Identity Theft What to Do in the First 24 Hours

U.S. consumers lost $27.2 billion to identity fraud in 2024, a 19% increase from 2023, according to Javelin Strategy & Research. If you're searching for “identity theft what to do,” start with the clue you have, not every possible disaster. An unfamiliar card application, a hijacked gaming account, and a breach notice need different first moves.

Your First Hour Order

Say you find an unfamiliar credit-card application and a password-reset email you didn't request. Your first instinct might be to delete the email and call the bank. Instead, preserve the message and secure the account that receives your resets.

Take these actions before trying to identify the original breach:

1. Write down what looks wrong. List unfamiliar accounts, cards, applications, and charges. Note the email address and mobile number attached to password recovery.
2. Secure your primary email. From a trusted device, change its password, inspect recovery settings, and sign out other sessions. Save suspicious messages before deleting anything.
3. Contact affected companies. Call each company's fraud department through its official app, statement, or website. Ask to close or freeze the affected account and replace its login, password, and PIN.
4. Check tax-related clues. Look for an unexpected filing notice, refund activity, or a return you didn't submit. If something looks wrong, contact the relevant tax agency through its official channel.
5. Choose the matching situation below. Use your strongest concrete clue, rather than assuming every exposed detail has already been abused.

A breach notice isn't proof that money was stolen. Our data breach victim guide helps separate exposure from confirmed misuse, so you can respond without treating every notification as financial fraud.

Don't delete a suspicious account just to make it disappear. You could erase evidence a creditor later requests. If fraudulent reporting has already damaged your credit, Superior Credit Repair's resource on how to repair your credit in Illinois can provide additional context while you pursue the underlying identity-theft disputes.

First priority: Secure the reset email and recovery phone before a lengthy argument with a bank. If money is actively moving, contact the bank immediately while securing those recovery channels.

Match Today's Clue to the Right First Move

Pick one row before calling every company. Official recovery guidance often begins with a recognizable fraudulent account. Your first evidence may instead be scattered across an old email inbox, a gaming profile, and an unfamiliar address.

Account takeover isn't limited to banking. TransUnion found that global digital account-takeover volume increased 141% from the first half of 2021 to the first half of 2025.

Use this visual to identify the broad category, then follow the more specific action table.

First move by the kind of identity problem

Why the distinctions matter

Synthetic identity fraud combines genuine identifiers with fabricated details. An account may not appear under your exact name, so an unfamiliar employer, address, phone number, or inquiry deserves investigation. A mismatch is a clue, though, not an automatic finding of fraud.

For a hijacked login, credit protection alone won't restore access. Say someone takes over your gaming account and sends payment requests to your friends. You need the platform's recovery process and a warning to contacts, not just a credit-file action.

Exposed identity information becomes especially urgent when someone also controls a working recovery email or phone. That combination can let them reset accounts while you're trying to recover them. If your phone unexpectedly loses service, contact your mobile carrier through another trusted channel.

Tax or government-ID misuse needs a parallel response with the agency responsible for that record. A bank can't correct a tax filing, and a gaming platform can't replace an identity document.

Compare uncertain clues against our guide to signs your identity has been stolen. When you have confirmed fraud or strong suspicion involving new credit, choose the credit-file protection that restricts access.

Choose a Fraud Alert a Freeze or Both

A credit freeze is the stronger tool for new-credit fraud because it blocks most prospective creditors from accessing your file. A fraud alert asks creditors to take extra verification steps, but it doesn't create the same access restriction.

The FTC's recovery guidance explains that you can place a free one-year fraud alert with one nationwide credit bureau, which must notify the other two.

Fraud alert versus credit freeze

Choose protection around your actual risk

For confirmed identity theft, consider both an alert and freezes. The same combination makes sense when sensitive identity information and access to an account-recovery channel have been exposed together. Neither tool restores a hijacked account or reverses an existing charge.

Freezing only one bureau leaves the others accessible. Create separate entries for Equifax, Experian, and TransUnion in your case file, and record whether each freeze is active. Save the login or PIN-based lift instructions each bureau provides.

A freeze can complicate a legitimate mortgage, car loan, or credit-card application. Ask the lender which bureau it needs, arrange the necessary lift, and check that the freeze resumes afterward. Keep these credentials in a password manager rather than an unsecured note.

An alert also isn't a guarantee that every creditor will handle an application correctly. Our guide to free identity theft protection can help you organize the available safeguards without confusing monitoring with prevention.

New-credit risk calls for a freeze at each bureau, not just a single fraud alert. Keep the method for lifting each freeze with your recovery records.

Run the Containment Steps in Order

Follow a documented recovery process rather than relying on whichever company answers first. The Department of Justice's identity-theft guidance supports containing affected accounts, protecting credit files, documenting the theft, and disputing fraudulent information.

Keep this visual beside your notes, but use the numbered instructions below as your working sequence.

Contain misuse and inspect the files

1. Call each affected company's fraud department to stop further misuse. Request account closure or a transaction freeze, then replace the login, password, and PIN. Explain which activity you didn't authorize and ask what documentation the company needs.

   Save the statement or application, screenshots, representative's name, and case number. Ask for written confirmation of the restriction and a secure method for sending documents. Don't send identity documents to an address supplied in an unsolicited message.

2. Put your chosen credit-file protections in place to restrict new applications. Submit the fraud alert through one bureau and place any freezes separately. Record confirmations so you can distinguish a completed request from an application you merely started.

Two common failures waste time: treating an alert as a freeze and stopping after contacting only one bureau. Verify the protection you intended is active.

3. Review every bureau's report because their files can differ. Federal law provides a free report from each nationwide bureau every 12 months, as explained in the FTC's identity-theft recovery booklet. Inventory unfamiliar accounts, inquiries, addresses, employers, and reported balances, then compare account activity with your statements.

   Don't stop because your existing card still works. In 2024, new-account credit-card fraud accounted for 406,110 U.S. identity-theft reports, or 43.9% of the five leading categories, according to the Insurance Information Institute's summary of FTC data. Someone can open a separate account without touching the card in your wallet.

Create the report and submit disputes

4. Report the theft at IdentityTheft.gov to create an official recovery record. Complete the FTC process carefully, using dates and account details from your inventory. Save the resulting Identity Theft Report, personalized recovery plan, and supporting documents.

Describe what you know, and clearly label any uncertainty. You don't need to identify the original breach before documenting an account you didn't open.

5. Use the report to dispute fraudulent debts and file entries. Submit the requested evidence to the relevant creditor, collector, or bureau, and retain a copy of everything sent. Obtain a police report when a creditor, collector, or government agency requires one.

   Ask what will be corrected, who will receive the correction, and how you'll receive confirmation. An account restriction is not the same as removal of its fraudulent credit reporting.

For a complementary explanation of account security, watch this recovery video.

If the incident includes a stolen login, use our account takeover prevention guide to organize provider-specific security checks. Keep statements, screenshots, letters, reference numbers, and a dated call log together, with each unresolved item assigned its next action.

Track the Case File and Clear Leftover Access

Stop relying on memory. Create a protected spreadsheet or document with one row per problem, not one row per phone call.

Your inventory should make the next action obvious, even if you return to it after a frustrating conversation.

The Consumer Financial Protection Bureau's identity-theft guidance explains how identity-theft reports and supporting information help consumers seek correction or blocking of fraudulent information. Keep those documents organized so you can respond without reconstructing the incident.

Review the corrections, not just the promises

Set a weekly review appointment while cases remain open. Inspect bank and card statements for residual charges, and revisit each credit file for new inquiries or addresses that reappear. This is a practical follow-up schedule, not a deadline that guarantees a bureau will finish its review.

Batch calls by institution and prepare the documents before dialing. Where possible, follow an important conversation with a written summary through the company's secure channel. A useful note records what you disputed, what the representative agreed to do, and what remains unresolved.

Say a lender confirms that an application was fraudulent but the related inquiry remains visible. Keep that row open until you verify the promised correction. Our guide to removing hard inquiries from a credit report explains how to approach unfamiliar inquiries without challenging legitimate ones indiscriminately.

Remove access that a password change misses

Credential security deserves its own completion check. Verizon's 2025 Data Breach Investigations Report analyzed more than 22,000 incidents, including 12,195 confirmed breaches; credential abuse accounted for 22% of breaches, and third-party involvement doubled from 15% to 30%.

Use those findings as a reason to inspect connected access, not as proof of how your incident happened. A provider compromise, stolen credential, or malicious application can require different cleanup.

Work through these checks from a trusted, updated device:

• Primary email ownership: Confirm that recovery addresses, phone numbers, and forwarding rules belong to you.
• Authenticated sessions: Sign out unfamiliar devices and revoke active sessions where the provider allows it.
• Multifactor authentication: Remove unknown authentication methods and enable a method you control.
• Reused credentials: Replace the compromised password everywhere else you used it, choosing a unique replacement for each account.
• Connected applications: Remove integrations you don't recognize or no longer need.
• Device updates: Update your phone, operating system, browser, and relevant applications before continuing sensitive account work.

For a workplace login, notify your organization's security team. Don't erase files, reset a managed device, or investigate coworkers' accounts yourself. The organization may need logs or other evidence you can't access.

Report internet crime separately

If the incident involves suspected internet crime, notify every financial institution involved in the transaction. Submit a complaint to the FBI's Internet Crime Complaint Center, known as IC3, and notify local law enforcement; preserve transaction details and payment instructions.

The FBI's 2024 Internet Crime Report announcement recorded 859,532 complaints of suspected internet crime and reported losses exceeding $16 billion. An IC3 complaint serves a different purpose from a credit dispute, so neither replaces the other.

Don't pay someone who contacts you promising guaranteed recovery. Verify any purported investigator or recovery service independently, and don't share authentication codes or give remote device access to an unsolicited caller.

Protect your reputation and contacts

Check where the same email, username, or phone appears, including dormant social accounts, gaming profiles, and professional pages. Treat each match as something to verify, not proof that someone stole your identity.

For a hijacked dating profile, report the takeover and warn affected contacts through a separate trusted channel. An old photo or matching username alone doesn't verify a dating partner's identity or prove catfishing. Avoid posting accusations or another person's private information.

A compromised professional profile also deserves prompt correction. The EEOC's background-check guidance explains that employers may review background information, including social-media activity, but must apply consistent standards and comply with anti-discrimination law. Save platform recovery confirmations and evidence of unauthorized changes if a hiring-related question arises.

A case stays open until the relevant file and statement both show the correction, not merely until someone promises to make it.

Finish Open Cases and See What Is Still Public

This week, focus on closing gaps rather than starting another unstructured search:

• Confirm case ownership: Every open inventory row should have a reference number, next action, and follow-up date.
• Manage legitimate applications: Lift a freeze only when needed for a real application, then confirm that protection resumes.
• Schedule a 30-day checkpoint: Review credit files, bank alerts, and accounts sharing the compromised email. Keep investigating unresolved activity rather than assuming silence means resolution.

If you can't tell which breach exposed your information, make discovery a separate task. Search the involved email addresses and usernames to locate potential connections to older accounts, social profiles, gaming identities, and breach exposure. Investigate phone-linked accounts through the services you recognize.

At Digital Footprint Check, our process is to search a username or email, review potential matches, then act using step-by-step guides. Our free tools include a Profile Checker, Username Search, Data Breach Checker, and Reverse Email Search; start with the free checker. A match shows potential exposure, not proof of theft, and we don't remove listings for you; our guides explain how you can request changes yourself.

Continuous breach and dark-web monitoring alerts users to potential identity-theft risks, but it isn't a security guarantee. Finish the open disputes, then run a free check on the email and usernames involved.

---

Digital Footprint Check helps you discover public profiles and potential breach exposure connected to your online identity, with guides for taking action yourself. Review the identifiers involved in your incident, verify the potential matches, and use what you find to prioritize your next privacy and account-security steps.