What to Do If Your Identity Is Stolen: A Step-by-Step Plan

If you are sure someone has used your identity, speed and order matter. These steps follow official US guidance, with notes for the UK and Canada.

By Siddharth ShankarUpdated October 11, 2026

Finding out that someone is using your identity is stressful, but the recovery process is well defined. This guide assumes you have real evidence of misuse, such as an unknown account, a charge you did not make or a notice about a debt that is not yours. If you are only worried because your details were exposed, start with what identity theft is and how to spot it instead.

The steps below follow the US Federal Trade Commission (FTC), because it runs the main reporting system for the United States. Short sections for the United Kingdom and Canada follow, since the process differs.

The three immediate steps in the United States

The FTC's "What To Do Right Away" guidance has three parts.

Consider a credit freeze

A fraud alert asks lenders to check that it is really you. A credit freeze goes further by blocking access to your report, which makes it hard to open new credit in your name. The FTC says a freeze is free to place and lift and does not affect your credit score, but you must contact all three bureaus. It stays in place until you lift it. Read the credit freeze guide for how to place one and when a fraud alert is enough.

An extended fraud alert lasts seven years. It requires an FTC identity theft report or a police report, and it also removes you from credit and insurance marketing lists for five years.

Secure the accounts that can be reached

Identity theft often travels through email. Change the password on your email account first, then on banking and any account that shares a similar password, and turn on multi-factor authentication. If a phone number was involved, ask your mobile carrier to add a PIN or password to your account. Our guide on what to do if your phone number was in a data breach covers the SIM-swap risk.

If your Social Security number or tax account is involved

If your Social Security number was exposed or misused, there are extra steps, such as enrolling in the IRS Identity Protection PIN. See what to do if your Social Security number was leaked.

Keep records

Write down the date, the person you spoke to and what they agreed to do. Keep copies of letters and confirmations. If a company disputes the fraud, these notes are your evidence.

If you live in the United Kingdom

Report the fraud through Report Fraud, the national service run by City of London Police that replaced Action Fraud on 4 December 2025. You can report at reportfraud.police.uk or call 0300 123 2040. Scotland uses Police Scotland on 101. Cifas Protective Registration costs £30 for two years and places a warning flag on your record so organizations carry out extra checks. The ICO also advises complaining to any organization that lost your data. We have not found a UK equivalent of a US-style credit freeze, so do not assume one exists.

If you live in Canada

The Canadian Anti-Fraud Centre advises victims to flag affected accounts, change passwords, report to both Equifax and TransUnion, file a police report, get a file number and tell service providers. Credit lock or freeze options vary by province: Equifax Canada's lock is available to residents of Quebec and Ontario, and TransUnion's freeze is for Quebec residents.

Elsewhere

In other countries, start with your bank, your national police fraud reporting channel and your data protection authority. In France, for example, the data protection authority CNIL explains that identity theft is a criminal offence and advises collecting evidence, asking platforms to remove content and filing a police complaint.