How to Stop Identity Theft: Freeze, Dispute, and Monitor

To stop identity theft, move in this order: freeze your credit at all three bureaus, file a report at IdentityTheft.gov and with local police, use that combined report to block fraudulent accounts, and lock down the email address that controls your password resets. Each step cuts off a different route the thief is using. Federal law gives you the tools to do all of it for free, and several of the deadlines that limit your out-of-pocket losses run in days, not weeks.

Freeze Your Credit at All Three Bureaus

A credit freeze blocks lenders from pulling your credit report, so applications made by someone posing as you get denied automatically. It is the single most effective way to stop a thief from opening new accounts in your name. Federal law guarantees the right to freeze your credit at no cost, with no limit on how long you keep the freeze in place.¹

You have to contact each bureau separately. Experian, Equifax, and TransUnion keep independent files, so freezing one does not freeze the others. Each will ask for your name, Social Security number, date of birth, and address. You can freeze online, by phone, or by mail. Once the freeze is active you receive a PIN or password to temporarily lift it when you legitimately apply for credit.

A fraud alert is a lighter alternative. You only need to contact one bureau, and that bureau must notify the other two.² An initial alert lasts one year and tells lenders to verify your identity before approving credit. If you have an FTC or police report proving identity theft, you can place an extended alert that lasts seven years.¹ An alert flags your file but does not block access to it, so a freeze is the stronger tool.

Freeze vs. Credit Lock

The bureaus also sell products called credit locks. A freeze is your right under federal law, is always free, and is governed by statute. A lock is a bureau product with terms the bureau controls, sometimes bundled with paid monitoring. If your goal is blocking unauthorized credit applications, a freeze does the same thing at no cost.

Freeze Your Telecom and Utility File

The three major bureaus are not the only file a thief can exploit. The National Consumer Telecom and Utilities Exchange keeps a separate consumer file that phone companies and utility providers check before opening service. You can freeze that file by calling 866-349-5355 or filing a request online. Save the PIN they issue; you will need it to lift the freeze later.

File Your Identity Theft Report

Your identity theft report is the document that unlocks most of your federal recovery rights, including the power to force credit bureaus to block fraudulent accounts. Building it is a two-step process: file with the FTC, then take the result to local police.

Report at IdentityTheft.gov

Start at IdentityTheft.gov, the federal portal run by the FTC. You answer questions about what happened, which accounts were affected, and when you noticed the theft. The site then generates two things: an FTC Identity Theft Affidavit and a personalized recovery plan for your specific situation.³ Download and save the affidavit before you leave the page; you cannot retrieve it afterward.⁴ Creating an account is worth the extra minutes: the site tracks progress, pre-fills dispute letters, and updates the plan as your situation changes.

File a Police Report

Bring the printed FTC affidavit to your local police department along with a government photo ID, proof of your current address such as a utility bill or lease, and any evidence of the fraud you have collected.⁴ Ask for a copy of the report and the case number. Your FTC affidavit and police report together are what federal law calls an “identity theft report,” and that combined document triggers your strongest protections.

Block and Dispute the Fraudulent Accounts

With the identity theft report in hand, you can force credit bureaus to remove fraudulent information from your file. Under the Fair Credit Reporting Act, a bureau must block information you identify as resulting from identity theft within four business days of receiving your identity theft report, proof of your identity, and a statement identifying the fraudulent accounts.⁵ The bureau must also notify the company that reported the account, which then has to stop reporting it.

This is a stronger tool than a standard dispute. A regular dispute triggers an investigation that can take 30 days and may not resolve in your favor. An identity theft block backed by a proper report is faster and harder to reject. The bureau can only refuse if it finds the request was made in error or based on a misrepresentation.

Then contact each creditor where a fraudulent account was opened. Most have dedicated fraud departments. Send a copy of your identity theft report and a letter identifying the fraudulent accounts. Ask for written confirmation that the account has been closed and that you are not responsible for the charges.

Bank Accounts and ChexSystems

If a thief accessed your checking or savings, place a security freeze with ChexSystems, the reporting agency most banks check before opening new accounts. You can request the freeze online at chexsystems.com, by calling 800-887-7652, or by mailing your request with a copy of your ID, Social Security card, and proof of address to their Security Freeze Department in Minneapolis, MN.⁶ This blocks the thief from opening new bank accounts using your information.

Know Your Liability Deadlines

Federal law caps how much you owe for unauthorized charges, but the limits and deadlines are different for credit cards and bank accounts. Speed matters more than most people realize.

Credit Cards

Your maximum liability for unauthorized credit card charges is $50. If you report the card missing before any fraudulent charges post, you owe nothing, and most major issuers waive the $50 anyway.⁷ For billing errors and charges you did not authorize, you have 60 days from the date the statement was sent to notify the issuer in writing. The issuer must acknowledge your dispute within 30 days and resolve it within two billing cycles, and cannot try to collect on the disputed amount or report it as delinquent while the investigation is open.⁸

Debit Cards

Debit card rules are less forgiving. Report a lost or stolen card within two business days and your liability is capped at $50. Wait longer than two business days but report within 60 days of your statement, and you could owe up to $500. After 60 days, you risk losing everything the thief takes from that point forward.⁹ A stolen debit card number left unreported for two months can drain an account with no legal recourse.

Lock Down Your Email and Passwords

Changing passwords does no good if the thief still has your email account, because email is the reset path for everything else. Start there.

Log in and check for forwarding rules you did not create. Thieves often set up automatic forwarding so they continue receiving your messages after you change the password. Delete anything you did not set. Look through sent and deleted folders for messages the thief may have read or sent. Update your recovery phone number and backup email to ones you control, and sign out of all devices through your account settings so anyone logged in elsewhere is kicked out.¹⁰

Then turn on two-factor authentication for every financial account, your email, and any account that stores payment information. An authenticator app or hardware security key is more secure than text-message codes, which can be intercepted if the thief has ported your phone number. Change passwords for your bank, credit cards, and investment accounts, using a unique password for each. A password manager makes this workable.

Handle Tax Identity Theft

Tax identity theft happens when someone uses your Social Security number to file a fraudulent return and claim your refund. You usually discover it when your real return is rejected because the IRS already accepted one under your number, or when a notice arrives about income you did not earn.

File IRS Form 14039, the Identity Theft Affidavit, if you suspect a fraudulent return or unauthorized employment under your number. The fastest way is the online filing on the IRS website. The form asks what happened, when you discovered it, and how it affects your account, and you sign it under penalty of perjury.¹¹

Then request an Identity Protection PIN. This is a six-digit number the IRS assigns to you that must appear on your return before the IRS will accept it. Anyone with a Social Security number or ITIN can get one, and it is the strongest long-term defense against tax identity theft. The fastest route is your IRS online account; if you cannot verify online and your income is below the published thresholds, Form 15227 lets the IRS call to verify your identity and mail the PIN.¹²

If a fraudulent return was filed under your information, you can request a masked copy through your IRS online account or by mailing Form 4506-F. The IRS acknowledges requests within 30 days. Personal information will be redacted, but the copy helps you understand what happened and supports your case with law enforcement.¹³

Report a Stolen Passport or Driver’s License

Physical ID documents in a thief’s hands create risks that do not show up on a credit report. Report a lost or stolen passport through the State Department’s online form filler, which cancels the passport within one business day.¹⁴ Once reported, the passport is permanently invalid, even if you find it later.

For a stolen driver’s license, contact your state DMV to report the theft and request a replacement. Most states can flag your record so that attempts to use your identity for another license trigger extra verification. File a police report as well, because a stolen license is often the first step in building a fraudulent identity in your name.

Medical and Employment Identity Theft

Not all identity theft appears on credit reports. Medical and employment misuse can do real damage while staying invisible to the bureaus.

Medical

A thief who uses your health insurance to receive care can corrupt your medical records with their diagnoses, allergies, and prescriptions. That is not just a billing problem: incorrect records can drive dangerous treatment decisions in an emergency.

Contact every doctor, hospital, pharmacy, and insurer where the thief may have used your information. Request copies of your records and review them for visits or treatments that are not yours. Report errors in writing, include a copy of the record showing the incorrect entry, and explain why it is wrong. Under federal privacy rules, the provider must respond within 30 days and must notify other providers who received the incorrect information.¹⁵

If a provider refuses to release records citing the thief’s privacy rights, appeal to the person listed in the provider’s Notice of Privacy Practices or the patient representative and explain that you are the identity theft victim. You have the right to request that inaccurate information be amended. If the provider denies the correction after investigating, you can ask that a written explanation of the dispute be added to your file.¹⁶

Employment

If someone uses your Social Security number to get a job, the employer reports their wages to the IRS under your number. You may not find out until an IRS notice arrives about unreported income. File Form 14039 with the IRS and report the misuse to the Social Security Administration’s Office of the Inspector General at 1-800-269-0271.¹⁷ Check your Social Security earnings statement at ssa.gov to confirm only your actual employers appear.

If the Victim Is a Child

Children are attractive targets because their Social Security numbers have no credit history attached. A thief can use a child’s number for years, often undetected until the child applies for a first credit card, student loan, or job.

Warning signs: bills or pre-approved credit offers in your child’s name, collection calls about debts your child supposedly owes, or IRS notices referencing income your child did not earn. Check whether your child has a credit file by contacting each bureau: Equifax at 888-202-4025, Experian at 800-493-1058, and TransUnion at 800-680-7289. If a file exists and your child did not create it, that confirms identity theft.

Federal law lets parents and legal guardians place a free credit freeze for anyone under 16. You will need proof of your authority, such as a birth certificate. If a bureau does not already have a file on your child, it will create one solely to freeze it, and that file cannot be used for credit decisions.¹⁸ Then report the theft at IdentityTheft.gov and follow the same dispute and blocking process you would use for an adult.

Keep Watching After the Cleanup

Recovery is not a single event. Even after the freezes, reports, and closures, watch for signs the thief kept enough of your information to try again.

All three major bureaus now offer free weekly credit reports on a permanent basis through AnnualCreditReport.com, the only site authorized by federal law for free reports.¹⁹ Check all three, because creditors do not always report to every bureau. Compare each report against your own records for accounts you did not open, addresses where you have never lived, inquiries you did not authorize, and employer names you do not recognize. If anything is wrong, use your identity theft report to request a block under the Fair Credit Reporting Act rather than filing a standard dispute.⁵

Check your bank and credit card statements weekly, and pay attention to small transactions you do not recognize. Thieves often test a stolen card number with a small charge before attempting a larger one. Report anything suspicious right away: the 60-day credit card window and the two-business-day debit card window are what keep your liability at $50 rather than $500 or more.⁹

If someone was arrested or committed crimes using your identity, those records may appear on background checks in your name. Ask local law enforcement to run your name through state and federal databases for outstanding warrants or convictions you were unaware of. If criminal records exist, you can petition the court in the jurisdiction where the crime was charged for a finding of factual innocence, using your identity theft report, police report, and any documentation proving you were not the person involved. Some states also offer identity theft passport programs through the attorney general’s office that give you a credential to show law enforcement if you are ever stopped on a warrant that belongs to the thief.

1
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
2
Federal Trade Commission. Credit Freezes and Fraud Alerts
3
IdentityTheft.gov. IdentityTheft.gov Recovery Steps
4
Federal Trade Commission. IdentityTheft.gov Recovery Checklist
5
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
6
ChexSystems. Place a Security Freeze
7
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
8
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
9
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
10
Federal Trade Commission. How To Recover Your Hacked Email or Social Media Account
11
Internal Revenue Service. Form 14039 – Identity Theft Affidavit
12
Internal Revenue Service. Get an Identity Protection PIN
13
Internal Revenue Service. Instructions for Requesting Copy of Fraudulent Returns
14
U.S. Department of State. Report Your Passport Lost or Stolen
15
Federal Trade Commission. What To Know About Medical Identity Theft
16
Federal Trade Commission. Medical Identity Theft – FAQs for Health Care Providers and Health Plans
17
Social Security Administration. How Do I Report Fraud in the Social Security, Supplemental Security Income (SSI) or Medicare Programs
18
Federal Trade Commission. New Protections Available for Minors Under 16
19
Federal Trade Commission. Free Credit Reports