Identity theft: contain the damage, step by step

Identity theft rarely announces itself. It surfaces as a small unfamiliar charge, a letter about an account you never opened, or a password that suddenly fails. Underneath is usually stolen data from a breach you had no part in — this is not something you caused.

Recovery is a sequence, not a scramble. The order below exists because each step protects the ones after it.

Do this now

1. Take back your email. Change the password to something unique, enable app-based two-factor authentication or a passkey, and check recovery addresses, forwarding rules, and connected apps for anything you don't recognize.
2. Freeze your credit. Place a freeze with each credit bureau so no new account can be opened in your name. It is free, it does not affect your score, and you can lift it temporarily whenever you need credit.
3. Call banks and card issuers. Report fraudulent charges, request replacement cards with new numbers, and dispute anything you did not authorize. Ask each institution for its fraud case number.
4. Lock your phone number. Set a port-out PIN or SIM-lock with your carrier. Attackers hijack numbers precisely to intercept the SMS codes protecting your other accounts.
5. File the official reports. In the US, identitytheft.gov generates a recovery plan and an FTC report many institutions require for disputes; elsewhere, file with your national fraud service or police. Keep copies of everything.
6. Watch the long tail. Review credit reports and statements for the next twelve months. If the theft traces back to a company breach — especially your employer — professional investigation may be warranted.

What not to do

• Do not reuse your old password pattern with a number changed — attackers try variations first.
• Do not ignore small charges; criminals test with small amounts before striking.
• Do not pay "credit repair" services promising instant deletion of fraud — the official dispute process is free.
• Do not throw away fraud letters, envelopes, or notices — they are evidence with dates.
• Do not trust callers claiming to be your bank's fraud department. Hang up and call the number on your card.

Preserve the evidence

Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:

• Your dated log of discoveries, calls, and case numbers.
• Statements and screenshots showing each fraudulent charge or account.
• Credit reports from each bureau, saved as files.
• Police, FTC, or national fraud-service reports.
• Any phishing emails or texts you suspect started it, kept unforwarded.

Keep a clear head

Identity theft is a drip-feed stressor: it resurfaces in letters and statements for months, and the feeling of violation is real and normal. Contain the anxiety the way you contain the fraud — schedule two or three fixed times a week to work the list and check accounts, instead of checking constantly.

Keep a short script by the phone for fraud-department calls: what happened, when you found it, your case numbers. Turning each call into a routine removes most of its sting.

Questions victims ask