Every other guide on this site is about prevention. This one is for the day prevention has already failed: a collection letter for a debt that is not yours, a credit card you never opened, a tax return rejected as a duplicate. The first thing to know is structural, and it is genuinely good news: identity theft recovery is a defined legal process with real leverage on your side. Treated as a process, it is weeks of annoying paperwork. Treated as a panic, it stretches into years. Here is the process.
Step one: the FTC report is the keystone
Start at IdentityTheft.gov, the Federal Trade Commission's official recovery site. Filing there does two things: it generates a personalized recovery plan for your specific situation, and it produces an FTC Identity Theft Report, the document the rest of the process runs on. That report is what legally obligates credit bureaus to block fraudulent accounts from your file and gives businesses a formal reason to treat you as a victim rather than a debtor. File it before arguing with anyone; every later conversation goes better with it in hand. A police report is worth adding when you know who did it, or when a creditor specifically demands one, but the FTC report is the one with general legal force.
Step two: stop the bleeding
Same day: freeze your credit at all three bureaus so nothing new gets opened while you clean up, and place a fraud alert, which the FTC flow walks you through. Contact the fraud department of each company where an account was opened or misused, say the words "identity theft," and ask them to close the account and send written confirmation that you are not liable. If the theft involves your Social Security number, add the other three locks: the IRS IP PIN, your SSA account, and E-Verify Self Lock. And change credentials on any account the thief may have touched, starting with your email.
Step three: dispute in writing, keep everything
Pull your reports from all three bureaus and dispute every fraudulent item: accounts, inquiries, addresses. Attach the FTC report. Bureaus generally have 30 days to investigate, and with an identity theft report they must block the disputed items rather than merely investigate them. Do disputes in writing through the bureaus' processes, not just phone calls, and keep a dated log of every letter, call, and confirmation number. The log feels bureaucratic; months later, when one company's fraud department loses your case, the log is what restarts it in one email instead of from zero.
- File at IdentityTheft.gov. Get the FTC Identity Theft Report and the plan.
- Freeze all three bureaus. Fraud alert on.
- Fraud departments of every affected company: close, confirm in writing.
- SSN involved? IRS IP PIN, SSA account, E-Verify Self Lock.
- Dispute everything fraudulent, in writing, FTC report attached.
- Log every contact. Recheck all three reports in 60 to 90 days.
What recovery does not require
You do not need to hire an identity theft recovery firm; the process above is exactly what they do, with your paperwork. If you already pay for a protection service with restoration support, this is the moment to use its case manager, that is what the subscription was for. And be wary of the second wave: recovery-stage victims are re-targeted by "we can fix your case" callers who are the same scam in a new costume. Nobody legitimate cold-calls identity theft victims.
Recovering? Find out what else is exposed.
Knowing which breaches contain your data tells you which doors the thief may try next. Free scan, about 10 seconds.
Run the Free Breach Scan →