Discovering that your identity has been stolen — through an unfamiliar account on your credit report, a tax return rejected because one has already been filed in your name, a debt collector calling about debts you didn’t incur, or a notification of government benefits being claimed in your name — is one of the most stressful financial events a person can experience. Identity theft recovery is the systematic process of documenting the theft, stopping the immediate damage, correcting fraudulent records, and rebuilding the credit and documentation the theft compromised. This fits into the wider topic we cover in our Complete Guide to Security and Privacy.
The FTC estimates the average recovery takes 200 hours of effort spread over six months or more, depending on the severity and the number of fraudulent accounts involved. This is not a sprint — it’s a campaign. Understanding the full scope before beginning prevents the discouragement that comes from discovering the process is longer than expected.
Step 1 — Containment and documentation (do these first)
Place an immediate credit freeze at all three major bureaus. This is the single most important first action. A credit freeze prevents any new credit account from being opened in your name — it stops the attacker from opening additional fraudulent accounts while you work through the existing ones. Freezes are free, can be placed online at each bureau’s website within minutes, and can be temporarily lifted when you need to apply for legitimate credit. Place the freeze before taking any other action — every hour of delay is another window for additional fraudulent accounts.
- Equifax: equifax.com/personal/credit-report-services/credit-freeze/
- Experian: experian.com/freeze/center.html
- TransUnion: transunion.com/credit-freeze
Download credit reports from all three bureaus (annualcreditreport.com provides free weekly access) and identify every fraudulent item — accounts you didn’t open, addresses you’ve never lived at, employers you didn’t work for, and inquiries you didn’t authorise. Create a master list of every fraudulent item with the creditor name, account number if visible, and the date it was opened or reported. This master list drives every dispute, creditor contact, and follow-up throughout the recovery.
Document thoroughly at the start — it saves significant time in every subsequent step. Our guide on protecting your online identity covers the preventive credit monitoring practices that detect identity theft earlier.
The complete recovery process
- File an identity theft report with the FTC. Go to identitytheft.gov (US) or the equivalent national reporting agency in your country. The FTC identity theft report is a legal document — creditors, debt collectors, and credit bureaus are legally required to accept it as evidence. It also generates a personalised recovery plan with pre-filled dispute letters for your specific situation. UK residents report to Action Fraud at actionfraud.police.uk.
- File a police report. Take your FTC identity theft report to your local police department. Some creditors require a police report number for disputes; having one speeds the process and provides an additional official record. Request a copy of the police report for your records.
- Contact each fraudulent creditor directly. For each item on the master list, call the creditor’s fraud department (the number is on the credit report listing) and report that the account was opened fraudulently. Provide the FTC identity theft report number. Request that the account be closed, fraudulent charges removed, and written confirmation sent. Document every call: date, time, representative name, and what was agreed. This step is the most time-consuming and the one most people underestimate — some creditors require multiple contacts and escalations.
- Dispute each fraudulent item with all three credit bureaus. The FTC’s identitytheft.gov generates pre-filled dispute letters for each bureau. Submit disputes to Equifax, Experian, and TransUnion for every fraudulent item — account, inquiry, and address. Under the FCRA, bureaus must investigate and respond within 30 days. Submit in writing (certified mail or the bureau’s online dispute portal) and keep copies of everything.
- Place a fraud alert alongside the credit freeze. An initial fraud alert (free, lasts one year) requires creditors to take extra verification steps before opening new accounts. An extended fraud alert (requires identity theft report, lasts seven years) provides stronger protection. Place an alert with one bureau — they’re legally required to notify the other two.
- Secure all compromised accounts. For every online account affected — email, banking, government accounts — change the password immediately using a generated unique password. Enable two-factor authentication. Review active sessions and terminate unfamiliar ones. If the email account was compromised, follow the full remediation process in our guide on checking if your email was hacked.
- Monitor the recovery progress. Check credit reports monthly during active recovery to confirm disputed items have been removed and no new fraudulent activity appears. Keep all correspondence in a dedicated folder — physical and digital — for follow-ups and escalations.
Creditors are legally required to block fraudulent accounts under the FCRA when presented with an identity theft report. In practice, this requires persistence — document every contact with the date, the representative’s name, and the specific commitment made. This audit trail is essential for escalation if the creditor doesn’t follow through.
Tax and government identity fraud — a separate track
Government identity fraud operates through different channels from financial credit fraud. Tax identity theft — where an attacker files a fraudulent return to claim a refund before you file yours — has become one of the most common types and requires a separate IRS-specific response.
If the IRS rejects a return because one has already been filed for your SSN: file the legitimate return by paper (not e-file, since the system already has a filing for your SSN) accompanied by Form 14039 Identity Theft Affidavit. The IRS assigns a unique IP PIN to confirmed identity theft victims — a 6-digit number required on all future returns that prevents any return being filed without it. IRS identity theft recovery can take 12–18 months to fully resolve; the IP PIN provides protection during and after this period. The IRS Identity Protection Specialised Unit: 1-800-908-4490.
Driver’s licence and passport identity theft recovery involves the relevant government agency directly — DVLA in the UK, state DMVs and the State Department in the US. A fraudulent document requires reporting to the agency with the FTC report or police report, then applying for a replacement with enhanced verification. If the fraudulent identity was used to commit crimes, correcting the associated criminal record may require legal assistance beyond standard recovery steps.
Rebuilding credit after fraudulent accounts
After fraudulent accounts have been disputed and removed, the credit score may still show the impact — missed payments recorded before fraud was detected, high utilisation from fraudulent charges, or account age effects. The rebuild takes time, but specific actions accelerate it.
Verify removal across all three bureaus independently. Fraudulent items sometimes remain on one or two bureaus even after being removed from the third. Once removal is confirmed on each, request updated credit reports from all three and verify the removal is complete. If any items were incorrectly retained: escalate to that bureau with the original dispute documentation and the FTC identity theft report.
| Credit rebuilding action | Impact | Timeline |
| Maintain on-time payments on existing legitimate accounts | High — payment history is 35% of score | Immediate, compounds monthly |
| Keep credit utilisation below 30% | High — utilisation is 30% of score | Reflects within 1-2 billing cycles |
| Keep oldest legitimate accounts open | Medium — preserves credit history length | Ongoing |
| Avoid new credit applications during recovery | Medium — prevents hard inquiry penalties | Each hard inquiry lasts 2 years |
| Secured credit card if rebuilding from scratch | Medium — builds positive history without fraud risk | 3–6 months to establish pattern |
The combination of clean credit reports, a credit freeze preventing new fraudulent accounts, and normal positive account behaviour typically restores the credit score to near its pre-theft level within 12–24 months of fraudulent items being removed.
When to involve a consumer protection attorney
For cases involving significant debt wrongly attributed to you — amounts affecting housing applications, employment background checks, or professional licensing — legal assistance may be warranted. A consumer protection attorney can exercise legal rights on your behalf, file complaints with regulatory agencies, and in some cases pursue statutory damages against creditors who failed to process disputes within the legally required timeframes. Many consumer protection attorneys offer free initial consultations, and cases involving FCRA violations may be taken on contingency — the attorney is paid from any damages awarded rather than requiring upfront fees.
Legal recourse is particularly relevant when the standard dispute process meets institutional resistance that requires escalation beyond a standard complaint. If a creditor refuses to acknowledge a dispute, fails to respond within the 30-day FCRA timeframe, or continues to report a fraudulent account after being notified of the identity theft, these are FCRA violations that give rise to legal claims.
The psychological dimension
Identity theft creates a sustained sense of violation and loss of control — someone has used your identity, made decisions in your name, and created problems you must now spend months resolving. This process is exhausting not because it’s technically complex but because it requires persistent engagement with bureaucratic processes designed for institutions’ convenience rather than the victim’s.
Practical coping strategies: break the process into defined phases (containment → documentation → disputes → monitoring) and address one creditor or bureau at a time rather than attempting to resolve everything simultaneously. Set aside dedicated time weekly for recovery tasks. Keep meticulous records to reduce the cognitive load of tracking where things stand. Acknowledge that recovery measured in months rather than days is normal — not a failure.
For the FTC’s identity theft recovery resources and the personalised recovery plan generator, identitytheft.gov is the authoritative US government resource that generates pre-filled dispute letters for your specific situation and tracks your recovery progress. Victims who use this official framework and document every step consistently recover faster than those who navigate the process independently without the structured documentation approach.
Child identity theft — a specific scenario
Children’s identities are particularly targeted because they have clean credit histories with no monitoring. A child’s SSN can be used to open credit accounts that may go undetected for years — until the child applies for credit as an adult and discovers a damaged history.
Signs of child identity theft: your child receives credit card offers or collection notices in their name; you’re turned down for benefits because the child “already receives them”; the child’s SSN comes back with a credit history when you check.
Recovery steps for child identity theft follow the same general process but with some additions:
- Contact each bureau specifically to check whether a credit file exists for the child’s SSN (bureaus don’t create files for minors without cause, so any existing file indicates identity theft)
- Place a credit freeze on the child’s SSN at all three bureaus — this requires submitting documentation of parentage or guardianship in addition to the standard freeze request
- File Form 14039 with the IRS if tax fraud is involved
- Contact the Social Security Administration if the SSN was used for employment fraud (someone working under the child’s SSN creates a record the SSA maintains)
What to do if identity theft happens again
Identity theft victims are at elevated risk of repeat theft because their personal information is already circulating in criminal databases. After completing the initial recovery: If this sounds familiar, Remove Malware from Windows is worth a look.
- Keep the credit freeze active permanently rather than lifting it after recovery — lift temporarily only for specific legitimate credit applications, then reinstate immediately
- Sign up for free breach notifications at haveibeenpwned.com so that any new appearance of your email addresses in breach databases triggers an immediate alert
- Request your IRS IP PIN annually if tax fraud was involved — the IP PIN provides protection only for the tax year it’s issued, and must be renewed each year at irs.gov/identity-protection-pin
- Set Google alerts for your name — a simple ongoing monitoring that occasionally surfaces fraudulent activity using your identity in public-facing contexts
- Review all three credit reports quarterly rather than annually for the 24 months following recovery — the elevated risk period where monitoring matters most
Identity theft recovery is one of the more unpleasant processes anyone will navigate. But it is achievable, it has a defined end, and the combination of credit freeze, documented disputes, and systematic creditor engagement closes the fraudulent accounts, removes them from credit reports, and restores the financial standing the theft temporarily compromised. The victims who recover most successfully are those who document thoroughly, engage systematically with every creditor and bureau, and treat it as a project with phases and milestones rather than an overwhelming single problem. Our guide on Protect Against Ransomware covers an adjacent issue.
