What to Do If Your Identity Is Stolen in 2026
Reviewed · Updated
Not legal or financial advice. Identity theft protection services reduce risk; they do not prevent all fraud.
Quick answer: If your identity is stolen, call the companies where the fraud happened, place a free fraud alert, and report it at IdentityTheft.gov to get a recovery plan. Then freeze your credit at all three bureaus. Every step is free (checked 10/09/2026). A paid service can help watch for the next attack, but its insurance won’t cover a theft you already found.
- Free: every step below costs nothing. The FTC’s checklist is at IdentityTheft.gov, and credit freezes are free by federal law.
- Time: the first three steps take an afternoon. Closing fake accounts and fixing your credit reports can take weeks of letters and calls.
- Pay only for what comes next: an identity theft service can monitor all three bureaus and help with paperwork, but Aura’s insurance excludes fraud found before you join.
This is not legal or financial advice. If you’ve been a victim, start at IdentityTheft.gov.
Step 1: Do it yourself for free
The federal government already publishes the checklist. IdentityTheft.gov is run by the Federal Trade Commission. It calls itself “the federal government’s one-stop resource for identity theft victims.” I read every step of it on 10/09/2026, and the order below follows it.
1. Call the companies where you see fraud
Start with the bank, card issuer or store where the strange charge or account showed up. Call its fraud department and say someone stole your identity. Ask it to close or freeze the account, so no one can add charges without your OK. Then change the logins, passwords and PINs for those accounts. You may have to call again once you have your FTC report.
2. Place a free fraud alert and pull your credit reports
Contact one of the three credit bureaus and ask for a fraud alert. That bureau must tell the other two. With an alert on your file, a business has to verify it’s you before it opens new credit in your name. The alert is free and lasts one year, and you can renew it.
| Bureau | Online | Phone |
|---|---|---|
| Experian | experian.com/help | 888-397-3742 |
| TransUnion | transunion.com/credit-help | 888-909-8872 |
| Equifax | equifax.com/personal/credit-report-services | 800-685-1111 |
Then get your reports from all three at AnnualCreditReport.com or 1-877-322-8228. You can check them every week for free. Write down every account or inquiry you don’t recognize; you’ll need that list for step 3.
3. Report it to the FTC and get a recovery plan
Fill in the form at IdentityTheft.gov or call 1-877-438-4338. From your answers, the site builds your FTC Identity Theft Report and a personal recovery plan. The report proves to businesses that your identity was stolen, and IdentityTheft.gov says it “also guarantees you certain rights.” If you don’t create an account, print the report right away. Once you leave the page, you can’t get it back.
A police report is optional. IdentityTheft.gov says you “may choose to file” one. Bring your FTC report, a photo ID and proof of address. Filing a false report with the FTC is illegal, the site warns.
4. Freeze your credit at all three bureaus
A freeze goes further than an alert: no one can open new credit in your name, including you, until you lift it. Unlike the alert, you have to ask each bureau separately. Federal law makes it free to place and to lift. A request made online or by phone must be placed within 1 business day and lifted within 1 hour (15 U.S.C. §1681c-1).
TransUnion’s freeze page didn’t load from my connection on 10/09/2026, so I can’t show it. Use transunion.com/credit-help or 888-909-8872, the contacts IdentityTheft.gov lists. Once you have your FTC report, you can also ask for a free extended fraud alert, which lasts 7 years.
5. Close fake accounts and block them on your credit report
With your FTC report in hand, call each business where an account was opened in your name. Ask it to close the account and send a letter saying it isn’t yours and you aren’t liable for it. Then write to each bureau, enclose the FTC report, and ask it to block the fraudulent lines. With that report, bureaus must block them within 4 business days (15 U.S.C. §1681c-2). IdentityTheft.gov has sample letters for both.
6. Fix the kind of theft you’re facing
- Taxes: if the IRS says a return was already filed with your SSN, send Form 14039. To stop it next year, get an Identity Protection PIN. Anyone with an SSN or ITIN who can verify their identity can get one, and it changes every calendar year.
- Social Security number: check your earnings history in a free my Social Security account, and lock your number against job checks with E-Verify’s Self Lock. You generally can’t get a new number unless there’s evidence yours is being misused, IdentityTheft.gov says.
- Medical: read your records in each patient portal and send the FTC report to your insurer’s fraud department. Medicare’s number is 1-800-633-4227.
- Phone, utility or checking accounts: request your NCTUE report (1-866-349-5185) and your ChexSystems report (1-800-428-9623).
7. Keep checking your reports
Fraud often comes back months later. Pull your reports every few weeks at AnnualCreditReport.com, and log in to each bureau to lift or restore your freeze when you apply for credit.
Step 2: When doing it yourself isn’t enough
Everything above is free, but it’s slow. Each bureau, bank and agency is a separate call or letter, and IdentityTheft.gov tells you to note who you spoke to and when. Freezes and fraud alerts stop new credit. They don’t stop someone from filing taxes, using your health insurance or draining a bank account you already have.
They also don’t watch for you. A freeze sends no alert when someone tries to use your file. A service can monitor your credit at all three bureaus, flag your SSN on the dark web and help with the paperwork.
There’s a limit you should know before paying. In a BBB complaint from 2026, an Aura member found out about a fraudulent tax return from someone else. Aura replied on 09/02/2026 that the tax-filing activity isn’t shared with it, so “this type of event does not generate an Aura alert.” Aura also said that “credit freezes also do not trigger notifications.” The IP PIN in step 6 covers that gap better than any subscription.
Step 3: Use one service that does it for you
If you want help with the next attack, Aura covers more of this checklist than the other service I checked. Its plans include credit monitoring at all three bureaus, a one-tap Experian lock and help placing freezes at the other two. Its identity theft page offers an “Expert Fraud Remediation team” that builds a recovery plan with you. Aura says that team can set up three-way calls with your bank or the bureaus.
Read this before you sign up. Aura’s $1M insurance summary excludes “loss resulting from an identity fraud that was discovered prior to the effective date of the Policy.” Its stolen-funds cover applies only to losses that first happen after that date. So if your identity was stolen last week, Aura’s insurance won’t pay for that theft. Its pages don’t say whether the remediation team will take a case that started before you joined. Ask Aura before you pay, not after.
On 10/09/2026, Individual cost $12 a month billed yearly ($144), or $15 month to month. Every plan starts with a 14-day free trial, and annual plans can be refunded within 60 days. Aura didn’t show the renewal price before payment. When I tried to sign up on 10/08/2026, it asked for my home address “to verify your identity” before the payment step, and I stopped there. Create your account on Aura’s site:
Start Aura’s free trialAffiliate link · how it works →
Aura’s 60-day refund is requested by phone and doesn’t apply to monthly plans or renewals. Read the full Aura review for what its terms and checkout say, and Aura’s pricing for every plan.
If you’d rather use another service
LifeLock is the other identity theft service I’ve run through checkout. Its Core plan was $124.99 a year with credit monitoring at two bureaus, and its trial needs a card. LifeLock’s insurance also covers only events after you join, per its Evidence of Coverage. Compare the two on LifeLock vs Aura.
| Service | Our score | Free trial | Lowest 1-year price | Insurance and existing theft | Data asked | Support (ET) | Reviewed on |
|---|---|---|---|---|---|---|---|
| LifeLock | 8.1/10 | 30 days, card needed | $124.99/yr | Covers events after you join | email, phone number, last 4 digits of SSN (phone-width checkout) or full SSN and date of birth (manual entry), name and address, card | 24/7 per LifeLock contact page | 10/08/2026 |
| Aura | 7.0/10 | 14 days | $144/yr | Excludes fraud discovered before the policy date | email, name, home address (to verify identity), later steps not seen: Details and Payment | 24/7 per Aura contact page | 10/08/2026 |
Is paying worth it for you? See what you get free first on free credit monitoring, then compare the paid services on the best identity theft protection, ranked by our methodology.
See also
- Is identity theft a federal crime?
- Credit lock vs. credit freeze
- Best credit monitoring services
- What identity theft insurance covers
What we checked
- IdentityTheft.gov recovery steps read in full and captured on 10/09/2026, with the three “What To Do Right Away” steps opened
- FTC’s credit freeze and fraud alert page, Equifax’s and Experian’s freeze pages, AnnualCreditReport.com and the IRS IP PIN page captured on 10/09/2026. TransUnion’s freeze page didn’t load from my connection, so its contacts come from IdentityTheft.gov
- Federal law on freezes and blocks: 15 U.S.C. §1681c-1 and §1681c-2, read on Cornell’s Legal Information Institute on 10/09/2026
- Aura: pricing page, identity theft protection page and $1M insurance summary captured on 10/09/2026. No account: Aura’s enrollment stopped at the home address step when I tried it on 10/08/2026
- LifeLock: its Evidence of Coverage for events from 09/01/2026, read on 10/08/2026 for the run behind our review
- What owners say: Aura’s BBB complaints and Trustpilot reviews collected on 10/08/2026. Reddit didn’t load from my connection
- Cookie banners were hidden before the screenshots; a small cookie strip stayed on Aura’s pages
- Where the run stopped: desk review only: government pages and Aura's public pages; no Aura account (enrollment stops at the home address step, 10/08/2026)
FAQ
What is the first thing to do if your identity is stolen?
Call the fraud department of every company where you can see the fraud, such as your bank or a card issuer, and ask them to close or freeze those accounts. Then change the logins, passwords and PINs. That’s step 1 of the FTC’s checklist on IdentityTheft.gov (checked 10/09/2026).
Do I need to file a police report for identity theft?
Usually not. IdentityTheft.gov says you “may choose to file a report” with local police. The FTC Identity Theft Report you get there is what businesses and credit bureaus ask for. Go to the police if a company insists on a police report, or if you know who the thief is.
Does freezing my credit cost anything?
No. Federal law requires the three bureaus to place and lift a freeze free of charge (15 U.S.C. §1681c-1). A request made online or by phone must be placed within 1 business day and lifted within 1 hour. You have to contact Equifax, Experian and TransUnion separately.
What’s the difference between a fraud alert and a credit freeze?
A fraud alert tells lenders to verify it’s you before opening credit, but they can still see your report. A freeze blocks access to your report until you lift it. One call to one bureau places an alert at all three; a freeze takes three requests. Both are free, according to the FTC.
Can I get a new Social Security number after identity theft?
Generally not. IdentityTheft.gov says you can’t get a new number unless there’s evidence someone is misusing yours, and even then a new number won’t clear records tied to the old one. You can check your earnings history in a my Social Security account and lock your number for job checks with E-Verify.
Will an identity theft protection service fix identity theft that already happened?
Don’t count on its insurance. Aura’s $1M insurance summary excludes identity fraud discovered before the policy date, and LifeLock’s coverage applies to events after you join. Aura advertises a fraud remediation team, but its pages don’t say whether that team takes a case that started before you signed up. Ask before you pay.