What to do if my identity is stolen

Identity theft strikes faster than most people realize, and the moment you suspect it, every hour counts. Whether it's an unauthorized credit card charge, a rejected loan application you never submitted, or a collection notice for an account you never opened, discovering your identity has been stolen demands immediate, methodical action. At Universal Investigations Agency, we've worked with countless victims who lost weeks because they didn't know where to start—time that let criminals drain accounts, open new lines of credit, and multiply the damage. This guide walks you through every step, from the first report you must file to the long-term protections that prevent recurrence, all grounded in cyber crime safety best practices we've seen work in real cases.

What Should I Do Immediately if My Identity Is Stolen?

Speed matters more than perfection. The Federal Trade Commission's IdentityTheft.gov serves as your starting point—file a report there first, even before you contact your bank. This creates an official identity theft report that you'll need for nearly every downstream action: disputing fraudulent charges, freezing accounts, and proving to creditors that you're a victim, not a deadbeat.

Visit IdentityTheft.gov and complete the questionnaire. The system generates a personalized recovery plan based on what type of theft occurred—credit card fraud, tax fraud, medical identity theft, or multiple categories at once. Print your FTC Identity Theft Report. Keep multiple copies. You'll submit this document repeatedly over the coming weeks, and companies often lose paperwork.

Next, place a fraud alert with one of the three major credit bureaus: Equifax, Experian, or TransUnion. You only need to contact one; that bureau must notify the other two. A fraud alert is free, lasts one year, and requires creditors to verify your identity before opening new accounts. For victims with a police report or FTC Identity Theft Report, an extended alert lasts seven years. According to the Consumer Financial Protection Bureau , fraud alerts reduce—but don't eliminate—the risk of new fraudulent accounts, so treat this as one layer, not a complete shield.

How Do I Report Identity Theft to the Right Agencies?

After filing with IdentityTheft.gov, contact your local police department. Not all jurisdictions will take an identity theft report, especially if the crime originated elsewhere, but try anyway. A police report strengthens your case with creditors and sometimes triggers faster account closures. Bring your FTC report, a government-issued ID, proof of address, and any documentation of fraudulent activity—credit card statements, collection letters, or account alerts.

If the theft involves your Social Security number, report it to the Social Security Administration's fraud hotline. If tax fraud is suspected—someone filed a return using your SSN—submit IRS Form 14039, the Identity Theft Affidavit. The IRS will flag your account and issue a unique PIN for future filings. Processing takes months, so file early if tax season approaches.

Report the theft to any company where fraud occurred. Call the fraud department of each credit card issuer, bank, or retailer. Close compromised accounts and open new ones with fresh account numbers and PINs. Request written confirmation that fraudulent charges have been removed and that the company won't report those debts to credit bureaus. Keep records of every phone call: date, time, representative name, and reference number.

Why Should I Place a Credit Freeze Instead of Just a Fraud Alert?

A fraud alert asks creditors to verify your identity. A credit freeze locks your credit file entirely, preventing anyone—including you—from opening new accounts until you lift the freeze with a PIN. Freezes are free, never expire unless you remove them, and offer stronger protection than alerts.

Place a freeze with all three bureaus: Equifax, Experian, and TransUnion. Each bureau has a separate online portal or phone number. You'll receive a unique PIN for each freeze. Store those PINs securely—you need them to temporarily lift the freeze when you apply for credit yourself. Also freeze your ChexSystems report (used by banks to approve checking accounts) and your Innovis file, two lesser-known consumer reporting companies that criminals sometimes exploit.

One trade-off: freezes add friction to legitimate transactions. Applying for a mortgage, opening a utility account, or even some job background checks may require you to unfreeze one or more bureaus temporarily. But at Universal Investigations Agency, we've seen the alternative—victims who relied only on alerts and discovered six new credit cards opened in their name within a month. Inconvenience beats devastation.

How Do I Check if My Social Security Number Is Being Used Fraudulently?

Request your Social Security Administration earnings statement at ssa.gov/myaccount. Review reported income for years you suspect fraud. If employers you never worked for appear, someone is using your SSN for employment. Report this to the SSA fraud hotline and the IRS.

Pull your full credit reports from all three bureaus at AnnualCreditReport.com. You're entitled to one free report per bureau every 12 months, but identity theft victims can request additional reports. Scan for accounts, inquiries, or addresses you don't recognize. Dispute every fraudulent entry in writing, attaching your FTC Identity Theft Report. The bureau must investigate within 30 days and remove unverified information.

Monitor your Explanation of Benefits statements from health insurers. Medical identity theft—when someone uses your insurance to obtain care—rarely shows up on credit reports but generates EOBs listing procedures you never had. Contact your insurer immediately if you spot unfamiliar claims.

Do You Get a New SSN if Your Identity Is Stolen?

Rarely. The Social Security Administration issues new numbers only in extreme cases where the victim faces ongoing harm despite preventive measures. You must provide evidence that misuse continues and that you've already placed fraud alerts, filed police reports, and taken standard protective steps. Even then, a new SSN creates complications: your work history, tax records, and credit file don't automatically transfer, and past debts tied to the old number may still appear under your name.

What Are the Long-Term Steps to Protect My Data After Theft?

Identity theft isn't a one-time event—it's a vulnerability that persists. Criminals share stolen data on dark web marketplaces for years. That's why recovery extends far beyond the initial fraud alert and police report. Consider strategies to prevent identity theft in order to reduce your exposure going forward.

Enable two-factor authentication on every financial, email, and social media account. Use a password manager to generate unique passwords for each site—credential stuffing attacks succeed because people reuse passwords. Review your financial statements monthly. Set up account alerts for transactions above a certain threshold. Monitor your credit reports every few months even after the crisis passes.

Phishing attacks often precede identity theft. Preventing phishing attacks involves recognizing spoofed emails, verifying sender addresses, and never clicking links in unsolicited messages. At Universal Investigations Agency, we've investigated cases where a single phishing email led to full identity compromise—victims handed over credentials without realizing the sender was fraudulent.

Can a Private Investigator Help After Identity Theft?

Law enforcement prioritizes high-dollar cases or organized fraud rings. If your theft involves complex fraud—business identity theft, international scams, or criminals using your information for criminal activity—a private investigator brings resources police can't. Victor Elbeze, our Chief Investigator, brings over 25 years of combined law enforcement and military intelligence experience in the U.S. and abroad, and our global network of seasoned investigators can trace fraudulent accounts across jurisdictions, identify how your data was breached, and document evidence that strengthens civil or criminal cases.

We've worked with clients whose identities were stolen by family members, former partners, or business associates—situations where the thief knows enough personal information to bypass standard fraud protections. In those scenarios, standard reporting procedures often fail because the perpetrator can answer security questions or intercept mail. Professional investigators can uncover the source, secure evidence, and support legal action when personal relationships complicate resolution.

If you're facing ongoing fraud despite following every recommended step—or if you suspect someone close to you is responsible—contact Universal Investigations Agency. We'll assess your situation and determine whether investigative services can close gaps that consumer reporting agencies and law enforcement leave open.