Identity Theft Recovery Protocol

Recognizing Identity Theft

Identity theft occurs when someone uses your personal information — such as your name, national ID number (e.g. Social Security number in the US, National Insurance number in the UK), date of birth, or financial account details — without your permission, typically for financial gain. It can go undetected for weeks or months. Here are common warning signs:

• Unfamiliar accounts or charges. You see credit card charges, bank withdrawals, or accounts on your credit report that you did not authorize.
• Unexpected bills or collection notices. You receive bills for services you did not use or calls from debt collectors about debts you did not incur.
• Credit report anomalies. Your credit score drops unexpectedly, or your credit report shows inquiries, accounts, or addresses you do not recognize.
• Tax filing issues. You are unable to file your tax return because one has already been filed using your national ID or tax identification number, or you receive a tax refund you did not request.
• Medical records discrepancies. Your medical records contain treatments or conditions that are not yours, or your health insurance claims do not match services you received.
• Government benefit problems. You are denied government benefits because records show you are already receiving them, or you receive benefit statements you did not apply for.
• Mail changes. You stop receiving your regular mail, which could indicate someone has submitted a change-of-address form in your name.

Immediate Action Checklist

If you have confirmed or strongly suspect identity theft, these are the actions to take immediately. Work through them in order — each step builds on the previous one.

1. Document everything you have discovered so far. Write down the fraudulent accounts, charges, or activities you have identified, including dates, amounts, and any reference numbers. Take screenshots of anything you can see online. This documentation will be essential for every report you file.
2. Place a fraud alert on your credit reports. Contact your country's credit reporting agencies to place an initial fraud alert. In the US, contact one of the three major bureaus (Equifax, Experian, or TransUnion) — that bureau is required to notify the other two. In the UK, contact Experian, Equifax, or TransUnion UK individually. Other countries have their own credit agencies — check with your national consumer protection authority. A fraud alert warns creditors to take extra steps to verify your identity before opening new accounts.
3. Request your credit reports. In many countries you are entitled to free credit reports. In the US, request from all three bureaus. In the UK, use the statutory credit report option from each agency. In the EU, GDPR gives you the right to request your data from credit agencies. Review each report carefully for accounts, inquiries, or addresses you do not recognize. Annotate anything suspicious.
4. Place a credit freeze. A credit freeze (also called a security freeze) prevents new creditors from accessing your credit report entirely, which stops most new fraudulent accounts from being opened. You must freeze your credit at each bureau individually. Unlike a fraud alert, a freeze must be actively lifted by you when you want to apply for legitimate credit.
5. Report to your national identity theft authority. In the US, visit IdentityTheft.gov to file a report with the Federal Trade Commission (FTC), which generates a personalized recovery plan. In the UK, report to Action Fraud (actionfraud.police.uk). In Canada, contact the Canadian Anti-Fraud Centre. In Australia, report to ReportCyber (cyber.gov.au). In the EU, contact your national data protection authority. This official documentation is essential for disputing fraudulent accounts.
6. File a police report. Contact your local police department to file an identity theft report. While local police may not be able to investigate the crime directly, the report provides important documentation that creditors and financial institutions may require.

Contacting Financial Institutions

Contact every financial institution where fraudulent activity has occurred. Be prepared for this process to take time — you may need to speak with fraud departments, fill out affidavits, and follow up multiple times.

For each institution, you should:

• Call the fraud department directly. Do not use phone numbers from suspicious correspondence. Look up the institution's official fraud reporting number from their website or the back of your legitimate card.
• Explain that you are a victim of identity theft. Provide your official identity theft report number (e.g. FTC report in the US, Action Fraud reference in the UK) and police report number.
• Request that fraudulent accounts be closed or frozen. Ask for confirmation in writing that the account has been closed and that you are not liable for the charges.
• Ask about their dispute process. Each institution has a formal process for disputing fraudulent activity. Get the details in writing, including deadlines for submitting documentation.
• Request a fraud affidavit if required. Some institutions require you to complete their own fraud affidavit in addition to your official identity theft report.
• Keep records of every conversation. Note the date, time, name of the representative, and what was discussed. Follow up phone calls with written confirmation via email or certified mail.

For your own legitimate accounts that may have been accessed, change all passwords and enable multi-factor authentication. Request new account numbers, card numbers, or PINs as appropriate.

Filing Reports and Building Your Case

A strong paper trail is your most powerful tool in identity theft recovery. The reports you file create an official record that supports your disputes and protects your rights.

Essential reports to file:

• Official identity theft report — In the US, file at IdentityTheft.gov (FTC) which generates a personalized recovery plan. In the UK, file with Action Fraud. In other countries, file with your national fraud or consumer protection authority. This creates an official document recognized by creditors and credit agencies.
• Local police report — Many creditors require a police report number before they will close fraudulent accounts or remove charges.
• Credit agency disputes — For each fraudulent account or inquiry on your credit reports, file a formal dispute with your country's credit reporting agencies. Include your official identity theft report and any supporting documentation.
• Tax authority protection — If your national ID or tax number has been compromised, contact your national tax authority. In the US, apply for an Identity Protection PIN from the IRS. In the UK, contact HMRC's fraud helpline. Other countries have similar mechanisms to prevent fraudulent tax filings in your name.
• National ID authority — If your national ID number is being misused, contact the issuing authority to report the fraud. In the US, this is the Social Security Administration (SSA). In the UK, contact the relevant government department. In rare cases, a new number may be issued.

Keep copies of every report, letter, and communication in a dedicated folder — physical or digital. Organize documents by institution and date. You will reference these repeatedly throughout the recovery process.

Credit Freezes and Fraud Alerts

Understanding the difference between these two tools is important, as they serve different purposes and you may want to use both.

Fraud alerts

• Require creditors to take reasonable steps to verify your identity before extending credit
• An initial fraud alert lasts one year and can be renewed
• In the US, an extended fraud alert (available with an FTC report) lasts seven years. Durations vary by country.
• In the US, you only need to contact one bureau — they will notify the other two. In other countries, you may need to contact each agency individually.
• Does not prevent all new account openings but adds a layer of verification

Credit freezes

• Completely block new creditors from accessing your credit report
• Must be placed individually with each credit reporting agency in your country
• Remain in place until you lift them — there is no expiration
• Free to place and lift by law
• You will need to temporarily lift a freeze when you legitimately apply for credit, a rental, or certain services
• Do not affect your existing accounts or credit score

For identity theft victims, placing both a fraud alert and a credit freeze provides the strongest protection. In the US, also consider freezing your credit with smaller specialty bureaus such as ChexSystems (used by banks for checking accounts), LexisNexis, and the National Consumer Telecom and Utilities Exchange. In other countries, check whether equivalent specialty agencies exist.

Monitoring for Further Misuse

Identity theft is rarely a single event. Once your information is compromised, it may be sold, traded, or used again months or even years later. Ongoing monitoring is essential.

• Check your credit reports regularly. Access your credit reports from your country's credit agencies (in the US, free weekly reports are available from all three bureaus). Review them at least monthly for the first year after discovering identity theft, then quarterly going forward.
• Set up account alerts. Enable transaction notifications on all bank accounts and credit cards so you are immediately alerted to any activity.
• Monitor your medical records. Request an accounting of disclosures from your health insurers and medical providers to check for medical identity theft.
• Watch your mail. Be alert for bills, statements, or collection notices for accounts you did not open. Also watch for missing mail, which could indicate address fraud.
• Review your government benefits statement. Check your national ID earnings or benefits statement annually (e.g. Social Security statement in the US, National Insurance record in the UK) to ensure no one is using your number for employment or benefits fraud.
• Consider a credit monitoring service. Many identity theft victims are offered free credit monitoring. While not a substitute for credit freezes, monitoring services provide useful alerts about changes to your credit file.

Long-Term Recovery Steps

Full recovery from identity theft is a process that unfolds over months. Here is what to expect and work through after the immediate crisis has passed.

• Follow up on all disputes. Creditors and credit bureaus are required to investigate and respond to your disputes, typically within 30 days. If you do not hear back, follow up in writing. Keep copies of all correspondence.
• Rebuild your credit if needed. If your credit score has been damaged, focus on maintaining good habits with your legitimate accounts. Pay bills on time, keep credit utilization low, and allow time for fraudulent items to be removed from your reports.
• Update your security practices. Use this experience as a catalyst to strengthen your overall digital security. Adopt a password manager, enable multi-factor authentication on all important accounts, and minimize the personal information you share online.
• Keep your recovery file for years. Do not discard your identity theft documentation. Some disputes take months to resolve, and fraudulent activity can resurface years later. Keep your records for at least seven years.
• Review and update your credit freeze. Remember that your credit freeze is in place. Before applying for new credit, a rental, or a new job that requires a credit check, you will need to temporarily lift the freeze at the relevant bureau.
• Consider an identity theft protection plan. Some victims find ongoing identity monitoring and restoration services valuable for peace of mind. Evaluate these services carefully — look for those that include hands-on restoration assistance, not just monitoring alerts.

Emotional Impact and Support

Identity theft is not just a financial crime — it is a deeply personal violation that can take a significant emotional toll. If you are feeling overwhelmed, anxious, angry, or helpless, know that these reactions are entirely normal.

• Acknowledge the emotional impact. Many identity theft victims report feelings similar to those experienced after a home burglary or physical violation. The sense that someone has invaded your life is real and valid.
• Do not blame yourself. Identity theft can happen to anyone regardless of how careful they are. Data breaches, social engineering, and stolen mail are often beyond your control. Focus your energy on recovery, not self-blame.
• Take breaks from the recovery process. Spending hours on the phone with fraud departments and filling out paperwork is exhausting. Set a daily time limit and step away when you need to. Recovery is a process, not a race.
• Talk to someone you trust. Whether it is a friend, family member, or counselor, sharing your experience can help reduce the emotional burden. You do not have to go through this alone.
• Seek professional support if needed. If the stress of identity theft is significantly affecting your daily life, sleep, or mental health, consider speaking with a mental health professional. Many offer sliding-scale fees or accept insurance.
• Connect with other victims. The Identity Theft Resource Center and similar organizations offer support groups and resources specifically for identity theft victims. Hearing from others who have been through the same experience can be reassuring and practically helpful.

Recovery from identity theft is possible. It takes time and persistence, but the vast majority of victims are able to resolve fraudulent accounts, restore their credit, and move forward with stronger protections in place.