Identity Theft Checklist: What to Do in the First 24 Hours
The moment you realize your identity has been stolen — a strange charge, a login alert you didn't trigger, a collections call for a card you never opened — the instinct is to panic. That's understandable, and it's also exactly the wrong move. Identity theft is a race against time, but it's a race won by order, not speed. Doing the right five things in the right order in the first 24 hours can be the difference between a contained incident and months of cleanup.
This checklist is built to be usable in the moment, even if your hands are shaking a little. Work through it in order.
Hour 1: Stop the Bleeding
1. Change the password on the compromised account first — then everywhere you reused it. If you know which account was breached, secure it immediately. Then check any other account using that same password (email, banking, shopping), since credential reuse is one of the most common ways one breach becomes five.
2. Enable two-factor authentication if it isn't already on. Use an authenticator app rather than SMS where possible — SIM-swapping (where a scammer hijacks your phone number) is a known workaround for text-message codes.
3. Call your bank or card issuer using the number on the back of your card — not any number from a text, email, or caller ID. Ask them to freeze or cancel the affected card and flag the account for monitoring. This single habit — using a number you already trust instead of one provided to you — stops the majority of follow-up scams that piggyback on a real incident.
Hours 2–6: Contain the Damage
4. Place a free fraud alert or credit freeze with the three credit bureaus. A fraud alert (free, lasts one year, renewable) requires lenders to verify your identity before opening new credit in your name. A credit freeze (also free) goes further and blocks new credit entirely until you lift it. For most people dealing with active identity theft, a freeze is the stronger option:
- Equifax
- Experian
- TransUnion
You only need to contact one bureau to place a fraud alert — by law, that bureau must notify the other two. A freeze, however, needs to be placed with each bureau separately.
5. Check your accounts for unauthorized activity — all of them. Bank, credit card, retirement, PayPal/Venmo-type apps, email, and any account tied to stored payment methods. Look specifically for:
- Small "test" charges (often $1–$5, used to verify a stolen card works before a larger charge)
- New account creation confirmations you didn't request
- Password reset emails for accounts you don't recognize
6. Start a simple written log now — while it's fresh. Note the date, time, what happened, who you spoke to, and any reference or case numbers. This single habit saves enormous time later with banks, credit bureaus, and law enforcement, all of whom will ask for exact dates and details.
Hours 6–24: Report and Formalize
7. File a report at IdentityTheft.gov. This U.S. government site (run by the FTC) generates an official identity theft report and a personalized recovery plan, and is typically the fastest, most direct path to a usable affidavit that banks and creditors will accept.
8. File a police report if money was stolen or you know the perpetrator. Not every case needs one, but a police report can be required by some banks or insurers to reverse fraudulent charges, and it strengthens your paper trail if the case escalates.
9. Notify any directly affected institution in writing. Follow up phone calls with a short email or letter confirming what was discussed and agreed upon — this creates a timestamped record independent of any single phone call.
10. Watch your mail and inbox for confirmation notices over the next few days. Fraud alerts, freeze confirmations, and reports often trigger secondary emails or letters. These are your proof that the actions above actually went through — don't assume "no news is good news."
A Few Things Not to Do
- Don't call back a number provided in a suspicious message, even if it "confirms" the fraud is real. Verified institutions never need you to use their contact information — you already have it.
- Don't pay anyone to "protect" you during an active incident. Legitimate agencies do not charge upfront fees to investigate fraud.
- Don't share your Social Security number, one-time codes, or passwords with anyone who contacts you, even if they already know some of your information — partial information is often used specifically to seem credible.
Keep This Where You Can Find It
The middle of an actual identity theft incident is a terrible time to be searching your inbox for "what number do I even call." That's exactly why we built the free Scam Response Kit — a printable, plain-language 15-minute action plan (including a refrigerator-ready reference card) that covers this checklist plus what to do for phone, romance, and remote-access scams specifically.
👉 Get the free Scam Response Kit here
Frequently Asked Questions
What is the very first thing I should do if my identity is stolen? Secure the specific compromised account first (change its password, enable two-factor authentication), then contact your bank using the number on your card — not any number provided in a suspicious call, text, or email.
What's the difference between a fraud alert and a credit freeze? A fraud alert requires lenders to verify your identity before extending new credit and only needs to be requested at one bureau. A credit freeze blocks new credit entirely and must be requested separately at each of the three bureaus, but offers stronger protection during an active incident.
Do I need to file a police report for identity theft? Not always, but some banks, insurers, or creditors require one to reverse fraudulent charges or process a dispute, and it strengthens your documentation if the case is larger or ongoing.
How long does it take to recover from identity theft? It varies widely depending on what was compromised, but acting within the first 24 hours — freezing credit, alerting your bank, and filing an official report — significantly shortens both the financial exposure and the cleanup timeline.
This article is general education, not legal or financial advice. If you are in immediate physical danger, contact local emergency services.