What To Do If Your Identity Is Stolen (2024 Identity Restoration Guide)

Do You Think Your Identity Has Been Stolen? Act Fast!

According to some reports, Americans lost over $43 billion to identity theft last year alone — making it one of the most damaging financial crimes in the country [*]. But maybe even worse than the initial shock of having your identity stolen is when it happens again.

The terrifying truth is that nearly 70% of identity theft victims are targeted more than once [*].

If you’re seeing unfamiliar transactions on your bank account statements or any other common warning signs indicating that your identity has been stolen, you need to act quickly to mitigate the damage, report the fraud, and protect yourself from future attacks.

NEW: Use This Template To Track Your Identity Recovery 

Dealing with identity theft is an exhausting process that can require months of effort — entailing numerous phone calls to banks and credit unions, preparing and sending dispute letters, and trying to recover lost funds. 

To give yourself the best chance of recovering quickly from identity theft, follow these guidelines to document your efforts:

What To Do If Your Identity Is Stolen

The identity theft restoration process typically involves three stages: 

1. Restriction: Limiting the damage and securing your most vulnerable accounts. 
2. Reporting: Filing official reports with impacted companies, the police, and relevant government agencies. 
3. Recovery: Disputing fraudulent transactions, repairing your credit, and securing yourself against future fraud.

Here’s a step-by-step guide on what to do in each phase:

Phase 1: Restriction

Before anything else, you must stop the fraudsters from continuing to ruin your financial reputation. 

Place initial fraud alerts or credit freezes with the credit bureaus 

When you place a fraud alert on your credit report, lenders will have to contact you to verify your identity before issuing credit in your name. This makes it much harder for identity thieves to take out loans or open accounts in your name.

You’ll also receive a free copy of your credit report from all three bureaus — Experian, Equifax, and TransUnion — which you can check for signs of fraud.

To place an initial fraud alert, you only need to contact one of the three major credit reporting agencies —  they are all duty-bound to contact the other two bureaus on your behalf:

• Experian: 1-888-397-3742
• Equifax: 1-800-525-6285
• TransUnion: 1-800-680-7289

Tracking tip: The initial fraud alert stays on your report for one year, but it can be renewed afterwards. Make sure you mark the date on your calendar.

Consider a credit freeze for high-risk scenarios

A credit freeze offers better protection against fraud because it completely prevents anyone from accessing your credit file. However, it requires a bit more work — as you need to contact each of the three bureaus individually.

Here’s how to initiate a credit freeze with each bureau:

Each bureau will supply you with a PIN you can use to “thaw” your credit file later. Credit freezes last until you lift them and won’t impact your credit score. 

Note: You can’t have a fraud alert and a credit freeze on your account at the same time. In almost all cases, we suggest choosing a freeze for added security. 

Notify your bank and credit card issuer

If your identity is stolen, you must notify financial institutions that your bank account may be at risk. 

To start, call the phone number on the back of your debit card or credit card. Card issuers can block access to your accounts, cancel compromised cards, and issue new ones.  

If your credit card was stolen or lost, here's how to contact most major U.S. credit card companies:

• Visa: 1-800-847-2911
• Mastercard: 1-800-627-8372 (1-800-MASTERCARD)
• Chase: 1-800-432-3117
• Capital One: 1-800-227-4825 (1-800-CAPITAL)
• Citibank: 1-800-950-5114
• Bank of America: 1-800-732-9194
• Discover: 1-800-347-2683 (1-800-DISCOVER)
• American Express: 1-800-528-4800

📚 Related: How To Protect Your Bank Account From Identity Theft →

Secure your online accounts with new passwords and two-factor authentication (2FA)

Modern identity thieves often target sensitive online accounts — especially email, social media, and financial accounts. If you’re locked out of any online accounts or see signs that you were hacked, update your passwords immediately and enable two-factor authentication (2FA). 

Secure passwords are: 

• Unique: Each password is only used for one account.
• Long: At least 10–13 characters to protect against brute force attacks.
• Complex: Combine uppercase and lowercase letters, numbers, and symbols.  

A password manager makes it much easier to create and store unique login credentials. 

Insider tip: If you get an email about a recent hack or data breach, your personal data may be at risk. Check if your passwords have been leaked by using Aura’s free Dark Web scanner.

Scan your devices for malware, and set up antivirus protection

If hackers infiltrate your devices with malware, they can continue to hack your data even after you secure your identity and accounts. Delete any suspicious apps, and then install and run reputable antivirus software to scan for ransomware, spyware, trojans, and other viruses.

Phase 2: Reporting

Once you’ve secured your credit files, financial accounts, and online profiles, you can assess the damage and start reporting and disputing the fraud.

Review your bank statements for suspicious activity

Inspect account statements, and document all possible fraudulent activity:

• Take note of all unauthorized or unfamiliar transactions — including dates, times, amounts, and vendors.
• Don't ignore small charges. Thieves test stolen credit card numbers by making small purchases before trying to max out the credit lines. 
• Contact each vendor directly to query unfamiliar transactions. If you suspect any fraud, you can dispute the charges with your bank or credit card company.

Check your credit reports, and report fraud

You can get free copies of all three of your credit reports by visiting AnnualCreditReport.com (or after submitting a fraud alert or credit freeze request).

Review each report for signs of fraud, such as unauthorized changes to your profile and new accounts opened in your name. Take note of all suspicious activity, and record the dates, times, and amounts. 

📚 Related: How To Read a Credit Report (and Dispute Fraud) →

Create an official identity theft report 

Filing an official report is one of the most important things to do if your identity is stolen. 

After you gather evidence from reviewing your statements and credit reports, follow the steps below to report identity theft:

• File a report with the Federal Trade Commission (FTC) at IdentityTheft.gov. Include your identity information and as many details as possible. The FTC will provide you with an official Identity Theft Affidavit as well as a personalized recovery plan.
• File a police report. Contact your local police department, and ask to speak with the officer in charge of the fraud department to make an official police report. You’ll be asked to provide your FTC affidavit and all supporting evidence‍
• Make an Identity Theft Report. By attaching your FTC Identity Theft Affidavit to your police report, you can create an official Identity Theft Report. This will help clear your name and dispute fraudulent charges with impacted vendors and financial lenders.

Phase 3: Recovery

You may not be able to recover all of your stolen or misused funds if your identity is stolen — but you can take steps to dispute charges, restore your credit, and recover from the fraud. 

Contact impacted vendors to block fraudulent activity from your credit reports

By law, credit reporting companies must block identity theft-related information — including unauthorized transactions, accounts, and inquiries — from appearing on your credit report (and harming your credit score). 

To request a block, send letters including details of your identity theft to:

• The three credit reporting agencies.
• The fraud department of every business that reported a fraudulent transaction on your existing financial accounts. This could include retail stores and government agencies like the Social Security Administration (SSA).
• The fraud department of every business that reported a new account opened in your name by an identity thief. These businesses may include credit unions, payday loan companies, and credit card issuers.

What should you include in your credit dispute letters?

• Proof of your identity, including your name, date of birth, address, and Social Security number (SSN).
• A copy of the police report and FTC report. 
• Details of the fraudulent activity on your credit report.
• A request for copies of documents that the thief used to open new accounts or charge purchases in your name.

You can view sample dispute letters on the FTC website.

Tracking tip: Record the date that you send each dispute letter, and keep copies in your files. Set a reminder to follow up with each company if you haven’t heard back within a month.

Obtain information from debt collectors under the FCRA

The Fair Credit Reporting Act (FCRA) grants all consumers the right to dispute inaccurate information in their credit reports [*]. 

If debt collectors are harassing you about fraudulent debts, lodge a request with the debt collection agency to send you all information related to debts in your name. You can then provide your Identity Theft Report to prove you’re a victim of identity theft. 

If the debt collectors have already reported the debt, contact the three credit bureaus to block reports of any damaging information related to fraud. 

📚Related: How To Dispute Debts That Aren’t Yours →

Take extra security measures for special types of identity theft

Identity theft can manifest itself in many different ways. You may need to take additional recovery steps depending on how criminals have used your identity:

• Criminal identity theft. If an identity thief uses your personal information during a police stop, you must contact your local law enforcement agency and the department in the municipality where the crime was committed. 
• Child identity theft. If criminals have used your child’s identity or credit file, you can freeze their credit and dispute fraudulent accounts on your child’s behalf with each of the three bureaus.
• Student loan fraud. If a thief takes out a student loan in your name, contact the school or program involved and ask them to terminate the loan. You can also contact the U.S. Department of Education by using the online OIG Hotline or by calling 1-800-647-8733.
• Medical identity theft. If someone uses your health insurance information, contact each impacted healthcare provider to get your records. If the provider refuses to provide your records within 30 days of your request, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Once you get the records, you can dispute errors and fraud in writing.
• Government benefits fraud. You should report any false claims for state benefits to the relevant state unemployment agency. Here’s a list of offices.
• Investment account fraud. If an identity thief compromises your investments or brokerage accounts, contact your broker or account manager. If you lost money in an investment scam, you should also file a complaint with the U.S. Securities and Exchange Commission (SEC). 
• Employment identity theft. If impersonators use your details, they could tamper with your Social Security benefits and leave you with a higher tax bill. Visit your local SSA office or call 1-800-772-1213 to correct your earnings record. 
• Tax identity theft. If a thief has used your SSN to get a job or file a fraudulent tax return, report the fraud to the IRS immediately at 1‑800‑908‑4490 or visit www.irs.gov/identitytheft. 

Contact your insurance provider to get help

It can take more than six months and 100–200 hours to discover, resolve, and recover from the effects of identity theft [*]. With identity theft insurance, you have more protection and support to recover. 

Call your provider to see what you’re entitled to — especially for stolen funds and expenses such as replacing documents. If you haven’t taken out a personal insurance policy, check if you have coverage with your home insurer and employer.

How To Protect Yourself Against Identity Theft

It’s not always easy to know if someone has stolen your identity. But once you spot the signs, the crime becomes painfully clear. While there’s no way to completely prevent all identity theft, you can take measures to make yourself a less vulnerable target: 

• Take account security seriously. Use strong, unique, and complex passwords for every account, and store them in a secure password manager. Safeguard all sensitive accounts with a secondary authentication method — this can include using an authenticator app like Authy, 2FA codes sent to your phone, or even biometric security (fingerprints, facial scans, etc.).
• Limit personal information that’s available online. Request that Google removes your personal information from search results, and use a data broker opt out service to prevent scammers from researching you. It’s also a good idea to update your social media privacy settings. 
• Don’t click on suspicious links or answer strange messages. Look for the warning signs of a phishing attack in strange emails and texts, including suspicious or masked links, a sense of urgency, typos, and random QR codes. 
• Hide your browsing activity by using a virtual private network (VPN). This encrypted connection masks your data and location from hackers. Always use a VPN when shopping or banking online — especially on public Wi-Fi networks.
• Shred sensitive documents. Shred sensitive paperwork that you no longer need in order to prevent it from falling into the wrong hands. This includes bank statements and anything related to your taxes and healthcare. 
• Protect your valuable documents. Store your passport, birth certificate, and Social Security card in a locked safe. 

Protecting yourself and your loved ones from identity theft can feel like a full-time job — but Aura can make it easier.

Aura's award-winning identity theft protection platform provides 24/7 identity monitoring, as well as bank account and three-bureau credit monitoring with the industry's fastest fraud alerts³. You’ll get near-instant notifications warning you about signs of fraud and alerts if your data is leaked to the Dark Web. 

If you fall prey to fraud, Aura covers you and your family with up to $5 million in identity theft insurance — and Aura’s Expert Fraud Remediation team is available to help you 24/7.  

Keep your family safe from identity thieves. Try Aura free for 14 days.