Identity Theft Discovered: Your First 72 Hours, Hour by Hour

The First 10 Minutes: Stop, Don’t Panic-Click

The moment you discover identity theft, whether it’s a strange charge, a collections letter for a debt you never opened, or a rejected tax return, your instinct will be to do everything at once. Resist that. Scattered action wastes the one resource that actually matters here: time before the thief moves to the next account.

Start by writing down what you know, right now, before you do anything else. A simple note on your phone works:

• What alerted you (email, letter, denied application, bank alert)
• The date and time you noticed it
• Any account numbers, amounts, or names involved

This becomes the spine of your case file. Every call you make from here forward, you’ll be asked “when did you first notice this,” and a vague answer slows everyone down, including you.

Hour 1: Lock the Doors That Matter Most

Freeze your credit first

Before you call your bank, before you call the police, freeze your credit at all three major bureaus: Equifax, Experian, and TransUnion. This is free, it takes about ten minutes per bureau, and it stops new accounts from being opened in your name while you handle everything else. A freeze doesn’t affect your existing accounts or your credit score. Keep the PIN or password each bureau gives you; you’ll need it to lift the freeze later.

Change the one password that unlocks everything

If your email account is compromised, or you suspect it might be, change that password immediately and turn on two-factor authentication if it isn’t already on. Your email is usually the reset path for your bank, your utilities, and half your other logins. If a thief controls it, they control the recovery process for everything else too.

Hours 1 to 6: Call the People Who Can Actually Stop the Bleeding

Financial accounts

Call the fraud department (not general customer service) of any bank, credit card, or lender where you see suspicious activity. Ask them to:

• Close or freeze the specific compromised account
• Reverse fraudulent charges and put that in writing (email confirmation, not just a verbal promise)
• Flag the account for identity theft in their internal system

Get a reference number for every single call. Write it in your case file next to the date, the representative’s name if given, and what was promised.

The one federal report that ties it all together

File a report at the government’s identity theft reporting site (identitytheft.gov in the US). This generates an official Identity Theft Report and a personalized recovery plan. Many banks, creditors, and credit bureaus will ask for this report number before they’ll take further action, so getting it early saves you from redoing steps later.

Local police report, if applicable

Not every case needs one, but file a local police report if:

• Someone used your identity to commit a crime
• A creditor or bureau specifically requires it to remove fraudulent debt
• Physical documents (wallet, mail, checks) were stolen

Bring your case file notes and the federal report number. It makes the officer’s job faster and yours too.

Hours 6 to 24: Widen the Check Beyond the Obvious

Financial fraud is the loud kind of identity theft. Three quieter kinds often get missed in the first day, and each has its own process.

Tax identity theft

If your tax return gets rejected because one was “already filed” under your Social Security number, that’s tax identity theft. This doesn’t get fixed through your bank. You’ll need to file a specific identity theft affidavit with your tax authority and expect a longer resolution timeline, often months, not days. Request a copy of the fraudulent return if the agency allows it; it can tell you what other personal details the thief has access to.

Medical identity theft

Check your health insurance explanation of benefits for services you didn’t receive. This matters for two reasons: it can mean someone is using your coverage for their own care, and errors introduced into your medical record from their treatment could affect your future care if not corrected. Contact your insurer’s fraud line and request a corrected accounting of claims tied to your name.

Government identity theft

This covers things like someone using your identity for unemployment benefits, a driver’s license, or other government services in your name. Check your state unemployment agency directly, even if you’re not filing for benefits; fraudulent claims in your name are a growing problem and often surface only when you go looking. Report government identity theft directly to the relevant agency, separate from your bank and credit bureau reports.

Hours 24 to 72: Build the Paper Trail That Protects You Later

Keep one running document

By day two, you’ll have talked to five or six different institutions, each with its own case number and its own promises. Keep one master document (a spreadsheet works well) with columns for:

• Date and time of contact
• Organization and department
• Person’s name and reference number
• What was agreed to happen next
• Follow-up date if nothing has happened by then

This document is what you’ll hand to a supervisor if something falls through the cracks, and something usually does.

Pull your credit reports

Once your freeze is in place, request a free copy of your credit report from each bureau and look specifically for accounts you don’t recognize, hard inquiries you didn’t authorize, and addresses that aren’t yours. Dispute anything fraudulent directly with the bureau in writing, referencing your federal identity theft report number.

Set expectations for what comes next

The 72-hour window is about containment, not full resolution. Some cases close in a week. Tax and government identity theft cases can take months. Set a follow-up reminder for two weeks out to check on every open case, and don’t assume silence means it’s fixed. Call and ask.

The Short Version

1. Write down what you know before you do anything else
2. Freeze your credit at all three bureaus
3. Secure your email and enable two-factor authentication
4. Call fraud departments for every affected account, get reference numbers
5. File the federal identity theft report
6. File a police report if warranted
7. Check for tax, medical, and government identity theft, not just financial
8. Keep one master log of every contact and promise made
9. Pull and review your credit reports
10. Set a two-week follow-up to confirm everything actually got fixed

Identity theft rarely announces itself all at once. The person who discovers a fraudulent credit card today may find a fraudulent tax return in March. Treat the first 72 hours as triage, not a finish line, and you’ll be in a far stronger position for whatever surfaces next.

For the complete, structured playbook on this topic, see The Identity Theft Response Manual: The 72-Hour Playbook for the Day You Find Out in our library. New here? Start with our free guide.