What to do if your identity is stolen: a step-by-step recovery plan

Identity theft rarely announces itself. You usually find out from a side effect, often weeks or months after it started. Common signs:

• Bills, cards or collection letters for accounts you never opened.
• Charges or withdrawals you did not make.
• A credit application denied for reasons you do not recognize, or a sudden drop in your credit score.
• Unfamiliar accounts, addresses or hard inquiries on your credit report.
• The IRS telling you a return was already filed under your SSN, or reporting income from an employer you never worked for.
• A medical bill or insurance statement for care you did not receive.
• Mail you expect stops arriving, which can mean someone changed your address.
• Being locked out of your email or phone account, or your phone suddenly losing service.

One odd charge on a card is usually plain card fraud, and a call to the issuer fixes it. Several signs together, or any new account in your name, means you should work through the steps below.

Call the fraud department of each company where something happened. Use the number on the company's website, on your card, or on a statement, never a number from an unexpected email or text. Tell them your identity was stolen and ask them to close or freeze the fraudulent account.

• For new accounts opened in your name, ask for a letter confirming the account is fraudulent and that you are not responsible for it.
• For your own accounts that were misused, change the passwords and PINs and ask for new card numbers.
• Write down who you spoke to, the date, and any reference number.

If your email account was taken over, recover it first. Most other accounts can be reset through your email, so whoever controls it controls the rest. Once you are back in, change the password, turn on two-factor authentication, and check the settings for forwarding rules or recovery addresses the thief may have added.

IdentityTheft.gov is the Federal Trade Commission's identity theft site. You answer questions about what happened and it produces two things:

• An FTC Identity Theft Report. This is an official statement that you are a victim. It lets you get fraudulent information removed from your credit report, stop companies collecting debts that are not yours, and place an extended fraud alert.
• A personalized recovery plan. A checklist of next steps based on what happened, with pre-filled letters you can send to companies and bureaus.

It is free. Creating an account lets you save your progress and come back to update the report. You can also report by phone; the number is on the site.

A credit freeze stops anyone opening new credit in your name. It is free at Equifax, Experian and TransUnion, and you must place it at each one. Our credit freeze guide walks through the process.

A fraud alert is a second layer. It asks lenders to verify your identity before opening an account. Placing one at any of the three bureaus means that bureau notifies the other two. An initial alert lasts one year. With an FTC Identity Theft Report, you can place an extended alert that lasts seven years.

Then get your credit reports. AnnualCreditReport.com is the official free source and offers free weekly reports from all three bureaus. Go through each line. For anything fraudulent, dispute it with the bureau and include your FTC report. Under federal law, bureaus must block information that results from identity theft once you provide the report and proof of identity.

For many cases the FTC report is enough, and you do not need to go to the police. A local police report helps when:

• You know the thief, or have information that could identify them.
• Someone used your name during an arrest or traffic stop.
• A creditor, debt collector or other company specifically asks for one.

Bring your FTC Identity Theft Report, a photo ID, proof of address and any evidence. Ask for a copy of the police report, or at least the report number. If the theft involved online fraud, you can also file with the FBI at IC3.gov.

If someone filed taxes with your SSN

You often discover this when your own e-filed return is rejected because a return was already filed, or when the IRS sends a letter. If the IRS sent you a letter, follow its instructions and respond quickly. If not, file Form 14039, Identity Theft Affidavit, which you can do online through the IRS website or attach to a paper return. Keep filing and paying your own taxes as normal; a paper return may be needed that year.

Then get an Identity Protection PIN. The IP PIN is a six-digit number the IRS issues and changes every year. Any return filed under your SSN without it is rejected. It is free and you can request it online at IRS.gov once you verify your identity. Getting one is a good idea even if your SSN was only exposed, not yet misused.

If someone is using your SSN for work or benefits

Create or log in to your my Social Security account and check your earnings record for income you did not earn. If something looks wrong, or you receive Social Security benefits and they have been redirected, contact the Social Security Administration directly. Wrong earnings can also show up as unexpected income on an IRS notice.

• Medical: call your insurer's fraud line, ask providers for copies of your records, and request corrections to any false entries. If you are on Medicare, report it to Medicare.
• Phone number hijacked (SIM swap): call your carrier from another phone, get your number back, and add a PIN and port-out protection to your account.
• Bank account opened in your name: contact the bank and consider a ChexSystems freeze, since many banks use ChexSystems when opening accounts.
• Government benefits or unemployment claimed in your name: report it to the state agency involved, and note it in your FTC report.

Recovery can take weeks or months, and you will deal with people who have no record of your last call. Keep a simple log, on paper or in a spreadsheet:

• Date, company, person's name and what was agreed for every call.
• Copies of every letter you send, ideally by certified mail with a return receipt for important disputes.
• Your FTC report number, police report number and any case or reference numbers.
• Dates you expect a response, so you know when to chase.

Follow up in writing when a phone call does not resolve something. Check your credit reports again a month or two later to make sure disputed items are gone and nothing new has appeared.