Verified against official sources — 31 Oct 2026

Identity Stolen in the USA? The FTC Recovery Process, Step by Step

NEW Published 31 October 2026

If someone is using your name, your Social Security number or your accounts, the United States already runs a recovery system for you — free, official, and built around one document. This guide walks the Federal Trade Commission's process in its own order, then the separate IRS route for tax misuse and the Social Security Administration's much narrower lane, using only what those agencies publish.

SECTION 01First Hours: Containment Calls, Then the FTC Front Door

RULE — Learn the signs, because the first sign is often a by-product. The FTC's list is mundane: a bill that stops arriving (someone may have changed your billing address), charges for things you didn't buy, withdrawals you didn't make, or accounts on your credit reports that you don't recognise. The IRS adds tax-side signs — a rejected tax return, a Form W-2 or 1099 from an employer you didn't work for, a notice about income you didn't report — and Section 05 covers those. If what you are seeing matches the lists, treat it as theft, not as an error to watch.

RULE — The FTC's steps start with the companies where the fraud happened. "Call the fraud department. Explain that someone stole your identity. Ask them to close or freeze the accounts. Then, no one can add new charges unless you agree." The FTC adds two instructions that recur through its whole process: "Change logins, passwords and PINS for your accounts", and expect to "contact these companies again after you have an FTC Identity Theft Report" — the first call stops the bleeding; the report, in Section 03, is what you send to make it stick.

RULE — Then report it to the FTC and let the plan organise everything else. "If you think someone stole your identity, report it to the Federal Trade Commission. You'll get a free personal recovery plan with next steps." At IdentityTheft.gov the site "will create your Identity Theft Report and recovery plan" based on the information you enter; if you create an account, it will "walk you through each recovery step, update your plan as needed, track your progress, and pre-fill forms and letters for you" — including "pre-filled letters and forms to send to credit bureaus, businesses, and debt collectors". Without an account, "you must print and save your Identity Theft Report and recovery plan right away. Once you leave the page, you won't be able to access or update them." Reporting is also possible by phone: the FTC's steps give "Complete the online form or call 1-877-438-4338", and its consumer guidance adds that callers who prefer another language can press 3 for interpreters. One expectation to set honestly, in the FTC's own words: "The FTC does not resolve individual consumer reports." The agency builds your plan and your report; the fixing is done by you, sending that report to bureaus and businesses — which is why the report matters so much.

SECTION 02Freeze or Fraud Alert: The Distinction That Matters

RULE — A credit freeze locks the door; a fraud alert asks businesses to check ID at it. The FTC's freeze page: "When a credit freeze is in place, nobody can open a new credit account in your name. There's no cost to place or lift a credit freeze, and it doesn't affect your credit score." More precisely, "while a credit freeze is in place, nobody can open a new credit account in your name, including you" — you lift it temporarily when you yourself need a credit check (a job application, an apartment, a new account), and "a credit freeze lasts until you lift it". A fraud alert works differently: an initial alert "tells businesses to check with you before opening a new credit account in your name. Usually, that means contacting you first to make sure the person trying to open a new account is really you. Unlike a credit freeze, a fraud alert doesn't prevent businesses from seeing your credit report." The alert warns; only the freeze bars.

RULE — The mechanics differ in the one way people get wrong: freeze = all three bureaus, alert = one. To freeze, "contact all three of the credit bureaus — Equifax, Experian, and TransUnion" — a freeze placed with one bureau does nothing to the other two files. Anyone may do it: "Anyone can freeze their credit report, for any reason, even if their identity hasn't been stolen." To place an initial fraud alert, contact one bureau — "the credit bureau you contact must tell the other two" — and the alert "lasts one year, but you can renew it". An initial alert also entitles you to "a free copy of your credit report from each of the three credit bureaus".

RULE — After a confirmed theft there is a stronger alert, and it runs on the Identity Theft Report. An extended fraud alert does what an initial alert does, and additionally "requires the credit bureaus to take you off their marketing lists for unsolicited credit and insurance offers for five years". It is for "people who have experienced identity theft and have completed an FTC identity theft report at IdentityTheft.gov or filed a police report", and it "lasts seven years", placed through one bureau like the initial alert. The FTC's own comparison chart puts the two heavy tools side by side: the extended alert means "a company must contact you before granting new credit in your name" and lasts 7 years; the freeze "limits access to your credit report unless you lift or remove it" and lasts until you do. The two are not alternatives in the FTC's scheme — "even if you already have a credit freeze in place, you can also place a fraud alert" — but if you place only one after a theft, the freeze is the one that blocks.

RULE — Read your reports at the one authorised site, and read all three. "Only one website — AnnualCreditReport.com — is authorized to fill orders for the free annual credit reports you are entitled to by law", and the bureaus "have permanently extended a program that lets you check your credit report from each once a week for free at AnnualCreditReport.com" — the FTC's steps add that weekly checking "can help you spot any new fraud quickly". The FTC warns about the lookalikes at exactly this strength: other sites "pretend to be associated with AnnualCreditReport.com or claim to offer free credit reports, free credit scores, or free credit monitoring. They also use terms like 'free report' in their names. They might even have URLs that purposely misspell AnnualCreditReport.com in the hope that you'll mistype the name of the official site" — and "AnnualCreditReport.com and the credit bureaus will not email you asking for your Social Security number or account information". Review each bureau's report, because "each credit bureau may get its information from different sources", and make note of every account or transaction you don't recognise: the FTC's steps make that list the raw material for your report and for the blocking requests in Section 04.

SECTION 03The Identity Theft Report: What It Is and What It Does

RULE — The report is the system's key document, and the FTC states its function in one sentence. "Your identity theft report proves to businesses that someone stole your identity. It also guarantees you certain rights." It is generated by the same IdentityTheft.gov session that builds your recovery plan, which is why the FTC's process puts the report before the repair steps: with it in hand, "now that you have an FTC Identity Theft Report", you work through the businesses, the bureaus and the collectors in Sections 04. If you didn't create an account, the warning from Section 01 applies with full force — print and save it before you leave the page, because you cannot retrieve it afterwards.

RULE — Its headline legal effect is blocking: fraudulent information comes off your report, and the debts attached to it cannot be collected from you. The FTC's steps, in its own words: "If someone steals your identity, you have the right to remove fraudulent information from your credit report. This is called blocking. Once the information is blocked, it won't show up on your credit report, and companies can't try to collect the debt from you. If you have an FTC Identity Theft Report, credit bureaus must honor your request to block this information." Blocking is a different act from disputing: "If you don't have an FTC Identity Theft Report, you still can dispute incorrect information in your credit file. It can take longer, and there's no guarantee that the credit bureaus will remove the information." The report converts a request a bureau weighs into an instruction it must honour — that, plus the extended fraud alert it unlocks (Section 02), is the substance of the "certain rights" the FTC refers to. This article states the effect at the FTC's published strength; the FTC's consumer pages do not publish a processing deadline for a block, and none is printed here.

RULE — A police report is part of the FTC's own sequence, taken after the FTC report. The FTC's steps include it as a standard step: "Go to your local police office with: a copy of your FTC Identity Theft Report; a government-issued ID with a photo; proof of your address (mortgage statement, rental agreement, or utilities bill); any other proof you have of the theft (bills, IRS notices, etc.). Tell the police someone stole your identity and you need to file a report. Ask for a copy of the police report. You may need this to complete other steps." Two sourced points frame its weight. First, it is an alternative foundation, not a rival one: the extended fraud alert accepts an FTC report or a police report. Secondly, businesses in the repair steps "may require you to send them a copy of your FTC Identity Theft Report or complete a special dispute form" — the FTC report is the document the system runs on, and the police report supports it where a company or an agency asks for one.

SECTION 04Debts and Accounts Opened in Your Name

RULE — Accounts the thief opened are closed by the business, and you leave with a letter, not a promise. The FTC's steps: "call the fraud department of each business where an account was opened. Explain that someone stole your identity. Ask the business to close the account. Ask the business to send you a letter confirming that: the fraudulent account isn't yours; you aren't liable for it; it was removed from your credit report. Keep this letter. Use it if the account appears on your credit report later on." Fraudulent charges on an account that is genuinely yours follow the same shape: call the fraud department, "tell them which charges are fraudulent", ask the business to remove them, and ask for the confirming letter. Throughout: "Write down who you contacted and when."

RULE — Blocking is requested from each bureau, in writing, with the report attached. "Write to each of the three credit bureaus. Include a copy of your FTC Identity Theft Report and proof of your identity, like your name, address, and Social Security number. Explain which information on your report came from identity theft. Ask them to block that information." The FTC's steps page prints the bureaus' fraud-assistance addresses for exactly this letter (attributed here to that page): TransUnion Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19016, 1-800-680-7289; Equifax, P.O. Box 105069, Atlanta, GA 30348-5069, 1-800-525-6285; Experian, P.O. Box 9554, Allen, TX 75013, 1-888-397-3742. Once blocked, the information "won't show up on your credit report, and companies can't try to collect the debt from you" (Section 03).

RULE — A debt collector chasing the thief's debt gets a written answer, inside 30 days, with the report enclosed. The FTC's steps: "Write to the debt collector within 30 days of getting the collection letter. Tell the debt collector someone stole your identity, and you don't owe the debt. Send copies of your Identity Theft Report and any other documents that detail the theft." Then go to the source of the debt: "Contact the business where the fraudulent account was opened. Explain that this is not your debt. Tell them to stop reporting this debt to the credit bureaus. Ask for information about the debt, and how it happened. The business must give you details if you ask" — for a card opened in your name, the FTC's example is to "ask for a copy of the application and the applicant's signature". And if the debt is still on your reports, "ask the credit bureaus to block information about this debt from your credit report" — the same blocking request as above. Keep copies of every letter you send; the FTC repeats that instruction after nearly every step, and Section 07 explains why it is structural, not fussy.

SECTION 05Tax-Related Identity Theft: The IRS Route

RULE — The tax version has its own signs, and the IRS publishes the list. From the IRS's guide for individuals: a tax return rejected; a "Form W-2 or Form 1099 from employer you didn't work for"; "Form 1099-G unemployment benefits you didn't get or apply for"; an employer identification number you didn't apply for; an "unreported income alert, like a CP2000 series notice"; a Social Security account that "shows wages you didn't earn or expect"; accounts or password-reset alerts you didn't trigger. The IRS's summary of the list is the right calibration: "These don't always mean you've been affected by identity theft, but still be cautious." The Social Security Administration's publication describes the classic refund pattern from the victim's side: a thief "could file a tax return before you do and get your refund. Then, when you do file, the IRS will think you already received your refund" — and a thief working under your number leaves wages on your record that make "it appear that you didn't report all of your income on your tax return".

RULE — If the IRS writes to you, the letter runs the process. "We send a letter or notice when we suspect identity theft on a return. Sometimes, getting our mail is your first sign you could be affected by identity theft." The IRS's steps for letter-holders: verify the letter is genuinely from the IRS (its guide gives a notice-lookup and the 800-829-1040 line for verification), then "follow our instructions" — which may mean using its Identity and Tax Return Verification Service. The FTC's steps agree and add one move: if the notice says you were paid by an employer you don't know, "send a letter to the employer too, explaining that someone stole your identity and that you don't work for the employer". The IRS also offers victims a copy of what was filed in their name: "To get a copy of a fraudulent return, send us Form 4506-F, Identity Theft Victim's Request for Copy of Fraudulent Tax Return."

RULE — Form 14039 is the IRS's identity theft affidavit, and filing your real return still happens. The IRS's guide directs victims to "check if you should file Form 14039, Identity Theft Affidavit" — including after a data breach: "Data breach leaked your information. Consider filing Form 14039, Identity Theft Affidavit." The FTC's steps state the filing route: complete the form and "mail or fax the form according to the instructions". A fraudulent filing does not suspend your own obligations: the IRS's steps for victims include "file returns and pay tax as usual", and the FTC's version is the same — "File your tax return, and pay any taxes you owe. You might have to mail paper tax returns." If the matter still isn't resolved, both agencies converge on the IRS's specialised line: "contact the IRS for specialized assistance at 1-800-908-4490" (the IRS gives the same number "to verify your identity and tax return status"). Our guide to taxes for international students covers the ordinary filing duties this sits on top of.

RULE — Afterwards, lock the tax identity with an IP PIN — and the programme covers an ITIN exactly as it covers an SSN. "An identity protection PIN (IP PIN) is a six-digit number that prevents someone else from filing a tax return using your Social Security number (SSN) or individual taxpayer identification number (ITIN). The IP PIN is known only to you and the IRS. It helps us verify your identity when you file your electronic or paper tax return." Eligibility is stated without a citizenship condition: "Anyone who has an SSN or individual taxpayer identification number (ITIN) and is able to verify his/her identity is eligible to enroll into the IP PIN program" — newcomers sometimes hold an ITIN rather than an SSN (see our guide to the ITIN), and for IRS identity protection the two numbers are treated alike: the IRS's prevention guidance describes the PIN as what "keeps someone else from filing a return with your taxpayer identification number (TIN)". The mechanics that matter: an IP PIN "is valid for one calendar year" and "a new IP PIN is generated each year"; confirmed victims are enrolled by the IRS itself — "if the IRS enrolled you into the IP PIN program due to being a confirmed victim of tax-related identity theft, we'll mail you a CP01A Notice with your new IP PIN each year"; once you have one, "correct IP PINs must be entered on electronic and paper tax returns to avoid rejections and delays". And the IRS's warning, which newcomers should treat as absolute: "The IRS will never ask for your IP PIN. Phone calls, emails or texts asking for your IP PIN are scams."

SECTION 06SSN Misuse: The SSA's Lane, and Its Limits

RULE — The SSA's own job is your earnings record, and that is the review it offers. From the Social Security Administration's publication Identity Theft and Your Social Security Number: "Sometimes more than one person uses the same SSN, either on purpose or by accident. If you suspect someone is using your number for work purposes, you should report the problem to us. We'll review your earnings with you to ensure our records are correct." You can inspect the record yourself first: the Statement is available through a my Social Security account, and the IRS counts a Social Security account showing "wages you didn't earn or expect" among its warning signs. The FTC's steps add two refinements: if you find errors, "contact your local SSA office"; and to stop the number being used for a job in future, "consider setting up an E-Verify account so you can lock your Social Security number" — E-Verify "is run by the U.S. Department of Homeland Security and the Social Security Administration", and "when someone tries to use a locked Social Security number to get a job, employers that use E-Verify must get more information from the person trying to use your Social Security number". How the number is issued and what it is for is covered in our guide to getting a Social Security number.

RULE — Credit damage is not repaired at the SSA's counter, because the publication routes it elsewhere. Asked "what if a scammer is creating credit problems for you?", the SSA's publication answers: "If someone has misused your Social Security number or other personal information to create credit or other problems for you, there are several things you can do" — and the things listed are other agencies' processes: visit IdentityTheft.gov for the FTC recovery plan; contact the IRS if the misuse is tax-side; file a complaint with the Internet Crime Complaint Center (IC3); and "monitor your credit report periodically" at AnnualCreditReport.com. That is the whole of the SSA's lane as it publishes it: it guards the number and the earnings record ("We protect your SSN and keep your records confidential. We don't give your number to anyone, except when authorized by law"), and it points credit repair back to the FTC process in Sections 01–04. Anyone who tells you the SSA will clean your credit file is describing a service the agency does not offer.

RULE — A new Social Security number is a last resort with conditions, and it is not a clean slate. The publication's test: "If you've done all you can to fix the problems resulting from misuse of your SSN, and someone is still using your number, we may assign you a new number." The exclusions are printed just as plainly — you can't get a new SSN "if your SSN card is lost or stolen, but there's no evidence that someone is using your number"; "to avoid the consequences of filing for bankruptcy"; or "if you intend to avoid the law or any legal responsibility". Applying means proving "your identity, age, and U.S. citizenship or immigration status" and providing "evidence that you're having ongoing problems because of the misuse". And the warning the FTC repeats almost word for word: "other governmental agencies (such as the IRS and state motor vehicle agencies) and private businesses (such as banks and credit reporting companies) have records under your old number… using a new number won't guarantee you a fresh start. This is especially true if your other personal information, such as your name and address, remains the same." For some victims it backfires: "if the old credit information isn't associated with your new number, the absence of any credit history under the new number may make it more difficult for you to get credit." Note the distinction newcomers most often blur: a lost or stolen Social Security card is replaced — the FTC's steps note you can "apply online for free to get a replacement card" — while the number stays the same, and a different number is the rare, conditioned step above.

SECTION 07Documents and the Long Tail: Records, Replacements, Follow-Through

RULE — Keep the file the process tells you to keep. The instruction appears after almost every FTC step — "Write down who you contacted and when. Keep copies of any letters you send" — and the IRS's victim steps include the same discipline: "Keep records of letters, phone calls and emails." This is mechanics, not tidiness: the confirmation letters from Section 04 are your evidence "if the account appears on your credit report later on", a blocked item that resurfaces is answered with the letter that discharged it, and every agency in this guide works from documents. Keep the Identity Theft Report itself, the police report if you filed one, and the confirmation letters together, permanently.

RULE — Monitoring after the repair is part of the repair. The weekly free reports at AnnualCreditReport.com (Section 02) are the FTC's suggested watch: checking them "can help you spot any new fraud quickly". Set against that, the FTC's account of paid credit monitoring is deliberately flat: such services "usually charge a monthly or annual fee", and they "won't alert you when someone uses your Social Security number to file a tax return and collect your refund" — the tax misuse is caught by the IRS route in Section 05 and the IP PIN, not by a monitoring subscription. On recovery services generally, the FTC's sentence deserves quoting whole: "You might be able to do some of the services they offer on your own for little or no cost." The official process in this article is that "on your own" route, and it is free at every step.

ADVICE (mechanism, labelled) — Stolen documents are replaced through separate issuers, and a US visa is not reissued inside the USA. No single agency replaces a stolen wallet's contents. A Social Security card is replaced free through the SSA (Section 06) — the number does not change. Your passport is your own country's document: replacing it runs through your home country's consulate, not any US agency, and our guide to a lost passport in the USA works through what replaces what. The point that surprises people: the US visa inside a stolen passport is not reprinted or transferred in the United States — returning to a usable visa means a fresh application at a consulate abroad, whose mechanics our guide to renewing a visa stamp abroad covers. Report the theft itself through the FTC process above regardless of which documents were taken; the report is the evidence every issuer's replacement process can be pointed to.

PARTIALLY VERIFIED — Nothing in the official recovery texts addresses immigration status, in either direction. This article was built from the FTC's, the IRS's and the SSA's published processes, and none of them makes immigration status a condition of the tools or states any effect of identity theft — or of reporting it — on a visa, on status, or on a future application. What the texts do say about eligibility is cast in general terms: the freeze is open to "anyone", the initial fraud alert to "anyone who is or suspects they may be affected by identity theft", and the IP PIN to "anyone who has an SSN or individual taxpayer identification number (ITIN) and is able to verify his/her identity". We state the position no more strongly than that: on the published texts, the recovery system is built for consumers and taxpayers generally, and the immigration question is one the sources simply do not take up. A reader whose case involves both identity theft and a live immigration problem should take the immigration half to a qualified immigration attorney; the recovery half is the process above.

FAQFrequently Asked Questions

Official references and verification status

Verified on 31 October 2026 against: IdentityTheft.gov's recovery steps page (read in full) — the step order, the report's stated function ("proves to businesses that someone stole your identity… guarantees you certain rights"), the blocking right and its wording, the debt-collector and business letters, the police step and its document list, the tax steps, the E-Verify Self Lock, and the bureaus' fraud-assistance addresses printed there; the FTC's consumer articles on identity theft, on credit freezes and fraud alerts, and on free credit reports (each read in full) — the freeze/alert distinction and mechanics, the authorised-site rule and the weekly free reports, the impostor-site warning, and the FTC's account of paid monitoring and recovery services; the FTC's Privacy Act statement at IdentityTheft.gov ("The FTC does not resolve individual consumer reports"); the IRS's identity theft guide for individuals and its IP PIN page (each read in full) — the warning-signs list, the letter procedure and Form 4506-F, Form 14039's place in the process, and the IP PIN's definition, eligibility (SSN or ITIN), annual cycle and CP01A mailing for confirmed victims; and the Social Security Administration's publication Identity Theft and Your Social Security Number (No. 05-10064, March 2026 edition, read in full at ssa.gov) — the earnings-record review, the routing of credit problems to the FTC/IRS processes, and the new-number conditions and warnings. Three limits are flagged where they arise. First, no source read for this article addresses any effect of identity theft, or of reporting it, on immigration status, or makes status a condition of the recovery tools — Section 07 and FAQ 4 state that absence and are marked PARTIALLY VERIFIED. Secondly, the FTC's consumer pages state the blocking right and that bureaus "must honor" a block request supported by an Identity Theft Report, but publish no processing deadline for a block; the four-business-day figure found in secondary coverage and in the statute text was not found on the FTC pages read here and is not printed. Thirdly, the SSA's current publication phrases its credit-problems answer as a list of steps run by other agencies rather than an express statement that it cannot repair credit; Section 06 states the SSA's lane at exactly that strength. Separately: IdentityTheft.gov's FAQ path rendered only its Privacy Act statement in this pass, and the IRS's Form 14039 landing page rendered navigation only — the form's role in the draft rests on the IRS guide and the FTC steps, which name it and its filing route.

• IdentityTheft.gov — Recovery Steps (Federal Trade Commission)
• Consumer Advice (FTC) — What To Know About Identity Theft
• Consumer Advice (FTC) — Credit Freezes and Fraud Alerts
• Consumer Advice (FTC) — Free Credit Reports
• IRS — Identity Theft Guide for Individuals
• IRS — Get an Identity Protection PIN (IP PIN)
• SSA — Identity Theft and Your Social Security Number (Publication No. 05-10064)

General educational information, not legal advice. The FTC's recovery tools at IdentityTheft.gov are free; be cautious of any service charging to do what the official process does.

General information only. This guide is based on official sources publicly available and checked on the date shown on this page. Visa rules change, and consular and USCIS officers decide every case on its own facts — nothing here is a confirmation or a guarantee for your individual case, and this is not legal advice. Always confirm the current requirement on the official page linked in this guide before you act, and consider a qualified immigration attorney for your specific situation.