RitezyNew York legal help
Ask for free

Credit, banks & credit reports · What to do now

Identity theft: what to do now, step by step

Updated By The editorial teamNot reviewed by an attorney — based on the official sources below

In short

Act quickly. Call the fraud departments of your banks and card companies, close or lock affected accounts, and follow up in writing. Place a free fraud alert with one of the three nationwide credit bureaus — it must tell the other two — or freeze your credit with each bureau, which is also free. Report the theft to the FTC at IdentityTheft.gov or 1-877-438-4338, and file a police report. With an official identity theft report, the credit bureaus must block fraudulent information from your report within 4 business days. Federal law also limits what you can lose on unauthorized credit and debit card charges if you report in time.

Read on for the details, the exceptions and the sources.

In plain words

Fraud alert
A flag on your credit file telling lenders to take extra steps to confirm it is really you before opening credit.
Security freeze
A lock on your credit file so new lenders can't see it, which stops most new accounts being opened. You can lift it when you need credit.
Identity theft report
An official report of the theft filed with a federal, state or local law enforcement agency, such as your local police.
Block
A credit bureau's removal of information that resulted from identity theft, so it no longer appears on your report.

Step by step

  1. Call your banks and card issuers

    Report the fraud, ask them to close or lock affected accounts and cards, and change passwords and PINs. Follow up in writing. The Attorney General recommends calling each creditor and then sending a letter.

  2. Place a fraud alert

    Ask one nationwide credit bureau (Equifax, Experian or TransUnion) for an initial fraud alert. It lasts at least one year, and the bureau must pass it to the other two (15 U.S.C. § 1681c-1(a)(1)).

  3. Consider a security freeze

    Freezes are free. A bureau must place one within 1 business day of an online or phone request, or 3 business days by mail, and lift it within 1 hour of an online or phone request (§ 1681c-1(i)). Contact each of the three bureaus.

  4. Report to the FTC and the police

    Report at IdentityTheft.gov or 1-877-438-4338, which also gives you a recovery plan. File a report with your local police: an official report with a law enforcement agency is what the law calls an identity theft report (§ 1681a(q)(4)).

  5. Get your credit reports and dispute what's not yours

    Placing a fraud alert entitles you to a free copy of your report from each bureau. Mark every account and inquiry you don't recognize.

  6. Ask the bureaus to block fraudulent information

    Send each bureau proof of identity, a copy of your identity theft report, the items that resulted from the theft, and a statement that they aren't yours. The bureau must block them within 4 business days (§ 1681c-2(a)).

  7. Consider an extended fraud alert

    With an identity theft report, you can get a 7-year extended alert, removal from prescreened credit offers for 5 years, and 2 free reports from each bureau within 12 months (§ 1681c-1(b)).

What to check

  • Bank and card statements for charges or transfers you didn't make.
  • Your credit reports from all three bureaus for accounts, addresses or inquiries you don't recognize.
  • Bills or collection calls for accounts you never opened, loan denials, or missing mail — USAGov lists these as warning signs.
  • Whether your tax return was affected: USAGov points to IRS Form 14039 if you suspect tax-related identity theft and haven't heard from the IRS.
  • Medical bills or insurance statements for care you didn't receive — the Department of State warns about medical identity theft.

What you may be owed

  • For unauthorized credit card charges, you may owe at most $50, and nothing for charges after you notify the card issuer (15 U.S.C. § 1643).
  • For unauthorized debit card or bank transfers, your loss may be limited to $50 if you report within 2 business days of learning your card or PIN was lost or stolen, or up to $500 after that (12 C.F.R. § 1005.6(b)).
  • If you report an unauthorized bank transfer within 60 days of the statement, the bank may have to credit your account provisionally within 10 business days while it investigates (§ 1005.11(c)).
  • You may be entitled to free credit reports: one from each bureau after an initial fraud alert, and two in 12 months after an extended alert (§ 1681c-1(a)(2), (b)(2)).
  • Fraudulent accounts and debts may be blocked from your credit report within 4 business days once a bureau receives your identity theft report and the other required items (§ 1681c-2(a)).
  • If a credit bureau or a company that reported the information willfully ignores the law, you might be able to sue for actual damages or $100 to $1,000, plus punitive damages and attorney's fees (§ 1681n).

Documents to gather

  • A government photo ID and proof of address (for the bureaus and banks).
  • Your FTC identity theft report and the police report number.
  • Statements showing the fraudulent charges, transfers or accounts.
  • Letters, bills and collection notices for accounts you didn't open.
  • A log of every call: date, company, person, reference number, and what was agreed.
  • Copies of every letter you send and proof of mailing.

When to get help

Get help if a bank or credit bureau refuses to remove fraudulent charges or accounts, if a debt collector or a lawsuit pursues you for a debt that isn't yours, if someone has used your name with police or in court, or if the theft involves your taxes or medical records. The New York Department of State's Identity Theft Prevention and Mitigation Program and the Attorney General's helpline (1-800-771-7755) can guide you, the CFPB takes complaints about banks, card issuers and credit bureaus, and a legal aid organization or consumer lawyer can help with lawsuits and serious cases.

Figures that change

  • Initial fraud alert: At least 1 year (as of 2026-10-30; Fair Credit Reporting Act — fraud alerts and security freezes, 15 U.S.C. § 1681c-1)
  • Extended fraud alert (with identity theft report): 7 years (as of 2026-10-30; Fair Credit Reporting Act — fraud alerts and security freezes, 15 U.S.C. § 1681c-1)

Frequently asked questions

Should I choose a fraud alert or a credit freeze?

You can have both. A fraud alert asks lenders to verify your identity and lasts at least a year (§ 1681c-1(a)). A freeze blocks access to your file for new credit until you lift it, is free, and can be lifted within an hour online or by phone (§ 1681c-1(i)).

Do I need a police report?

For an extended fraud alert and for blocking fraudulent items, you need an identity theft report — an official report filed with a federal, state or local law enforcement agency (15 U.S.C. § 1681a(q)(4); §§ 1681c-1(b), 1681c-2(a)).

Will I have to pay the charges the thief made?

Usually not much. Federal law caps your liability for unauthorized credit card use at $50 (§ 1643), and debit card losses at $50 or $500 depending on how fast you report, with a 60-day statement deadline (12 C.F.R. § 1005.6).

A collector is calling about a debt I never had. What do I do?

Tell the collector in writing that the debt resulted from identity theft and ask for proof, dispute the account with the credit bureaus, and ask them to block it with your identity theft report (§ 1681c-2). See also our page on debt collector letters.

Want your own situation checked?

This page is general. Describe what happened, attach the letter or document you received, and get a free first answer — then, if you want, a full check against New York and federal law and a letter ready to send.

Check my situation — free

Official sources

This page was written from the sources below. “Checked” is the date the source was last opened and read.

Related questions

Related guides

This page is general information based on the official sources listed, current as of the update date. It is not legal advice and does not replace a review of your own situation; if a case is already in court, a deadline is close, the amount is large, or there are criminal, immigration or family-law consequences, talk to a lawyer or legal aid.