Identity theft: how to freeze your credit and recover

Identity theft happens when someone uses your information, such as your Social Security number, your ITIN or your accounts, to open credit, buy things or collect money in your name. It can wreck your credit right when you want to rent or buy a home. The good news is that the law gives you free tools to stop the damage and clean up your report. This guide explains how to spot the theft, what to do first, how to freeze your credit and how to recover, according to the FTC, federal law and the IRS.

For a bureau to place your freeze if you ask by phone or online

1 business day⁴

How long an extended fraud alert lasts with an identity theft report

7 years⁴

For a bureau to block information that is not yours, with your report

4 business days⁵

The signs of identity theft

The FTC lists these signs:¹

• You stop getting a bill. Someone may have changed your address.
• Charges for things you did not buy.
• Bank withdrawals you did not make.
• Accounts in your name you do not recognize on your credit reportcredit reportA credit report is a statement that has information about your credit activity and current credit situation: your loans and cards, the balances, whether you have paid on time, accounts in collection and who has checked your credit. Credit reporting companies, also called credit bureaus, compile it from what banks and creditors report; your credit score is computed from it. When you apply for a mortgage, the lender pulls your report from the three bureaus. You have the right to see it for free and to dispute anything that is wrong.See the full definitionClose.

If you also get calls about a debt you do not recognize, or are turned down for a loan or an apartment over something you do not understand, check your report. You can get it at AnnualCreditReport.com or 877-322-8228, and the three bureaus let you check it for free once a week.² Our guide AnnualCreditReport step by step explains how, and How to read your credit report helps you find what is not yours.

What to do first

Order matters. The FTC recommends three steps:²

First steps if your identity was stolen

1. 1. Call the companies where the fraud happened

   Today

   Ask for the fraud department, explain that your identity was stolen and ask them to close or freeze the accounts.²

2. 2. Change your passwords and PINs

   Today

   Change access to your bank, email and other accounts; turn on two-factor authentication.¹

3. 3. Place a fraud alert

   Today

   Call one of the three bureaus; it is free for a year and that bureau must notify the other two.²

4. 4. Freeze your credit at all three bureaus

   Today or tomorrow

   It is free and, by phone or online, it is placed within 1 business day.⁴

5. 5. Report the theft at IdentityTheft.gov

   This week

   You get your identity theft report and a free recovery plan.²

6. 6. Ask them to block what is not yours

   With your report

   The bureau must block that information no later than 4 business days after.⁵

The three credit bureaus and their contact information, according to the FTC:²

Bureau	Website	Phone
Equifax	Equifax.com/personal/credit-report-services	800-685-1111
Experian	Experian.com/help	888-397-3742
TransUnion	TransUnion.com/credit-help	888-909-8872

Before you call, set up a sheet for each company. Write down the date, the time, the name of the person who helped you and what you were told. Ask for a confirmation or case number for each call. If you are asked to send something in writing, do it promptly and keep a copy. That sheet will help you weeks later, when you have to show what you asked for and when. Also keep each freeze confirmation: some bureaus give you a number or ask you to create an account so you can lift it later.

Fraud alert or credit freeze

These are two different tools, and you can use both.

Fraud alert or credit freeze

They verify it is you

Fraud alert

• A business must verify your identity before opening a new account
• The initial alert lasts at least 1 year and is free
• You place it with one bureau, which notifies the other two
• With an identity theft report, you can get the 7-year extended alert

Nobody opens new accounts

Credit freeze

• Nobody can open new credit in your name, not even you
• It is free to place and lift, and it does not lower your score
• You request it from each of the three bureaus
• It stays until you ask to lift it

If your identity was already stolen, the FTC recommends the alert and a freeze.

The fraud alertfraud alertA fraud alert is a note in your credit file that requires creditors who check your report to verify your identity before opening a new account, issuing an additional card or raising your credit limit. You only need to ask one of the nationwide credit reporting companies, which must notify the others. An initial alert is for anyone who suspects they are, or are about to become, a victim of fraud or identity theft, and it lasts one year unless you ask to remove it sooner. An extended alert requires an identity theft report and lasts seven years. When you place one, you are entitled to free copies of your report.See the full definitionClose. If you suspect in good faith that you are or will be a fraud victim, the bureau must place an initial alert for at least 1 year and notify the other bureaus. If you submit an identity theft report, you can request a 7-year extended alert; the bureau also removes you for 5 years from lists of credit offers you did not ask for and gives you 2 free copies of your report in the next 12 months. If you are on active military duty, you can request an active duty alert for at least 12 months.⁴

The credit freezesecurity freezeA security freeze, also called a credit freeze, keeps new creditors from seeing your credit file, which helps stop an identity thief from opening new accounts in your name. By law it is free to place and to lift, and you must ask each of the three nationwide credit reporting companies separately. While it is on, only a few can see your file, such as creditors on accounts you already have, and you can still review your reports. It does not affect your score. Because creditors rarely lend without checking your file, it stops you too; you can lift it for free for a period of time when you need to.See the full definitionClose. With a freeze, nobody can open a new credit account in your name, not even you. It costs nothing and does not affect your score.³ By law, the bureau must place it free no later than 1 business day after you ask by phone or online, or 3 business days if you ask by mail. It stays until you ask to remove it. The freeze does not apply to companies you already have an account with when they review or collect on that account.⁴

If you are applying for credit: how to lift a freeze

If you are applying for a mortgage, a card or an apartment, the lender or landlord will want to see your report. Lift the freeze temporarily before they check it. By law, the bureau must lift it free no later than 1 hour after you ask by phone or online, or 3 business days by mail.⁴ Ask the lender which bureau it will use, and when the process is over, freeze it again.

Report the theft and recover your credit

Reporting the theft to the FTC gives you two things: your identity theft report and a free recovery plan with next steps. You can do it in English at IdentityTheft.gov, in Spanish at RobodeIdentidad.gov, or in another language by calling 877-438-4338 and pressing 3, with interpreters from 9:00 a.m. to 5:00 p.m. Eastern Time.²

That report unlocks strong rights. With it, the bureau must block from your report the information that resulted from the theft, no later than 4 business days after receiving:⁵

1. Proof of your identity.
2. A copy of your identity theft report.
3. A list of the information that is not yours.
4. Your statement that the information does not relate to any transaction of yours.

The bureau must also notify the company that reported that information.⁵ If you later see other errors, you can file a credit disputecredit report disputeA credit report dispute is the complaint you make when your credit report has wrong or incomplete information. You have the right to dispute it, and the investigation is free. It is usually done in two places: with the credit reporting company and with the company that supplied the information, called a furnisher, such as your bank, your landlord or your credit card company. You explain in writing what is wrong and why, with copies of your documents. The credit reporting company must investigate, generally within thirty days, and delete or correct anything found to be inaccurate, incomplete or unverifiable.See the full definitionClose: our guide How to dispute credit report errors explains how to do it in writing. And if a collection agency calls about a debt that is not yours, Debt collection: your rights explains how to respond.

Tax-related identity theft

One form of identity theft is someone filing a tax return with your number to collect a refund. The IRS IP PIN stops it. It is a six-digit number that only you and the IRS know, and anyone with an SSN or ITIN who can verify their identity can request it, including for dependents. The fastest way is your IRS online account; if you cannot open one, there are other options, including an in-person appointment at a Taxpayer Assistance Center. A new IP PIN is generated every year.⁶

Our guide Tax refund timing and scams explains other tax-season traps. If you have a problem with the IRS because of identity theft, look for a Low Income Taxpayer ClinicLow Income Taxpayer Clinic (LITC)A Low Income Taxpayer Clinic (LITC) is an organization that helps low-income people who have a dispute with the IRS, such as an audit, an appeal or a tax collection matter, for free or for a small fee. It can represent you before the IRS or in court. It also teaches taxpayer rights and responsibilities to people who speak English as a second language. To qualify, your income generally must be below a certain level. The clinics get part of their funding from the IRS but are independent of it.See the full definitionClose near you.

How to protect yourself starting today

The FTC recommends:¹

• Take your mail out of the mailbox as soon as possible if you get statements with personal information.
• Ask questions before giving out your Social Security numberSocial Security number (SSN)A Social Security number (SSN) is the nine-digit number on a Social Security card. It is issued by the Social Security Administration (SSA), a federal agency, and you need it to work and to collect government benefits. The IRS also uses it as your taxpayer identification number on tax returns. You apply with Form SS-5 and proof of identity, age and U.S. citizenship or lawful immigration status, and the service is free. People who must file taxes but cannot get an SSN use an ITIN. Identity thieves look for this number; the government advises keeping the card in a safe place and not carrying it in your wallet.See the full definitionClose. Organizations that ask for it will not call, email or text you to ask; if you are not satisfied with their answers, do not give it.
• Use strong passwords and two-factor authentication on your accounts.
• Do not give your information to someone who calls, emails or texts you out of the blue.

Also review your bank and card statements every month, not only when something seems off. A small charge you do not recognize can be a thief’s test before a big one. And keep important documents, such as your Social Security card, your ITIN letter and your tax returns, somewhere safe at home, not in your wallet.

Our guide What documents to share with lenders and landlords explains what they can really ask for, and Impostor calls and messages how to spot someone pretending to be your bank or the government.

Example with real numbers

A family about to buy a home finds an account that is not theirs

An example in words, not a real case, of how to use these tools.

They check their report before applying for a loan

A credit card they never opened shows up

That same day

They call the card company, place a fraud alert and freeze their credit

That week

They report the theft at IdentityTheft.gov and ask the bureau to block the account

Before the preapproval

They lift the freeze temporarily; online, the bureau lifts it within 1 hour

What they achieve

A clean report to apply for their loan, and the freeze back on afterward

The rules come from the FTC and the Fair Credit Reporting Act.²⁵⁴ Use the credit plan to see what else to check before you apply.

Run it with your numbersCredit plan

If this is you

You are applying for a mortgage

Check your report early and lift the freeze before the lender pulls it.⁴

You use an ITIN

Get an IRS IP PIN so nobody can file taxes with your number.⁶

You have children under 16

You can freeze their credit for free until you ask to lift it.³

You are on active duty

Request an active duty alert, which lasts at least 12 months.⁴

You prefer to do it in Spanish

Report the theft at RobodeIdentidad.gov; for other languages, call 877-438-4338 and press 3.²

Your wallet was stolen today

Call your bank, place a fraud alert and freeze your credit today.²

Mistakes that cost you

• Mistake: Paying a service to freeze your credit.

  Instead: Placing and lifting a freeze is free by law; ask each bureau directly.⁴

• Mistake: Freezing your credit at only one bureau.

  Instead: You have to ask all three: Equifax, Experian and TransUnion.³

• Mistake: Thinking a freeze lowers your score.

  Instead: It does not affect it; it only keeps new accounts from being opened.³

• Mistake: Forgetting to lift the freeze before applying for a loan.

  Instead: Lift it temporarily; by phone or online, within 1 hour.⁴

• Mistake: Not reporting the theft out of fear or embarrassment.

  Instead: With your IdentityTheft.gov report, the bureau must block what is not yours.⁵

• Mistake: Giving your Social Security number to someone who calls you.

  Instead: Organizations that ask for it will not call or email to ask.¹

What to do this week

1. Get your reports at AnnualCreditReport.com and look for accounts you do not recognize.²
2. Freeze your credit at Equifax, Experian and TransUnion, even if nothing has happened.³
3. If you found something that is not yours, call that company and place a fraud alert.²
4. Report the theft at IdentityTheft.gov and save your report and plan.²
5. Send your report to the bureaus so they block what is not yours.⁵
6. Request your IP PIN in your IRS online account.⁶