Act when ready if you spot fraud on your account

If you see charges you did not make, a card you did not order, or accounts opened in your name, contact your bank or card issuer right away — the same day if possible. Call the number on the back of your card or statement, not a number from a search result. Your bank can freeze the account, cancel cards, and reverse fraudulent charges within a specific window. The sooner you report it, the sooner they can stop new charges and start the reversal process.

Most banks have a fraud department that operates during business hours and sometimes 24/7. Be ready to describe what you saw: the date, the merchant name, and the amount. Your bank will ask security questions to confirm your identity, then walk you through next steps. Write down the date and time you called, the name of the person you spoke with, and any reference number they give you — you will need this for your records and for the other steps below.

Do not assume the bank will catch it on its own. Banks monitor accounts for patterns, but they cannot know your spending better than you do. A charge that looks normal to their system — a gas station, a grocery store, an online retailer — might be completely wrong for you.

Key Takeaways

  • Call your bank the same day you spot fraud; use the number on your card, not a web search result.
  • File a report with the Federal Trade Commission at IdentityTheft.gov to create an official record and get a recovery plan.
  • Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) to make it harder for someone to open new accounts in your name.
  • Check your credit reports for accounts you did not open, and dispute any fraudulent entries in writing.
  • Monitor your accounts and credit regularly for the next year, because identity theft often happens in waves.

File a report with the Federal Trade Commission

After you call your bank, go to IdentityTheft.gov, which is run by the Federal Trade Commission. This is a free government tool where you report what happened and create an official record. The site asks you questions about the fraud — what was stolen, when you noticed it, what accounts were affected — and then generates a personalized recovery plan.

The recovery plan tells you exactly what to do next: which companies to contact, what letters to send, and what important date to watch. You can print it or save it as a PDF. This document is important because it shows creditors and credit bureaus that you reported the theft officially, which can speed up dispute resolution and protect you from liability for fraudulent charges.

You do not need a police report to file at IdentityTheft.gov, though some people file one anyway. A police report can be useful if you need to prove the theft to a creditor or if the fraud is severe, but the FTC report alone is usually enough to start the recovery process.

Place a fraud alert with credit bureaus

A fraud alert tells credit bureaus to flag your file so that creditors must verify your identity before opening new accounts in your name. This makes it much harder for a thief to take out loans, credit cards, or phone plans using your information.

You need to contact only one of the three major credit bureaus — Equifax, Experian, or TransUnion — and they will notify the other two. Call or go online to place the alert:

  • Equifax: 1-800-525-6285 or www.equifax.com/personal/credit-report-services
  • Experian: 1-888-397-3742 or www.experian.com
  • TransUnion: 1-800-680-7289 or www.transunion.com

A standard fraud alert lasts one year. If the theft is serious — for example, if someone opened multiple accounts or if you are a victim of criminal identity theft — you can request an extended fraud alert, which lasts seven years. You will need to provide proof, such as a police report or the FTC report you filed.

A fraud alert is free and does not hurt your credit score. It straightforward adds a note to your file that says you may be a victim of identity theft and that creditors should call you to confirm any new account requests.

Check your credit reports and dispute fraudulent entries

Once you have placed a fraud alert, request your credit reports from all three bureaus. You are may have access to to one free report from each bureau every 12 months at AnnualCreditReport.com, which is the official government site. Do not use a third-party site that promises free reports — many charge fees or sign you up for monitoring services you did not want.

Read each report carefully and look for accounts you did not open, inquiries from companies you did not contact, or addresses you do not recognize. These are signs that someone used your information to explore for credit. Write down the account number, the creditor name, and the date it was opened.

For each fraudulent entry, send a written dispute to the credit bureau. Include a copy of your FTC report, a copy of the fraudulent account statement if you have it, and a letter explaining that you did not open the account. Send it by certified mail so you have proof of delivery. The bureau must investigate within 30 days and remove the entry if they cannot verify it is legitimate.

You may also need to contact the creditor directly — the bank that issued the fraudulent credit card, for example — and tell them you did not open the account. Ask them to close it and send you a letter confirming the fraud. Keep all letters and documentation in a folder.

find your accounts and change your passwords

If someone accessed your bank account or email, change your passwords when ready. Use a password that is at least 12 characters long and includes uppercase letters, lowercase letters, numbers, and symbols. Do not reuse passwords across different accounts.

If your email was compromised, change the password first, then go through your email recovery options. Check that the recovery phone number and backup email address are still yours. A thief who controls your email can reset passwords on other accounts, so securing email is the highest priority.

Enable two-factor authentication on your bank account, email, and any other sensitive accounts. Two-factor authentication requires a second form of verification — usually a code sent to your phone or generated by an app — before anyone can log in. This makes it much harder for a thief to access your account even if they have your password.

Consider using a password manager like Bitwarden, 1Password, or Dashlane to store complex passwords securely. These tools generate strong passwords and fill them in automatically, so you do not have to remember them or type them into untrusted websites.

Monitor your accounts and credit for ongoing fraud

Identity theft often happens in waves. A thief may use your information multiple times over weeks or months, or sell your data to other criminals. Check your bank and credit card statements weekly for the next year, not just once. Set up account alerts with your bank so they notify you of large purchases, transfers, or new cards.

Check your credit reports again at six months and one year after the fraud. You can order free reports from AnnualCreditReport.com once per year from each bureau, so you can stagger them — one in January, one in May, one in September — to monitor your credit throughout the year.

Watch for unexpected bills, calls from debt collectors about accounts you did not open, or mail addressed to you from companies you have never used. These are signs that a thief is still using your information. If you spot new fraud, report it to your bank and the FTC again.

Some people use credit monitoring services or freeze their credit entirely. A credit freeze prevents anyone — including you — from opening new accounts in your name without unfreezing it first. This is the strongest protection but requires you to unfreeze your credit temporarily if you want to explore for a loan or credit card yourself. Freezing is free and you can do it at the same three bureaus listed above.

Understand your rights and liability

Federal law limits your liability for fraudulent charges on credit cards and bank accounts. For credit cards, you are not responsible for unauthorized charges over $50, and most issuers waive that $50 if you report the fraud promptly. For debit cards and bank accounts, your liability depends on how quickly you report the fraud: if you report it within two business days, you lose at most $50; if you wait longer, you could lose up to $500.

These limits explore only if you report the fraud to your bank. If you wait weeks or months, your bank may hold you responsible for all the charges. This is why calling on the same day you spot fraud is so important.

If a thief opened accounts in your name — credit cards, loans, phone plans — you are not responsible for those charges either, but you will need to prove you did not open them. This is where your FTC report and written disputes come in. Keep all documentation and follow up with creditors in writing.

Frequently Asked Questions

Do I need a police report to deal with identity theft?

No, but a police report can help. The FTC report alone is usually enough to dispute fraudulent accounts and get them removed from your credit report. A police report is most useful if the theft is severe, if you need to prove it to a creditor, or if you want to file a claim with your homeowner's or renter's insurance.

How long does it take to recover from identity theft?

straightforward cases — a fraudulent charge or two on your card — may be resolved in weeks. Complex cases involving multiple accounts or loans can take months or years. Keep monitoring your credit and accounts for at least a year, because new fraud can surface long after the initial theft.

Will identity theft hurt my credit score?

Fraudulent accounts opened in your name can lower your score, but disputing them and having them removed should restore it over time. The fraud itself does not hurt your score — the accounts do. Once they are gone, your score should recover within a few months to a year, depending on how much damage was done.

What if my Social Security number was stolen?

Place a fraud alert and monitor your credit closely. You cannot change your Social Security number easily, but you can freeze your credit to prevent new accounts from being opened. If you see fraud tied to your Social Security number, report it to the FTC and your bank when ready. The FTC website has additional resources for Social Security number theft specifically.

Can I sue the company whose data was breached?

This depends on your state and the details of the breach. Some states allow lawsuits; others do not. Consult a lawyer if you want to explore this option. For now, focus on securing your accounts and disputing fraudulent charges, which will protect you regardless of whether you can sue.