Identity Theft Response Checklist

First hour checklist

1. Write down what happened while it is fresh.
2. Save messages, dates, links, account names, phone numbers, screenshots, and transaction IDs.
3. Secure your email account from a trusted device.
4. Contact affected banks, cards, payment apps, lenders, benefits offices, or providers through known official channels.
5. Change exposed passwords anywhere they were reused.
6. Review account recovery settings, trusted devices, and forwarding rules.
7. Use IdentityTheft.gov for a personal recovery plan when identity theft is likely.

Decide what kind of exposure this is

A stolen password is different from a stolen Social Security number, a compromised email account, a lost wallet, a breached medical account, or a fraudulent loan. Start by identifying what information may be exposed and what someone could do with it. That determines whether you focus on passwords, payments, credit files, government benefits, medical records, or all of the above.

Signs identity theft may have happened

• Charges, withdrawals, or transfers you did not make.
• Bills, collection notices, loans, utilities, phone accounts, or buy-now-pay-later accounts you do not recognize.
• Unexpected medical, tax, unemployment, or benefit activity.
• Account recovery emails or login alerts that do not match your activity.
• Mail stops arriving, or you receive statements for unfamiliar accounts.

Credit freeze or fraud alert?

A credit freeze can help block new credit accounts from being opened in your name. A fraud alert tells businesses to take extra steps before opening credit. If your Social Security number or identity documents are exposed, a freeze is often the stronger defensive move. Use official bureau and FTC guidance rather than links from messages.

What to monitor next

• Bank, card, payment app, and loan statements.
• Credit reports and credit monitoring alerts.
• Email recovery settings, forwarding rules, and connected apps.
• Phone carrier account changes, SIM changes, and port-out notices.
• Tax, unemployment, medical, insurance, and benefit notices.
• New mail, collection letters, or calls about accounts you did not open.

Separate identity theft from account theft

Account theft means someone got into a specific account. Identity theft means personal information may be used to open accounts, request benefits, take loans, file tax forms, or impersonate you beyond one login. The response is different, so write down what happened before choosing the next step.

What to do this week

• Review bank, card, payment app, insurance, benefits, and email activity.
• Check credit reports or use IdentityTheft.gov if new accounts may be involved.
• Freeze credit if there is a real risk of new accounts being opened in your name.
• Save letters, emails, calls, case numbers, and screenshots in one folder.
• Keep watching for delayed notices, debt letters, or account recovery messages.

When to escalate

Escalate when money is missing, an account was opened in your name, government benefits or tax records are involved, a child’s identity may be affected, or you cannot regain access to an important account through normal support channels.