is why this comes near the top.
3. Change your passwords and turn on two-factor authentication
Start with your email, because whoever controls your email can reset everything else. Then your bank, and any account that shared that password. Use a different, strong password for each, and turn on two-factor authentication (2FA) everywhere it's offered. If a thief got in through one reused password, this closes the door behind them.
4. File a report at identitytheft.gov
The FTC's identitytheft.gov is the official federal starting point. Filing there generates an Identity Theft Report and a personalized recovery plan. That report is your proof — banks, bureaus, and businesses will ask for it when you dispute fraudulent accounts, so it's worth doing carefully.
5. File a police report if needed
If you know the thief, if a creditor demands it, or if someone used your identity in connection with another crime, file a report with your local police. Bring your FTC Identity Theft Report, a government ID, proof of address, and any evidence of the fraud. Get a copy of the report and its report number.
6. Check all three credit reports
Pull your reports from all three bureaus — you're entitled to free copies — and read them line by line. Look for accounts you didn't open, inquiries you don't recognize, and addresses that aren't yours. Each piece of fraud needs to be disputed in writing with both the bureau and the business involved.
7. Document everything
From the first phone call, keep a log: who you spoke to, the date and time, what they said, and any reference numbers. Save every letter and email. Send disputes in writing and keep copies. This paper trail is what turns "I think someone stole my identity" into a case you can actually win.
8. Watch for the follow-on fraud
Identity theft often comes in waves. The first fraudulent charge may just be a test. Over the following weeks, keep watching your accounts, your mail, and your credit for new activity — new accounts, medical bills for care you never got, tax or benefits fraud. Staying alert for a few months is part of the job.
What NOT to do
- Don't ignore it or "wait and see." Delay is the thief's best friend — every day left open is another account they can open.
- Don't pay a fraudulent debt to make it go away. Paying can look like you're accepting the debt. Dispute it instead.
- Don't call numbers from the suspicious message itself. Look up your bank's real fraud line independently — scammers love to "help" you fix the problem they created.
- Don't hand more personal information to anyone who contacted you first. Verify independently before you share anything.
How long this really takes on your own
Here's the part nobody warns you about: the steps above are the easy part. The recovery — disputing each account, following up when a bureau goes quiet, re-sending documentation, escalating when a business won't cooperate — can stretch over weeks or months and dozens of hours of phone calls. People routinely describe identity-theft recovery as a part-time job they didn't ask for, stacked on top of the one they already have.
And the emotional toll is real. It isn't just the money; it's not knowing how deep it goes, and the exhaustion of being the one who has to chase down every loose thread.
The kinds of fraud to keep watching for
Identity theft isn't one single thing, and the type shapes what you watch for over the following months:
- Financial and credit fraud — new cards or loans opened in your name. Your credit freeze and report checks catch most of this.
- Account takeover — a thief seizing an existing account (email, bank, a shopping profile). New passwords and 2FA are your main defense.
- Tax fraud — someone files a return in your name to grab your refund. People often find out only when their real return is rejected as a duplicate.
- Medical identity theft — care billed under your name, which can corrupt your medical records. Read the explanation-of-benefits statements your insurer sends.
- Child identity theft — a child's clean record and unused Social Security number are a quiet target. It can go undetected for years, so it's worth checking whether your child has a credit file at all.
Knowing which type you're dealing with tells you which accounts and documents deserve the closest watch — and it's common to be hit by more than one at once, so don't assume the first fraudulent charge is the whole story.
The easier way
You don't have to do the recovery alone. A family protection plan pairs identity monitoring — so you're warned early, often before you'd notice anything yourself — with licensed restoration specialists who do the heavy lifting for you. Instead of spending your evenings on hold, you hand the case to professionals who deal with bureaus and creditors every day, all for a flat monthly fee.
If you'd rather have a team on your side before something like this happens, see how the family plan's monitoring and restoration work. The best time to set that up is before anything goes wrong — monitoring only helps if it's already watching when the first alert comes.