What to do if your identity is stolen

Call the fraud department of any affected bank or card issuer directly — the number on the back of the card or your statement, never a number from an email or text. Have accounts frozen or closed and new numbers issued.

Speed matters most for debit cards. Federal law caps your liability at $50 if you report an unauthorized transfer within two business days of learning of it, $500 if within 60 days of the statement, and potentially the entire amount after that. Credit cards are capped at $50 by law and at zero by most card network policies — which is why contested spending belongs on credit, not debit.

Change passwords on your email first. Email is the master key: it resets everything else, so an attacker with your inbox has your accounts. Turn on two-factor authentication, preferably with an app rather than SMS.

If your phone stopped working suddenly, suspect a SIM swap — an attacker porting your number to intercept verification codes. Call your carrier immediately and add a port-out PIN.

Do not delete anything. Fraudulent emails, texts and transaction records are evidence.

Go to IdentityTheft.gov. It asks what happened and generates a personalized recovery plan plus an FTC Identity Theft Report — the official document creditors and bureaus are required to accept, and which unlocks the stronger remedies including blocking fraudulent information from your credit file.

Freeze your credit at all three bureaus. It is free by federal law, takes minutes online, does not affect your credit score, and blocks new accounts being opened in your name — the single most effective step against new-account fraud. Freezing one bureau is not enough; lenders pull from different ones.

Consider an extended fraud alert as well, which lasts seven years with an identity theft report and requires lenders to verify identity directly.

Get your free credit reports from all three bureaus at AnnualCreditReport.com — weekly access is free — and read them for accounts, inquiries and addresses you do not recognize.

File a police report with your local department. Many creditors ask for one, and it costs nothing beyond time. Bring your FTC report; some departments will simply attach it.

If your Social Security number was misused for employment or tax fraud, contact the IRS Identity Protection unit and consider requesting an Identity Protection PIN, which blocks fraudulent returns being filed in your name.

Dispute fraudulent accounts in writing with both the creditor and the credit bureaus, enclosing your FTC Identity Theft Report. Written disputes create a paper trail and legal obligations that phone calls do not.

Under the Fair Credit Reporting Act, bureaus must investigate disputes — generally within 30 days — and must block information you identify as resulting from identity theft when you provide an identity theft report. Creditors must stop reporting it and cannot sell the debt to a collector once notified.

If a debt collector contacts you about a fraudulent account, send a written dispute within 30 days of their first contact. They must then stop collection until they verify the debt in writing.

Keep a log: every call, every name, every date, every reference number, and copies of every letter sent — by certified mail for anything important. Recovery frequently takes months, and the log is what makes month four survivable.

Check your Social Security earnings record at ssa.gov for wages you did not earn, which indicates employment fraud and can affect your future benefits.

Watch for medical identity theft too: request records and billing statements from your health providers, and check the Explanation of Benefits statements from your insurer for care you did not receive.

Leave the freeze on permanently. Lift it temporarily when you apply for credit and refreeze after — it costs nothing and takes minutes.

Free weekly credit reports from all three bureaus make paid credit monitoring largely unnecessary. Paid services mostly repackage what you can get free, and none of them prevent fraud — they notify you after it happens, which a freeze prevents in the first place.

Freeze your children's credit too. Child identity theft typically goes undetected for years, surfacing when the child first applies for credit at 18, and freezes for minors are free.

Set up account alerts for transactions above a threshold and for new logins, and use a password manager so a breach at one service does not cascade.

Reduce your exposure: do not carry your Social Security card, shred documents with account numbers, be sceptical of any unexpected contact asking you to verify information, and remember that no government agency will ever call demanding immediate payment or threatening arrest.

If the fraud involved a data breach, the company must usually notify you under state breach notification laws, and may offer free monitoring — take it, but freeze regardless.