Consumer security guide (US)

Identity Theft: What to Do and How to Freeze Your Credit

If your identity has been stolen in the United States: contact the companies where fraud happened, place a free fraud alert, get your credit reports, and report the theft at IdentityTheft.gov, the FTC's site, which builds your Identity Theft Report and a personal recovery plan. Then consider a free credit freeze at all three bureaus.

This is general information for US readers, not legal or financial advice. It follows the FTC's recovery guidance and the bureaus' own freeze pages. We do not sell or recommend any identity theft protection product.

Updated 3 November 2026

Do these three things first

These are the FTC's “What to do right away” steps.

Call the companies where you know fraud occurred. Ask for the fraud department, say someone stole your identity, ask them to close or freeze the accounts, and change logins, passwords and PINs.
Place a fraud alert and get your credit reports. A fraud alert is free and lasts one year. Contact one of the three bureaus and it must tell the other two. Get your free reports at annualcreditreport.com (the FTC booklet gives 1-877-322-8228) and mark any account or transaction you do not recognise.
Report it to the FTC at IdentityTheft.gov or by phone at 1-877-438-4338. Include as many details as you can. The site creates your Identity Theft Report and recovery plan. The FTC warns that if you do not create an account you must print and save both right away, because you cannot return to them later.

Then work through the damage

Close accounts opened in your name. With your Identity Theft Report, call each business's fraud department, ask them to close the account, and ask for a letter confirming it is not yours, you are not liable, and it was removed from your credit report. Keep the letter.
Remove fraudulent charges from your existing accounts the same way, and ask for written confirmation.
Correct your credit report. Write to each bureau with a copy of your Identity Theft Report and proof of identity, say what is fraudulent and ask them to block it. The FTC says that with an Identity Theft Report the bureaus must honour a block request. Without one you can still dispute information, but it can take longer with no guarantee.
Debt collectors. The FTC advises writing to the collector within 30 days of the collection letter, saying you did not incur the debt and enclosing your Identity Theft Report.
Misused Social Security number. If someone may be using it for work, review your work history in your my Social Security account at ssa.gov/myaccount and contact your local SSA office about errors. A lost or stolen card can be replaced free at ssa.gov/ssnumber.
Tax-related theft. The IRS says to report at IdentityTheft.gov, follow any IRS letter, keep filing and paying as usual, and get an Identity Protection PIN (IP PIN). It says most people do not need to file Form 14039.
Police report. Optional in most cases (see the FAQ). Take your Identity Theft Report, a photo ID, proof of address and any evidence.
Keep a log of who you contacted and when, and copies of every letter.

How to freeze your credit (free)

A credit freeze stops anyone opening a new credit account in your name while it is in place. It costs nothing, lasts until you lift it, and you can lift it temporarily when you apply for credit. The FTC suggests lifting it only at the bureau the lender will check, then refreezing.

You must do it at each bureau. Equifax and Experian both state that their freeze does not cover the other bureaus.

Bureau	Online	Phone / mail (per its own page)
Equifax	myEquifax account (you must be 18)	Phone (888) 298-0045; verify by one-time PIN by text or questions about your Equifax report. Under-18 and other cases via its Customer Care page.
Experian	Free Experian account; online changes are in real time and no PIN is needed	1-888-397-3742, or mail to Experian Security Freeze, P.O. Box 9554, Allen, TX 75013 (mail can take up to 3 days to process).
TransUnion	transunion.com/credit-freeze	See that page for current options and numbers.

For mailed requests Experian asks for your full name, Social Security number, addresses for the past two years, date of birth, a government photo ID and a utility bill or bank statement.

Fraud alert or freeze: which?

	Fraud alert	Credit freeze
Cost	Free	Free
Length	Initial: 1 year (renewable). Extended: 7 years. Active duty: 1 year.	Until you lift or remove it
Who	Initial: anyone. Extended: people who have had identity theft and filed an FTC or police report.	Anyone
Set at	One bureau, which must tell the other two	Each of the three bureaus
Effect	You keep access to your report; companies must take steps to verify your identity	Access to your report is restricted until you lift it

You can use both. Sources: FTC credit freeze and fraud alert page, and the FTC recovery booklet.

Lock down the accounts behind it

Identity theft often starts with a reused password or a phishing message. After recovery, use a password manager for unique passwords, turn on multi-factor sign-in or passkeys, and check which of your accounts appear in known breaches.

Last reviewed 3 November 2026. Phone numbers and forms change: confirm on the FTC and bureau sites before relying on them. This guide covers the United States only.

Frequently asked questions

What should I do first if my identity is stolen?

The FTC lists three first steps: call the fraud department of the companies where you know fraud occurred and ask them to close or freeze the accounts and change logins, passwords and PINs; place a free fraud alert with one of the three credit bureaus and get your free credit reports; then report the theft at IdentityTheft.gov (or 1-877-438-4338), which creates your Identity Theft Report and recovery plan.

How much does a credit freeze cost?

Nothing. The FTC says there is no cost to place or lift a credit freeze, and Equifax and Experian say the same on their own pages.

How do I freeze my credit?

Contact each of the three credit bureaus separately: Equifax, Experian and TransUnion. A freeze at one bureau is not shared with the others. Each bureau offers an online account option; Equifax and Experian also take phone requests, and Experian accepts mail.

What is the difference between a fraud alert and a credit freeze?

Per the FTC: an initial fraud alert lasts one year and an extended fraud alert lasts seven years (it needs an Identity Theft Report). Both let you keep access to your report as long as companies verify your identity, and you set it at one bureau, which must tell the other two. A freeze restricts access to your credit report until you lift or remove it, is available to anyone, and must be placed at each of the three bureaus.

How long does a credit freeze last?

Until you lift or remove it, according to the FTC.

Can I freeze my child’s credit?

Yes. The FTC says that if your child is under 16 you can request a free credit freeze, but the process differs from the adult one, so follow each bureau’s own instructions for minors.

Do I need a paid identity theft protection service?

The FTC recovery steps, the fraud alert and the credit freeze are all free. This guide does not evaluate paid monitoring products. If you consider one, compare exactly what it does against the free steps above.

Should I file a police report?

The FTC says your Identity Theft Report is an official report to law enforcement and is sufficient documentation to resolve issues with the credit bureaus and most companies. It suggests also reporting to local police if you have information about a suspect or a specific company asks for a police report.