Identity Theft: What to Do Right Now (Step-by-Step Plan)

If you think your identity was stolen, do three things today: place a free fraud alert and freeze your credit at Equifax, Experian and TransUnion; report the theft at identitytheft.gov to get an official recovery plan; and contact any bank, card issuer or account that was touched. The sooner you act, the less damage a thief can do in your name.

Below is the full step-by-step plan, written for ordinary Americans, not lawyers. We're the editors at Getshure, a small US publisher focused on scams, privacy and family safety. We'll keep it calm and practical.

First: how do you know it's really identity theft?

Identity theft means someone used your personal information — name, Social Security number, date of birth, card number — to pretend to be you. Common warning signs:

• A charge on your card or bank account you don't recognize.
• A bill or collection notice for something you didn't buy.
• A letter welcoming you to an account you never opened.
• The IRS saying a tax return was already filed in your name.
• A medical bill or Explanation of Benefits for care you never got.
• A credit score drop you can't explain, or a new account on your credit report.
• Your email or phone suddenly getting locked out of login.

One odd charge might just be a mistake. A pattern — or anything involving your Social Security number, taxes or a new account — should be treated as identity theft until proven otherwise.

The step-by-step recovery plan

Step 1: Place a free fraud alert (takes 5 minutes)

A fraud alert tells lenders to verify your identity before opening new credit in your name. It's free, lasts one year, and you only have to contact one of the three bureaus — that bureau is required to notify the other two.

• equifax.com
• experian.com
• transunion.com

Pick one, log in, and request a fraud alert. Done.

Step 2: Freeze your credit at all three bureaus

A credit freeze is stronger than a fraud alert. It blocks new creditors from seeing your credit file, so a thief can't open new accounts even if they have your Social Security number. It's free, and you can lift it any time you need a loan or new card.

You must freeze at each bureau separately. Our full walkthrough is here: How to Freeze Your Credit at Equifax, Experian and TransUnion.

Step 3: Report at IdentityTheft.gov

This is the single most important step. IdentityTheft.gov is the FTC's free government site. It does two things for you:

1. Creates an official FTC Identity Theft Report — the document banks and credit bureaus accept as proof.
2. Builds a personalized recovery plan with pre-filled letters to send to companies, credit bureaus and debt collectors.

Here's how to use it:

1. Go to identitytheft.gov and click "Get started."
2. Pick the option that matches what happened (credit card misuse, new account opened, tax fraud, medical, etc.).
3. Create an account so you can save your progress and come back.
4. Fill in what you know — the site asks plain questions.
5. Download your FTC Identity Theft Report (save a PDF and print one).
6. Follow the recovery plan step by step. It literally tells you who to call and what to say.

Step 4: Call every affected company's fraud department

For each account that was touched — or opened fraudulently — call the company directly. Don't use a number from a text or email; use the number on the back of your card, on your statement, or the one you find by typing the company's official website yourself.

Ask for the fraud or security department and say: "I'm a victim of identity theft. I have an FTC Identity Theft Report. I need you to close this account, remove the fraudulent charges, and send me written confirmation."

Keep notes: date, time, who you spoke to, what they agreed to do. Get a reference number.

Step 5: Change passwords and turn on 2FA

Start with the big ones: your main email, your bank, and any account that was accessed. Use a unique password for each. Turn on two-factor authentication (preferably an app code, not a text) so a stolen password alone isn't enough to log in. Our guide: Two-Factor Authentication Guide.

Step 6: If your Social Security number was used

Report it at oig.ssa.gov and at identitytheft.gov. If a tax return was filed in your name, file IRS Form 14039 (Identity Theft Affidavit) — identitytheft.gov will walk you through this. You can also request an IRS Identity Protection PIN at irs.gov for future tax years.

Step 7: File a police report (when it helps)

You don't always need a police report, but file one if:

• You know the person who stole your identity.
• A creditor, bank or debt collector asks for one.
• Your identity was used during another crime.

Bring your FTC Identity Theft Report, a government ID, proof of address, and any evidence (bills, letters, statements).

Step 8: Check your credit reports and keep watching

Get your free reports at annualcreditreport.com — the only federally authorized source. You're entitled to free reports from each bureau every week. Look line by line for accounts, addresses or inquiries you don't recognize. Dispute anything fraudulent in writing, with your FTC report attached.

Step 9: Watch for the second wave

Thieves who already have your information often come back disguised as "recovery" help, fake bank fraud departments, or FTC agents offering to "release funds." The real FTC will never call and ask for money, gift cards, crypto or your Social Security number. If a call feels wrong, hang up and call the number on your card.

A simple recovery checklist

• □ Fraud alert placed at one of the three bureaus
• □ Credit frozen at Equifax, Experian and TransUnion
• □ Report filed at identitytheft.gov; PDF saved
• □ Every affected bank and card issuer called
• □ Passwords changed on email and financial accounts; 2FA on
• □ SSA and IRS notified if your SSN or tax return was involved
• □ Credit reports checked at annualcreditreport.com
• □ Notes kept: dates, names, reference numbers

If money is already gone

Call the bank or card issuer first — the clock on their liability rules starts ticking from the moment you notice. By federal law, credit card fraud liability is capped at $50 (and most issuers waive it). Debit cards and bank transfers have shorter timelines, so call the same day if you can. Then report at ic3.gov (the FBI's Internet Crime Complaint Center) and reportfraud.ftc.gov.

If you were tricked over the phone or by text in the last few hours, read Just Got Scammed? What to Do in the First 10 Minutes.

The book we wrote for exactly this moment

Recovery is only half the job. The other half is making sure it doesn't happen again — and understanding how today's scams actually work, including the AI-driven ones that make fake voices, fake emails and fake "bank" calls so convincing.

Don't Get Screwed by AI is our plain-English hardcover ($29) that walks you through the current playbook: AI voice clones, phishing, data broker exposure, deepfake calls, romance scams and more. It's written for ordinary adults, not tech people. If you've just been through identity theft, it's the clearest way to understand what happened and how to shut the door for good.

Free US shipping on orders of $40+, 30-day money-back guarantee, and real phone support if you need it: (754) 812-1679.

Check what thieves already have on you: the breach check

Most identity theft starts with a data breach you never heard about. A company gets hacked, your email and password get dumped online, and months later a thief tries them on your bank. You can't un-breach a company — but you can find out which of your accounts are already exposed and fix those first.

Every Getshure protection plan includes the Getshure app, which has a breach check built in. Enter your email, and the app tells you whether it has appeared in known data breaches — and which ones — so you know exactly where to change passwords first. The same app also includes:

• Scam Shield to identify likely scam and spam callers and help block robocalls.
• Data broker removal to send opt-out requests to people-search sites (each site decides when it removes a record).
• An encrypted vault for sensitive photos and documents, locked with Face ID or a passcode.
• Tracker blocking, a browsing-history eraser and a phone security score with steps to improve it.

No app can block every scam or data leak — but having the breach check, caller ID and data broker removal in one place means you catch more and recover faster. Learn more here: The Getshure App: What It Does and What It Can't Do. Android users can get it on Google Play; iPhone users use the download link in their Getshure order email. Setup help: Getshure App Sign In: How to Activate After Your Order.

Why trust Getshure to help

You're already dealing with people who lied to you. The last thing you need is a company that hides who it is. Here's what you can verify about us today, before you spend a dollar:

• Getshure is a brand of MetaWise Enterprises, LLC, a Delaware company (file number 10336625) — searchable on the Delaware Division of Corporations site.
• US address: 11772 W Sample Rd, Ste 103, Ofc 240, Coral Springs, FL 33065.
• US phone with real hours: (754) 812-1679, Mon–Fri, 9 AM–6 PM ET. Email: contact@getshure.com.
• 30-day money-back guarantee on every plan charge, renewal and add-on.
• One-step cancel at getshure.com/cancel — no phone call, no "retention" script.
• Card statement shows GETSHURE.COM so you always know what the charge is.

More proof: Is GETSHURE Legit? Who We Are and How to Check Us and Our Refund Policy: 30 Days, No Reason Needed.

Related reading

• How to Freeze Your Credit at Equifax, Experian and TransUnion
• Your Data Was in a Breach: What to Do Next
• How to Check if Your Email or Password Was Leaked
• How to Report a Scam in the US: FTC, IC3 and Your Bank
• Child Identity Theft: How to Check and Freeze Your Kid's Credit

Your next step

If you haven't yet: open identitytheft.gov in another tab and start your report. Then freeze your credit. Those two moves cover most of the damage control.

When you're ready to lock the door for the long term, pick up Don't Get Screwed by AI or start a Getshure protection plan to get the app with breach check, Scam Shield and data broker removal. Questions first? Call us at (754) 812-1679 or email contact@getshure.com — a real person answers.