Discovering that your identity has been stolen is a gut-wrenching moment. Whether it was a suspicious charge on your statement or a new credit card you never applied for, the feeling of violation is real.
Speed is your best friend, because the faster you act, the less damage the thief can do to your credit score and your peace of mind. Calling the bank stops new charges, but every account the thief opened stays on your Equifax, Experian, and TransUnion reports until you dispute it, so here are the 7 critical steps, in order, to reclaim your identity.
1. Sound the Alarm With the Companies Where Fraud Hit
Call the fraud department of every bank, card issuer, or company where you know fraud happened, and do it before anything else. That call is the only step that stops money from leaving an account today. Ask them to close or freeze the account, reverse the bogus charges, and give you a reference number.
- Close or Freeze Accounts: Stop the bleeding by making sure no new charges can land on the account.
- Change Logins: Update your passwords, PINs, and security questions for those accounts right away.
- Get It in Writing: Ask each company to confirm in writing that the account is closed and the charges are disputed.
Here is the order for the first day, and why each step comes where it does.
| Order | What to do | Why it comes here |
|---|---|---|
| First | Call fraud departments at affected companies | Stops new charges on accounts already hit |
| Second | Place a fraud alert or credit freeze | Blocks the thief from opening new accounts |
| Third | File a report at IdentityTheft.gov | Gives you the official proof for every dispute |
| Fourth | File a local police report | Adds a report number insurers and creditors ask for |
| Fifth | Pull your Equifax, Experian, and TransUnion reports | Shows every account the thief opened |
2. Place a Fraud Alert or Credit Freeze at All Three Bureaus
You need to make it impossible for the thief to open new accounts in your name. You have two tools for that, and both are free.
- Fraud Alert: Contact one of the three major bureaus (Equifax, Experian, or TransUnion). By law, the one you contact must notify the other two. The alert tells lenders to verify your identity before granting credit, and it lasts one year.
- Credit Freeze: For maximum security, a full credit freeze is often better. It prevents anyone (including you, until you “thaw” it) from opening new lines of credit. You place a freeze at each bureau yourself.
Once you have an identity theft report in hand, you can ask for a longer alert. We cover it in our guide to the extended fraud alert under FCRA Section 605A.
| Tool | What it does | Who sets it up |
|---|---|---|
| Fraud alert | Lenders must verify your identity before granting credit | One bureau, which tells the other two |
| Credit freeze | Blocks new credit until you thaw it | You, at each of the three bureaus |
| Extended fraud alert | A longer alert for confirmed identity theft victims | You, with an identity theft report |
If you are still deciding, read Credit Freeze vs Fraud Alert vs Credit Lock. Then follow How to Freeze Your Credit in 2026 bureau by bureau.
3. Report the Theft to the FTC at IdentityTheft.gov
Visit IdentityTheft.gov right away, because this is the federal government’s one-stop resource for victims. The FTC received more than 1.1 million identity theft reports through that site in 2024 (Federal Trade Commission, 2025). Filing puts your case on record and builds you a step-by-step recovery plan.
- When you file a report, you’ll receive a pre-filled FTC Identity Theft Affidavit.
- This document is essential because it serves as your official “proof” when disputing fraudulent accounts with creditors and bureaus.
Print it, save a PDF, and keep it with your case notes. Every step from here leans on it.
4. File a Local Police Report With Your FTC Report in Hand
Take your FTC report to your local police department and file a report there too. While the FTC report is often enough for creditors, a local police report gives you an extra layer of legal protection.
- What to Bring: Your FTC Affidavit, a photo ID, and any proof of the theft, such as statements or collection letters.
- Note: Many insurance companies and some creditors require a police report number to process identity theft claims.
Ask for a copy of the report, or at least the report number, before you leave.
5. Pull All Three Credit Reports and Mark Every Line You Don’t Recognize
Your three reports are the only place you can see everything the thief opened. Errors are common even without a thief: one in five consumers had an error on at least one of their three credit reports (FTC, 2013). After identity theft, your odds of finding something are much worse.
- Monitor Your Profile: Head to CreditRefresh.ai to pull your latest credit reports and identify exactly which accounts have been compromised. You can also order free weekly reports at AnnualCreditReport.com.
- Review Every Line Item: Check for “hard inquiries” you didn’t authorize, new accounts you didn’t open, or even secondary addresses you’ve never lived at.
- Spot Errors Fast: A streamlined platform like CreditRefresh.ai lets you quickly pinpoint discrepancies so you can move on to the dispute process without delay.
Check each bureau separately. Each one keeps its own file, so a fake account can show up at one bureau and not the others.
A free app that shows you the damage won’t clear it. In a 1-star Trustpilot review of Credit Karma, Martha M. wrote on June 22, 2026: “they let me suffer identity theft which negatively impacted my credit in general.” Seeing the problem is step five. Fixing it is step six.
For the full walkthrough, read Identity Theft and Credit Reports: A Complete Guide to Recovery.
6. Dispute Every Fraudulent Account With the Bureaus and Creditors
With your FTC Affidavit and your credit reports in hand, it’s time to clean up the mess. Accounts that belong to someone else are the most common credit report complaint in the country. Of 3,482,718 complaints recorded in the CFPB’s public Consumer Complaint Database under “Incorrect information on your report” from July 2025 through June 2026, 66.9% named “Information belongs to someone else,” in our own analysis.
| Complaint issue | Share of 3,482,718 complaints | What it looks like after identity theft |
|---|---|---|
| Information belongs to someone else | 66.9% | A card or loan the thief opened |
| Account information incorrect | 18.4% | Wrong balance or details on a real account |
| Account status incorrect | 8.7% | A real account shown as late or in collections |
These complaints are unverified consumer allegations, and the CFPB does not confirm the facts alleged.
- With Bureaus: Send a dispute letter to each credit bureau reporting the fraud. When you include your identity theft report, the bureaus are legally required to block the fraudulent information within 4 business days of receiving it. Our guide to blocking identity theft items under FCRA Section 605B shows what to send.
- With Creditors: Contact the fraud department of the companies where the thief opened accounts. Use your FTC report to prove the debt isn’t yours.
- Hold Them to a Real Review: Bureaus and the companies that supply the data both must run a reasonable, independent investigation, and simply repeating the creditor’s word can break the law (FCRA Section 611(a)(1)(A) and Section 623(b); Cushman v. Trans Union, 3d Cir. 1997).
7. Lock Down Your Email, Passwords, and Tax Return
If a thief got your Social Security number or credit card, they might also have your email or social media. Close those doors now, because a hijacked email can reset every other password you own.
- Enable MFA: Turn on multi-factor authentication on every sensitive account, including email, banking, and investment accounts.
- Update Passwords: Use a password manager to create unique, complex passwords for every site. Never use the same password twice.
- Protect Your Tax Return: If your Social Security number was taken, contact the IRS Identity Protection Central and ask for an Identity Protection PIN.
- Keep a Log of Actions: Note the date, the name of the person you spoke with, and what was discussed for every single call you make. This paper trail is invaluable if you need to escalate a dispute later.
Who Handles the Cleanup After Identity Theft, and What It Costs
Once the alarms are up, what is left is disputing the thief’s accounts on three separate reports, and your options come down to software you run, a firm that runs it for you, or a free app. Here is how they compare on price, what each does for an identity theft cleanup, and which bureaus each one reaches.
| Tool | What you pay | What that buys | Bureaus | Trustpilot |
|---|---|---|---|---|
| CreditRefresh | $49.99/mo, no setup fee, cancel anytime. Mail letters yourself free, or pay RushMail per letter | Scans all three reports, flags each unfamiliar item, drafts an FCRA letter you sign | All three | 4.3 (9 reviews) |
| Dispute Beast | From $49.99/mo for required monitoring. Mail letters yourself free, or pay Sprint Mail per letter | AI dispute app bundled with paid monitoring and one-click multi-bureau letters | All three | 4.2 (2,067 reviews) |
| DisputeBee | $49/mo personal, $129/mo business | Letter software; you import, print, mail, and upload responses yourself | All three | 3.2 (68 reviews) |
| The Credit People | $99/mo standard, $119/mo premium, or $599 for 6 months | Done-for-you firm works your file; you don’t approve each letter | All three | 1.7 (17 reviews) |
| Lexington Law | $139.95/mo, invoiced at the end of each service period | Attorney-backed firm handles challenges; individual letters aren’t shown to you | All three | 3.2 (624 reviews) |
| Credit Karma | Free, paid for by lender referrals | Free monitoring and alerts; its Direct Dispute tool reaches one bureau | TransUnion | 1.1 (912 reviews) |
Every price is that company’s own published rate, read off that company’s own site on September 15, 2026. Trustpilot scores and review counts as published on September 24, 2026.
How CreditRefresh Drafts a Dispute Letter for Every Fraudulent Item at 3 Bureaus
Steps 5 and 6 are where identity theft cleanup stalls, because three reports with dozens of lines each turn into a stack of letters nobody wants to write. CreditRefresh does that part. It scans your Equifax, Experian, and TransUnion reports, flags every item that looks inaccurate, incomplete, unverifiable, or too old to report, and drafts a print-ready FCRA dispute letter for each one you choose to challenge.
Across every kind of disputed item, identity theft and otherwise, in our September 18, 2026 analysis of paying-member data, 2.3% of disputed bureau-level items in mailed rounds had a recorded outcome. Within that subset, 47.9% were no longer reported on a newer pull of the same bureau, while 52.1% remained reported with a changed balance, status or negative flag.
You review and sign every letter, and nothing goes out without your approval. Mail the round yourself for free, or hand it to RushMail for a small per-letter fee, and we track each letter against the bureaus’ 30-day window. The bureaus decide every dispute. CreditRefresh is included with Refresh Monitoring at $49.99 a month, with no setup fee, no contract, and a 100% money-back guarantee for members who work the full program.
Frequently Asked Questions
Do I need a police report if I already filed with the FTC?
Often the FTC report is enough for creditors, but file the police report anyway. Many insurance companies and some creditors require a police report number before they will process an identity theft claim.
What if a fraudulent account comes back after the bureau removes it?
The FCRA calls this reinsertion, and you should dispute it again right away with your FTC report attached. In our read of 630,670 credit reporting complaint narratives published for 2024, 2,096 used the word “reinserted.” Those stories are unverified consumer allegations, and they are still why we tell victims to keep checking all three reports after the first round.
Can I use Credit Karma to dispute identity theft on all three reports?
No. Credit Karma’s Direct Dispute tool works with TransUnion only, so accounts a thief opened at Equifax or Experian need their own disputes.
How long does a credit bureau have to investigate a dispute?
A bureau generally must finish its reinvestigation within 30 days, and up to 45 in some cases (FCRA Section 611). An identity theft block filed with your identity theft report runs on the shorter 4-business-day deadline in Section 605B.
Should I contact the IRS if my Social Security number was stolen?
Yes, if you suspect tax fraud or your Social Security number was exposed. Contact the IRS Identity Protection Central and request an Identity Protection PIN, which adds a check before anyone can file a return in your name.
Can I dispute identity theft accounts myself for free?
Yes, disputing directly with Equifax, Experian, and TransUnion costs only postage. The work is the catch: you pull three reports, find each fake account, write each letter, mail it, and track each deadline yourself.
Is it worth paying a credit repair company after identity theft?
The right to dispute is yours by law, so you never need a firm to use it. Credit repair companies are barred from charging before they perform services (CROA, 1996), and if one asks for money up front, walk away.
CreditRefresh turns the accounts a thief left on your three credit reports into signed FCRA dispute letters you control. It’s included with Refresh Monitoring at $49.99 a month, with no setup fee and cancel anytime.
