Identity Theft Recovery: A Step-by-Step Plan That Actually Works

Why identity theft recovery falls apart

Most people who discover they’re victims of identity theft do the same thing: they panic, call one credit bureau, maybe cancel a card, and then stall. Not because they’re careless, but because nobody handed them a sequence. Identity theft recovery is not one task. It’s a project with dependencies, deadlines, and paperwork that has to be done in a specific order or it doesn’t hold up later.

This guide lays out that order. It won’t cover every possible fraud scenario, but it gives you the backbone: what to freeze first, how to dispute correctly, what to document, and how to tell if someone has planted tracking software on your devices as part of a broader pattern of control.

Step 1: Stop the bleeding before you investigate

Before you try to understand how the theft happened, cut off further damage. Investigation can wait a day. Ongoing fraud cannot.

Freeze your credit at all three bureaus

Contact Equifax, Experian, and TransUnion separately. A freeze is free and blocks new accounts from being opened in your name. Fraud alerts are weaker and expire; freezes stay until you lift them. Do all three the same day. Save the confirmation numbers and PINs they give you. You’ll need them later to lift or reapply the freeze, and losing them creates a second headache on top of the first.

Lock down financial accounts

Call your bank and any card issuers involved. Ask them to flag the accounts for fraud, not just cancel the card. Cancellation alone can wipe out the transaction history you need for disputes. Request that they preserve records rather than simply closing things out.

Change passwords, starting with email

Your email account is usually the master key to everything else. If there’s any chance it’s compromised, change that password first, then move to banking, then to anything tied to a payment method. Turn on two-factor authentication wherever it’s offered. Use an authenticator app rather than SMS if you have the option, since SMS codes can be intercepted through SIM-swap attacks.

Step 2: Build a paper trail that actually holds up

This is the part most people skip, and it’s the part that determines whether your case gets resolved in weeks or drags on for a year.

Open a dedicated file

Physical folder, digital folder, doesn’t matter, but keep everything related to the incident in one place. Every letter, every reference number, every screenshot.

File an FTC identity theft report

In the US, IdentityTheft.gov generates a personal recovery plan and an official report you can use with creditors and bureaus. This report is often required before banks or credit agencies will remove fraudulent charges or accounts, so get it early rather than after you’ve already started calling people.

File a police report

Some creditors specifically require a police report, not just the FTC report, especially for larger fraud amounts. Bring your FTC report with you when you file, since it gives the officer a structured summary instead of you trying to explain everything from memory.

Log every phone call

Date, time, who you spoke to, what they said they’d do, and any reference number. When you call back in two weeks because nothing happened, this log is what gets you a supervisor instead of another script-reader starting from zero.

Step 3: Dispute the specific fraudulent items

Freezing your credit stops new damage. Now you deal with what’s already there.

Pull your credit reports

Request reports from all three bureaus. In the US you’re entitled to free reports, and after a fraud report you can often get additional free copies beyond the standard annual allotment. Go through each line item. Mark anything you don’t recognize.

Dispute in writing, not just by phone

Phone disputes can get lost or misrecorded. Send written disputes to each bureau and each creditor reporting the fraudulent item, and mail them in a way that gives you delivery confirmation. Include copies (never originals) of your FTC report, police report, and ID. Reference the specific account numbers and the exact reason the item is fraudulent.

Follow up on a set schedule

Bureaus generally have a statutory window (commonly 30 days) to investigate a dispute. Mark that date. If you haven’t heard back by then, call, referencing your dispute confirmation number, and escalate if needed. Don’t assume no news is good news. Assume it means nobody has looked at it yet.

Get removal in writing

When a fraudulent item is removed, request written confirmation. Keep it permanently. Old fraudulent accounts have a way of reappearing on reports months later if a creditor’s records weren’t fully corrected, and having the original removal letter cuts a repeat dispute down from weeks to days.

Detecting and removing stalkerware

Sometimes identity theft isn’t a stranger buying a credit card database. It’s someone who has physical or digital access to your devices, often a current or former partner. This kind of monitoring software, commonly called stalkerware, is worth treating as its own category because the response is different: it’s not just about disputing charges, it’s about your physical safety.

Signs your device may be monitored

• Battery draining unusually fast or the phone running hot when idle
• Data usage spikes you can’t explain
• Someone seems to know details about your location, messages, or calls that they shouldn’t
• Unfamiliar apps, especially ones disguised with generic names or icons
• Settings changed that you didn’t change, like location sharing turned on

Checking for it safely

Review installed apps and device administrator or accessibility permissions, since stalkerware often hides by requesting elevated access under an innocuous name. Check for unfamiliar profiles or configuration settings on the device. On computers, check for remote access tools and browser extensions you didn’t install.

Be careful about how you search for this. If the person monitoring you has access to your search history or shares your device, researching stalkerware on that device can tip them off. Use a different device, like a library computer or a trusted friend’s phone, to research and to make any related calls.

Removing it without escalating danger

If you believe you’re in an abusive relationship, removing stalkerware abruptly can alert the person monitoring you and, in some cases, escalate the risk to your safety. Before removing anything, consider whether you need to loop in a domestic violence hotline or advocate first, since they can help you weigh the safety tradeoffs of removing versus quietly documenting. If safety isn’t a concern, a factory reset combined with a fresh operating system install, followed by only reinstalling apps you trust, is the most reliable way to clear hidden monitoring software. Change all account passwords afterward from a clean device.

Keeping the recovery on track

Identity theft recovery is rarely a single event. It’s a checklist that takes weeks or months, punctuated by follow-up calls and letters that are easy to let slide once the initial panic wears off. Set calendar reminders for every deadline: dispute windows, freeze renewal dates, follow-up calls. The victims who get full resolution are almost always the ones who kept a system, not the ones who reacted hardest in the first 48 hours.

For the complete, structured playbook on this topic, see Identity Theft Response & Stalkerware Defense: The Recovery Most Victims Navigate Without Operations in our library. New here? Start with our free guide.