Identity Recovery · Checklist · Reviewed July 14, 2026
Identity theft, credit freeze, and recovery check
When someone uses your name, order matters. This is the first-day sequence for accounts, credit, and government records.
The short version
Stop the live loss, then lock the next door
Call each affected company first, secure the account, and change exposed sign-in details from a trusted device. Then freeze all three credit files, report the theft at IdentityTheft.gov, and follow the recovery plan for each false account or record.
What changes the answer: A credit freeze helps stop new credit accounts. It does not stop theft from an existing bank, card, tax, benefit, phone, utility, medical, or online account.
Stopping one card is not the same as preventing new accounts or clearing false records. Work in layers: affected accounts, credit files, an identity-theft report, and the agency tied to the misuse.
How it works
The first call goes to the account being used
A credit freeze cannot stop a thief who is already inside an account. Call the fraud team at the bank, card company, lender, phone company, utility, marketplace, or agency where the misuse happened. Ask it to block access, stop new activity, and explain its dispute steps.
Change passwords, recovery email addresses, PINs, and security questions from a device you trust. Turn on stronger sign-in protection. Save the case number, the name of the person who helped, and the time of every call.
A freeze and a fraud alert do different work
A credit freeze blocks many new creditors from opening an account in your name. It is free and stays in place until you lift it. You must contact Equifax, Experian, and TransUnion separately.
A fraud alert tells a business to verify your identity before opening new credit. An initial alert is free and lasts one year. Contact one bureau for the alert; that bureau must tell the other two. A freeze is the stronger block for new credit.
The FTC report turns the problem into a recovery plan
IdentityTheft.gov asks what happened and builds steps for that kind of theft. Save the FTC Identity Theft Report, letters, and recovery plan. Companies and credit bureaus may ask for those records when you dispute false accounts or information.
The report does not update every company by itself. Send the right documents to each place named in the plan. Keep proof of delivery and a copy with personal numbers covered when the full number is not needed.
California gives victims a local police-report path
California law lets a person who learns or reasonably suspects that someone used their identity start an investigation with the law-enforcement agency for the person's home or place of business. The agency must take a report and give the person a copy.
Bring the false account, credit report, bill, message, or other proof you have. A police report can help with some disputes. It is still separate from the FTC report and the report each affected company needs.
Each false record has its own repair desk
Tax theft goes to the tax agency. Benefit theft goes to EDD, Social Security, or the benefit program. A stolen DMV card or false driver record goes to DMV. Medical, child, criminal, and utility identity theft also use their own records and forms.
Work from one list so no lane gets lost. A general fraud report creates useful evidence, but only the agency or company that owns a record can correct that record.
First moves
- 1
Call the fraud department at each company where misuse happened. Ask it to close or freeze the affected account and stop new charges or access.
- 2
Change passwords, personal identification numbers, recovery email addresses, and security questions from a device you trust. Turn on stronger sign-in protection where available.
- 3
Place a free one-year fraud alert by contacting one nationwide credit bureau. That bureau must tell the other two.
- 4
For stronger new-account protection, place a free credit freeze separately with Equifax, Experian, and TransUnion. Save each PIN, password, or confirmation.
- 5
Get current credit reports through AnnualCreditReport.com. Mark every account, inquiry, address, employer, and balance you do not recognize.
- 6
Report the identity theft at IdentityTheft.gov. Save or print the FTC Identity Theft Report and the recovery plan before leaving if you do not create an account.
- 7
California allows an identity-theft victim to report the crime to the local police agency where the victim lives or does business. Ask for a copy of the report.
- 8
Send the FTC report, police report when useful or required, proof of identity, and dispute letters to the companies and credit bureaus named in the recovery plan. Keep copies, tracking, and dates.
- 9
Use the agency-specific route for tax, EDD, Social Security, medical, child, DMV, criminal, or benefit identity theft. One general report does not update every agency.
Watch for
- 1
A fraud alert and a credit freeze are different. One bureau can place the alert with all three, but a freeze must be placed and lifted at each bureau.
- 2
Credit monitoring can warn about changes. It does not block new credit the way a freeze can.
- 3
A freeze does not stop misuse of an existing bank, card, tax, benefit, phone, utility, or medical account.
- 4
Use AnnualCreditReport.com for the federally authorized report source. Search ads and lookalike sites can lead to paid products.
- 5
Do not send full identity documents to an address from an unexpected message. Start from the known company or agency site.
- 6
Debt collection, court, tax, benefit, and account-dispute deadlines can continue while identity-theft reports are pending.
- 7
A recovery company that demands payment by gift card, wire, crypto, or payment app may be another scam.
Official sources
Where to confirm this
Use the source that matches the step you are on. Current forms, fees, deadlines, and agency decisions can change after this page is reviewed.
Use this as a map. It does not decide your rights, tell you what to file, or say someone broke the law. If a deadline, denial, eviction, firing, injury, tax bill, permit fight, or insurance dispute is on the line, use the official source or a licensed professional.