Someone Stole My Identity — What to Do Right Now

Maybe you typed your details into a page that turned out to be fake. Maybe a company you'd half forgotten about got breached. Maybe your wallet or your post was stolen, or a convincing "government" call talked you through "verifying" your ID. However it happened, someone now has enough of your personal information to pretend to be you — and the next few hours are the ones that limit the damage.

This isn't your fault, and panicking won't help. Work through the list in order. The single most important thing — freezing your credit — takes about fifteen minutes and stops the most common and most expensive kind of identity fraud: someone opening credit in your name.

First, know what "identity theft" covers

It's a spectrum. Someone might have just your card number (annoying, usually fixable in a call). Or they might have your Social Security or national ID number, your date of birth, and your address together — a "full profile" that can be used to open bank accounts, take out loans, file a tax return in your name, claim benefits, or pass the security questions on your existing accounts. The steps below are ordered for the serious case; if only a card was exposed, jump to step 4 and step 7.

Step 1 — Freeze your credit at every credit bureau

A credit freeze (also called a security freeze) blocks anyone — including you — from opening new credit in your name until you lift it. It's free, it doesn't affect your credit score, and you can unfreeze it yourself in minutes when you actually need to borrow.

The catch: you have to do it separately with each bureau. In the US that's Equifax, Experian, and TransUnion; freezing one does nothing to the other two. In the UK, the equivalent agencies are Experian, Equifax, and TransUnion UK, and you should also apply for Cifas Protective Registration, which flags your name so lenders apply extra checks. In Spain and much of the EU there's no consumer freeze system, so the equivalent protection comes from steps 2, 4 and 5 — the police report and the bank fraud markers.

If you can't face three separate freezes right now, place a fraud alert instead — one call to one bureau, and they notify the others. It's weaker than a freeze but far better than nothing, and you can upgrade to a freeze later.

Step 2 — File an official identity-theft report

You need an official report for two reasons: to prove to banks and lenders that the fraud wasn't you, and to unlock stronger protections (like an extended, years-long fraud alert).

• United States: go to IdentityTheft.gov, the FTC's official service. Answer its questions and it produces a personalised recovery plan and an Identity Theft Report / affidavit you can send to companies. Consider also filing a report with your local police, especially if you know who did it or a specific crime occurred.
• United Kingdom: report to Action Fraud (online or by phone) and keep the crime reference number.
• Spain: file a denuncia with the Policía Nacional or Guardia Civil, report it to INCIBE (free helpline 017), and — if a company's breach caused it — to the AEPD, the data-protection authority.

Keep every reference number somewhere safe. You'll quote them repeatedly over the coming weeks.

Step 3 — Lock down your email and money accounts

Someone with your personal details can often pass the "security questions" to reset your existing accounts. Before anything else, protect the two that matter most:

• Change the password on your main email and your online banking to unique passwords you use nowhere else.
• Turn on two-step verification (authenticator app rather than SMS where possible) on both.
• Check that the recovery email and phone number on each account are still yours — attackers change these first.

Step 4 — Alert your bank and card issuers

Call the fraud number printed on your statement or in your bank's official app — never a number someone gave you. Ask them to put a fraud marker on your profile, require stronger verification for any account change, and, if your account or card number was exposed, issue new ones. Do this even if you didn't hand over bank details directly: a full identity profile is enough for someone to talk their way past a call centre.

Step 5 — Protect the specific document that was exposed

• Social Security / national ID number: in the US, request an Identity Protection PIN from the IRS so no one can file a tax return in your name, and report the misuse to the Social Security Administration. Elsewhere, contact the authority that issues the number and your tax agency.
• Passport: report it compromised to your country's passport office and ask about a replacement and a flag on the record.
• Driver's licence: tell your licensing authority or DMV and ask for a replacement with a new number if that's possible where you live.

Step 6 — If you've already seen misuse, dispute it in writing

Collection calls for a debt that isn't yours, a card statement for an account you never opened, a letter saying your tax return was already filed, being turned down for credit out of nowhere — these mean the fraud is already in motion. For each fraudulent account or charge:

• Contact that company in writing, state that it's identity-theft fraud, and attach your official report.
• Ask them to close the account and clear the debt.
• Ask the credit bureaus to block or remove those entries from your report — your Identity Theft Report entitles you to this in many countries.

Keep copies of everything you send and a log of every call: date, who you spoke to, what they said.

Step 7 — Watch everything for 12 months

Stolen-identity fraud often surfaces months after the data was taken, once it's been sold on. For at least a year:

• Check your credit report regularly — in the US you're entitled to free weekly reports from AnnualCreditReport.com; most countries have a right to at least one free copy.
• Read every line of your bank and card statements.
• Check your tax and benefits accounts for filings or claims you didn't make.
• Watch for MFA codes you didn't request, mail that stops arriving, or medical bills for care you never had.
• Leave the credit freeze in place until you actually need to lift it.

If the exposure happened because you entered details on a fake site, the containment steps in What to Do If You Clicked a Phishing Link are worth doing too. If a login password was also taken, see Someone Has My Password — What to Do Right Now.