Identity Theft Recovery Checklist: What to Do First and How to Protect Accounts

Finding an unfamiliar account, unauthorized payment or suspicious login can be frightening. The most useful response is a prioritized checklist: protect affected accounts, contact financial providers through verified channels, preserve evidence and report the incident to the appropriate authority. Different problems require different remedies, however. A stolen bank card, leaked email password and new credit account opened without consent are not the same event. This guide explains the U.S. Federal Trade Commission’s identity-theft recovery approach and how to adapt the principles to your jurisdiction without treating U.S. credit bureaus as worldwide services.

First: identify what might be compromised

What to do in the first hour

1. Open the financial institution or affected account directly through a trusted app or a typed official URL.
2. Contact the fraud department and ask whether accounts, payment cards or sessions should be frozen or locked.
3. Change compromised passwords starting with your primary email, then banking and other linked accounts.
4. Enable multifactor authentication and review recovery phone numbers, email addresses and recent logins.
5. Do not click links from unexpected “fraud team” texts; attackers may exploit the incident with phishing messages.
6. Record dates, unknown transactions and the case number given by the official provider.
7. Report promptly where relevant so you do not miss applicable dispute deadlines.

The FTC’s identity-theft recovery checklist begins with contacting affected companies, securing accounts and reporting identity theft.

Credit fraud alerts and credit freezes in the United States

If someone used your identity to open accounts, U.S. consumers may consider free fraud alerts and credit freezes through the major credit bureaus. A fraud alert asks lenders to take extra verification steps; a security freeze generally restricts access to your report for new-credit purposes, subject to exceptions. They have different procedures and consequences. Verify current instructions through official bureau sites and government resources rather than paying a middleman who says only they can submit the request.

Review your credit reports

In the U.S., AnnualCreditReport.com is the federally authorized service for obtaining reports from major reporting companies. Review names, addresses, inquiries and accounts you do not recognize. Incorrect data is not proof of deliberate fraud in every case; contact the bureau and lender with the actual discrepancy. Save a copy of the report and correspondence.

Filing an identity theft report

For people within the relevant U.S. framework, IdentityTheft.gov helps generate an FTC identity theft report and tailored recovery plan. Depending on what occurred, you may also need a police report, tax-agency notification, medical-record correction or creditor dispute. The FTC’s plan provides examples of letters and steps, but a real account provider may have its own lawful identity-verification procedure.

If you live outside the United States

Do not assume U.S. fraud alerts, Social Security numbers or credit-bureau forms apply elsewhere. Contact your own country’s credit-reporting services, bank and authorized cybercrime reporting body. In India, for example, use the official National Cyber Crime Reporting Portal where appropriate and the bank’s established fraud channel for a financial incident. Local privacy and consumer rights differ.

How to preserve evidence without exposing yourself again

• Save account statements showing disputed transactions and dated reference numbers.
• Store phishing emails as evidence without opening attachments or unknown links.
• Record who you contacted, when, and what they advised.
• Keep screenshots of suspicious logins and messages in a private secure folder.
• Share documents only through verified bank, bureau or agency channels.
• Do not publish identity numbers or sensitive evidence in public forums while asking for help.

Preventing another account takeover

Create a unique password for every important account and consider a reputable password manager. Turn on a strong available second factor or passkey as supported; avoid treating an ordinary password alone as sufficient protection. Review account recovery details, connected apps and trusted devices. Update phones, browsers and computers promptly, and be suspicious of software that asks for remote access to “repair” your bank account. The CISA multifactor-authentication guidance explains why adding a second step protects accounts after password theft.

Understanding recovery scams

Someone who has already lost money may receive messages from strangers offering guaranteed recovery for an advance fee. Treat such claims with extreme skepticism. Fraud investigators, banks and official authorities have their own verified channels, and no outside agent can simply promise to reverse an irreversible payment. Never give remote device access or your account login to a person who contacted you unexpectedly.

Illustrative recovery timeline

This is a planning sequence rather than a legal deadline. Some disputes must be raised quickly under the relevant provider or local law; do not wait for a schedule in a general article if money is currently being stolen.

Common mistakes

• Replying to a scammer who impersonates your bank’s fraud team.
• Changing a shopping-site password but leaving the email account compromised.
• Assuming every unknown inquiry proves a new fraudulent account.
• Paying an unknown recovery agent for guaranteed results.
• Posting account numbers, identification or statements publicly.
• Failing to keep copies of dispute and correction correspondence.
• Applying U.S. credit-bureau procedures without checking your own country’s system.

Frequently asked questions

Should I freeze my card if a transaction looks fraudulent?

Contact the actual issuer promptly; it can advise whether to lock, replace or otherwise secure the card and how to dispute transactions.

Is identity theft the same as phishing?

No. Phishing is a method used to steal information; identity theft is misuse of identity data. Phishing can lead to identity theft but does not always do so.

What if I clicked a suspicious link but entered nothing?

Do not assume a download was harmless. Follow current device-security guidance, scan for threats and check accounts for unusual activity.

Does MFA guarantee my accounts cannot be compromised?

No. It adds valuable protection but cannot eliminate scams, malicious apps or users approving fraudulent sign-in prompts.

Can I fix a fraudulent account through a report alone?

Usually the report is part of the process. You may also need to contact the creditor, credit bureau or agency to correct actual records.

Sources and independence

References: FTC identity theft recovery steps, authorized U.S. credit report service, CISA MFA guidance and India cybercrime reporting. For fraud prevention before purchase, see our online seller safety checklist. Two flowcharts were created for this article. No reader case or government outcome has been personally investigated by Cen Xianyuan; this is general information, not legal advice.

Information is general guidance; use the official sources cited in this article for current rules.