Work through this list in order. Each step makes the next ones easier, and the early ones limit further damage while you deal with what already happened.
1. Freeze your credit at all three bureaus
A freeze blocks new credit being opened in your name. It is free, it does not affect your score, and you place it separately with Equifax, Experian and TransUnion. Do this first, because it stops the bleeding. Lift it temporarily when you need to apply for something yourself.
2. Report to the FTC
IdentityTheft.gov generates an official Identity Theft Report and a personalized recovery plan. That report is the document creditors and bureaus require to remove fraudulent accounts, so getting it early saves repeated explaining later.
3. Contact the affected companies
Call the fraud department of each bank or card issuer involved, close or freeze the compromised accounts, and get new numbers. Follow up in writing and keep the reference numbers.
4. File a police report
Some creditors require one. Bring the FTC report, your identification and whatever evidence you have.
5. Dispute the fraudulent entries
With the Identity Theft Report, you can require credit bureaus to block fraudulent information, and require creditors to stop reporting it. Send disputes in writing, keep copies, and follow the timelines.
6. Then check the quieter places
- Your Social Security earnings record, for employment under your number.
- IRS: a rejected return claiming already-filed is a signal; file Form 14039 and request an Identity Protection PIN.
- Medical records and insurance statements, for care you did not receive.
Keep a file
One folder, one log of every call with date, name and reference number, copies of every letter. Recovery is a paperwork process measured in months, and the people who resolve it fastest are the ones who can produce the record on demand.