What to Do If Someone Is Using Your Identity Online

Identity theft moves fast. The sooner you act, the less damage gets done. Whether someone has opened accounts in your name, filed taxes using your Social Security number, or taken over your online accounts, each type requires different steps. This guide walks through all of them.

Start Here: IdentityTheft.gov

Before doing anything else, go to IdentityTheft.gov, the FTC's official identity theft recovery portal.

Phone: 1-877-438-4338

What it does:

• Generates a personalised recovery plan based on what happened to you
• Creates an official FTC Identity Theft Report, which you can use as documentation with creditors, banks, and credit bureaus
• Provides pre-filled letters to send to companies where fraudulent accounts were opened
• Tracks your recovery progress

What to expect: No personal investigator is assigned to your case. The portal provides tools and documentation; you use them to contact the relevant organisations. Recovery typically takes weeks to months depending on the scope of the theft.

Immediate Steps for All Identity Theft

Step 1: Place a fraud alert Contact one of the three credit bureaus to place a free fraud alert on your credit file. That bureau must notify the other two. A fraud alert requires lenders to take extra steps verifying your identity before opening new credit.

• Equifax: equifax.com or 1-800-525-6285
• Experian: experian.com or 1-888-397-3742
• TransUnion: transunion.com or 1-800-680-7289

An initial fraud alert lasts one year. If you have a police report, you can request an extended alert lasting seven years.

Step 2: Consider a credit freeze A fraud alert requests caution from lenders; a credit freeze blocks access entirely. Place a freeze at all three bureaus for the strongest protection. It is free and does not affect your credit score. See the full guide on how to freeze your credit for step-by-step instructions.

Step 3: Get your free credit reports Check all three credit reports at AnnualCreditReport.com for accounts or inquiries you do not recognise. Dispute anything fraudulent directly with each bureau.

Step 4: Change compromised passwords Change passwords on any account that may have been accessed. Start with email, then banking, then any account that uses the same password. Enable two-factor authentication everywhere it is available.

If Fraudulent Accounts Were Opened in Your Name

1. Get your Identity Theft Report from IdentityTheft.gov
2. Contact each company where a fraudulent account was opened using IdentityTheft.gov's pre-filled letters
3. Request that the fraudulent account be closed and removed from your credit report
4. Follow up in writing by certified mail and keep copies of everything
5. Dispute the account with all three credit bureaus in writing

Companies are required to block fraudulent information from your credit report when you provide an Identity Theft Report. They must investigate within 30 days.

If Someone Filed Taxes Using Your SSN

Tax identity theft occurs when someone uses your Social Security number to file a tax return and claim a refund before you do.

File IRS Form 14039 (Identity Theft Affidavit) at irs.gov/identity-theft-central or by mail.

Phone: 1-800-908-4490 (IRS Identity Protection Specialised Unit)

What to expect: The IRS processes identity theft cases but it is slow, often taking 6 to 18 months to fully resolve. The IRS will issue you an Identity Protection PIN (IP PIN) that must be used on all future returns to prevent repeat theft.

If Someone Took Over Your Online Accounts

Email account takeover:

1. Use the platform's account recovery process immediately (Google, Microsoft, Yahoo each have recovery pages)
2. Once access is restored, change the password and enable 2FA
3. Check sent folder and account settings for forwarding rules the attacker may have set up
4. Notify contacts that your email was compromised

Social media takeover: Use the platform's "hacked account" recovery page. Each major platform (Facebook, Instagram, X/Twitter, LinkedIn) has a dedicated process. Search "[platform name] hacked account recovery" to find the current direct link.

Bank or financial account takeover: Call the number on the back of your card or on your bank's official website immediately. Do not use contact information found anywhere else. Ask to:

• Freeze the account
• Review recent transactions
• Issue new card numbers
• File an official fraud claim

If Your Medical Identity Was Stolen

Medical identity theft occurs when someone uses your information to receive healthcare, prescriptions, or insurance benefits. It can corrupt your medical records with incorrect information.

1. Request an explanation of benefits (EOB) from your insurer and review for services you did not receive
2. Contact your health insurer's fraud department
3. Request copies of your medical records from any providers listed in fraudulent claims
4. File a complaint with the Department of Health and Human Services at hhs.gov/ocr/privacy

How to File a Police Report

A police report is required by some creditors and may help with extended fraud alerts. Visit your local police station and bring:

• Your government-issued ID
• Your FTC Identity Theft Report from IdentityTheft.gov
• Any evidence of the theft (statements, letters, screenshots)

Ask specifically for a copy of the report with a report number. The officer may not be able to investigate, but the report provides official documentation.