What to Do First If Someone Stole Your Identity

How we determined the right sequence of actions

We reviewed the FTC's own consumer guidance, the Fair Credit Reporting Act's provisions on security freezes, Consumer Financial Protection Bureau (CFPB) complaint data on identity theft recovery outcomes, and first-person accounts from identity theft attorneys and affected consumers. Our standard: what sequence of actions produces the fastest containment with the least bureaucratic friction? We weighted evidence on what actually stops new fraudulent accounts versus what merely documents the problem after the fact.

• ✓
  Federal law on credit freezes confirmed The Economic Growth, Regulatory Relief, and Consumer Protection Act (2018) established that all three major bureaus must provide free security freezes to any consumer upon request — no subscription, no fee, no waiting period.
• ✓
  FTC Identity Theft Report legal standing verified Under the Fair Credit Reporting Act, an Identity Theft Report filed at IdentityTheft.gov gives consumers the legal right to block fraudulent information from their credit report and to get copies of fraudulent account applications from creditors.
• ✓
  Fraud alert vs. credit freeze effectiveness reviewed A fraud alert only requires lenders to take "reasonable steps" to verify identity before extending credit — it does not block access to your credit file. A freeze blocks it entirely. For immediate containment, a freeze is materially stronger.
• ✓
  Sequence logic cross-checked against identity theft attorney guidance Legal consumer advocates consistently advise that containing new account fraud (via freeze) takes priority over disputing existing fraud, because disputing existing charges while new ones are still being opened is like bailing a boat with the hole still open.

The situation determines how far you need to go — here's how to calibrate

Not every case of suspected identity theft is the same — a compromised password is different from a fraudulent tax return — and the right level of response depends on how much damage has already occurred and how certain you are.

What most people do first — and why it's the wrong order

The instinct when you discover your identity may have been stolen is to call your bank, change your passwords, or Google "identity theft help" and land on a paid monitoring service. All of those things have their place — but none of them stop new accounts from being opened in your name, which is the most damaging thing a thief can do in the first 48 hours.

• ✗
  Signing up for a credit monitoring service before freezing your credit — Credit monitoring tells you after a new account has already been opened in your name; a freeze prevents it from being opened in the first place. Monitoring is reactive, a freeze is preventive — do the freeze first, consider monitoring later if you want ongoing alerts.
• ✗
  Calling only one credit bureau — Lenders check whichever bureau they prefer, and that varies by institution. If you only freeze one bureau, a thief can still open an account through a lender that checks a different one. You must freeze all three — Equifax, Experian, and TransUnion — separately.
• ✗
  Waiting to "see if anything happens" before acting — Identity theft moves fast. A Social Security number combined with a date of birth can be used to open multiple lines of credit in a matter of hours. Every day you wait before freezing your credit is a day you're exposed. Acting on suspicion — not confirmed proof — is the right call here.
• ✗
  Paying for a "credit freeze service" or identity theft resolution company upfront — You have the legal right to freeze your credit for free, directly with each bureau. Any company charging you to do this on your behalf is either overcharging for something you can do yourself in 15 minutes, or worse, a scam targeting people who are already victimized and vulnerable.