First 24 Hours After Identity Theft: What to Do Right Now

You discover fraudulent charges on your credit card. Or you get a collections notice for a debt you never incurred. Or you try to file taxes and learn someone already filed using your Social Security number. The moment you realize your identity has been stolen, the clock starts.

The first 24 hours determine whether you contain the damage or watch it spread. Identity theft is not a single event. It's a cascade. Each hour you wait gives the operators more time to open accounts, drain balances, and embed themselves deeper into your financial life. This is not about perfection. This is about moving fast enough to stop the bleeding.

Here's what to do, in order, in the first 24 hours after you discover identity theft.

Hour 1: File Your FTC Identity Theft Report

Your first action is to create an official record. Go to IdentityTheft.gov and file a report. This is the Federal Trade Commission's reporting system. The report you generate becomes your FTC Identity Theft Report, which gives you specific legal rights when dealing with creditors, debt collectors, and credit bureaus.

The report takes around 20 minutes to complete. You'll answer questions about what happened, what information was compromised, and what fraudulent activity you've discovered. The system generates a recovery plan customized to your situation. You'll get a PDF copy of your report. Download it. Save multiple copies. You'll need this document for nearly every step that follows.

The FTC report does not automatically notify law enforcement. It's an administrative record that establishes the theft occurred and gives you standing to dispute fraudulent accounts. Some situations require a police report in addition to the FTC report , specifically, if you need to prove identity theft to a creditor who demands it, or if you're dealing with criminal identity theft where someone used your information during an arrest. For most cases, the FTC report is sufficient and faster.

Why this comes first: the report creates a timeline. It documents what you knew and when you knew it. Creditors and debt collectors cannot hold you responsible for charges made after you filed your report, assuming you've taken reasonable steps to secure your accounts. The report is your legal foundation. Everything else builds on it.

Hour 2: Freeze Your Credit at All Three Bureaus

A credit freeze prevents anyone from opening new credit accounts in your name. This includes you. That's the point. The freeze stops the cascade. As long as your credit is frozen, an identity thief cannot take out loans, open credit cards, or establish new lines of credit using your information.

You need to freeze your credit at all three major credit bureaus: Equifax, Experian, and TransUnion. Freezing at one bureau does not freeze the others. Each operates independently. Each requires a separate request.

Credit freezes are free. Federal law guarantees this. The bureaus cannot charge you to place, lift, or remove a freeze. You can do this online in around 10 minutes per bureau. You'll create an account, verify your identity, and request the freeze. Each bureau will give you a PIN or password to lift the freeze later. Save these credentials in your password manager.

Here's what the freeze does: when you apply for credit, the lender checks your credit report. If your credit is frozen, the bureau will not release your report. The application gets denied. This works even if the thief has your Social Security number, date of birth, and address. Without access to your credit report, the lender cannot approve the account.

The freeze does not affect existing accounts. Your current credit cards, loans, and lines of credit continue to work normally. It does not lower your credit score. It does not prevent you from using your existing credit. It only blocks new account openings.

When you need to apply for legitimate credit , a mortgage, a car loan, a new credit card , you lift the freeze temporarily. You can lift it for a specific lender or for a set time period. Lifting is instant. You use the PIN the bureau gave you when you placed the freeze. Once the lender pulls your report, you can re-freeze immediately.

Some people confuse freezes with fraud alerts. A fraud alert is weaker. It requires lenders to take extra steps to verify your identity before approving credit, but it does not block access to your report. A freeze is a hard stop. Use the freeze.

Hour 3-4: Review and Secure Compromised Accounts

Now you inventory the damage. Pull up your bank accounts, credit cards, investment accounts, and any other financial accounts you hold. Review recent transactions. Look for charges you did not make, withdrawals you did not authorize, and transfers you did not initiate.

For each compromised account:

Change the password immediately. Use a unique password you've never used before. If you're reusing passwords across accounts, stop. Every account gets its own password. Use a password manager to generate and store these. If you don't have a password manager, get one now. This is not optional. Password reuse is how one compromised account becomes ten.

Enable two-factor authentication. If the account offers 2FA and you haven't enabled it, enable it now. Prefer authenticator apps or hardware keys over SMS. SMS-based 2FA is better than nothing, but it's vulnerable to SIM-swapping attacks. Authenticator apps (Google Authenticator, Authy, or the authenticator built into your password manager) are stronger.

Contact the institution. Call the fraud department. Tell them your identity was stolen and you've discovered unauthorized activity. Ask them to flag your account for fraud monitoring. Ask if they can reverse the fraudulent charges. Ask if they see any other suspicious activity you might have missed. Get the name of the person you spoke with and a case number. Write this down.

Do not close the account yet. Closing an account before you've documented all fraudulent activity can complicate the dispute process. Leave the account open until you've worked through the fraud claims with the institution. Once everything is resolved, you can close it if you want to.

If you discover accounts you did not open , credit cards in your name that you never applied for, loans you never took out , contact those institutions immediately. Tell them the account is fraudulent. Request that they close it and remove it from your credit report. You'll need your FTC Identity Theft Report for this. Send them a copy.

Hour 5-6: Check Your Credit Reports

You're entitled to free credit reports from all three bureaus once per year through AnnualCreditReport.com. If you've already used your free reports this year, you can still request them in the context of identity theft. Federal law allows additional free reports if you're a victim of fraud.

Pull reports from all three bureaus. Read them carefully. Look for accounts you did not open, inquiries you did not authorize, and addresses you've never lived at. Each of these is a red flag.

When you find fraudulent accounts, dispute them. Each bureau has a dispute process. You can usually initiate disputes online. You'll need to provide your FTC Identity Theft Report and any supporting documentation (police reports, correspondence with creditors, receipts proving you were elsewhere when the account was opened). The bureau has 30 days to investigate. If they cannot verify the account as legitimate, they must remove it from your report.

Fraudulent inquiries , records showing that someone checked your credit , should also be disputed. These don't directly harm your credit score as much as fraudulent accounts do, but they're evidence of ongoing attempts to use your identity. Removing them cleans up your report.

Hour 7-8: Notify Relevant Institutions Beyond Financial Accounts

Identity theft often extends beyond bank accounts and credit cards. Depending on what information was compromised, you may need to contact other institutions.

If your Social Security number was stolen: File a report with the Social Security Administration. You can do this online at ssa.gov/fraud. The SSA cannot issue you a new Social Security number in most cases, but they can flag your number for monitoring and alert you to suspicious activity, such as someone using your number to claim benefits or report wages.

If your health insurance information was stolen: Contact your health insurance provider. Ask them to flag your account for fraud. Request a list of claims filed under your policy. Look for medical services you did not receive. Fraudulent medical claims can affect your coverage limits and create false medical records that complicate future care.

If your driver's license was stolen or used: Contact your state's Department of Motor Vehicles. Ask if any licenses have been issued in your name in other states. Ask if there are traffic violations or accidents on your record that you did not commit. Some states allow you to request a new license number if yours has been compromised.

If tax fraud is involved: If someone filed a tax return using your Social Security number, contact the IRS immediately. File Form 14039, the Identity Theft Affidavit. The IRS will flag your account and issue you an Identity Protection PIN, which you'll need to file future returns. Be prepared for delays in processing your legitimate return. Tax-related identity theft often takes months to resolve.

Hour 9-12: Document Everything

From this point forward, you are building a case. Every conversation, every email, every letter you send or receive becomes part of your documentation. This is not paranoia. This is how you prove what happened when disputes arise.

Create a dedicated folder , physical or digital , for identity theft records. Include:

• Your FTC Identity Theft Report
• Police reports, if you filed them
• Copies of credit reports showing fraudulent accounts
• Correspondence with creditors and debt collectors
• Records of phone calls (date, time, person you spoke with, case number, summary of conversation)
• Copies of dispute letters you send
• Receipts, bank statements, and any other evidence supporting your case

When you call an institution, take notes during the call. Immediately after you hang up, write a summary while the details are fresh. Include the date, time, name of the representative, any case or reference numbers they gave you, and what was agreed upon. If the representative made a commitment , "we'll reverse those charges within 5 business days" , write it down. If the timeline passes and nothing happens, you have a record to escalate with.

Send follow-up emails after phone calls. "This email confirms our conversation today at 2 p.m. regarding fraudulent charges on account ending in 1234. You stated that the charges would be reversed and a new card issued. Please confirm receipt of this email and let me know if any additional information is needed." This creates a written trail even when the original contact was by phone.

Keep copies of everything you send. If you mail a dispute letter, send it certified mail with return receipt. This proves the recipient received it and establishes a timeline. If you submit documents online, take screenshots showing the submission confirmation.

Hour 13-18: Set Up Monitoring and Alerts

You've contained the immediate damage. Now you set up systems to catch future attempts.

Enable account alerts. Most financial institutions allow you to set up alerts for transactions above a certain amount, foreign transactions, online purchases, and changes to account settings. Turn these on. Set the thresholds low enough that you'll catch small fraudulent charges, not just large ones. Thieves often test stolen credentials with small purchases before attempting larger fraud.

Monitor your credit. You can use free services like Credit Karma or the monitoring tools offered by your credit card issuers. These services alert you to new accounts, inquiries, and significant changes to your credit report. They're not perfect , they sometimes miss things, and they sometimes alert you to legitimate activity , but they're better than checking manually.

Consider a paid monitoring service. Services like the one offered through NordProtect provide dark web monitoring, credit monitoring, and recovery support. These services scan criminal forums and data markets for your personal information and alert you if your data appears. They also provide insurance and dedicated recovery specialists if you experience identity theft. Whether this is worth the cost depends on your risk tolerance and the sensitivity of your information. If your Social Security number, financial account numbers, and medical records were all compromised in a breach, a monitoring service might be worth it. If only your email address and password were exposed, probably not.

Check Have I Been Pwned. Go to Have I Been Pwned and enter your email address. This site aggregates data from known breaches and tells you if your email appeared in any of them. If it did, you'll see which breaches included your data and what types of information were exposed. This helps you understand the scope of exposure and prioritize which accounts to secure.

Hour 19-24: Plan for the Long Term

The first 24 hours are about stopping the bleeding. The weeks and months that follow are about recovery and prevention.

Expect this to take time. Resolving fraudulent accounts, disputing charges, and cleaning up your credit report is not a one-day process. Some disputes take 30 days. Some take longer. You'll send letters, make phone calls, and wait for responses. This is normal. Keep your documentation organized. Follow up when deadlines pass. Be persistent.

Understand your rights. The Fair Credit Reporting Act gives you specific rights when disputing fraudulent accounts. Creditors cannot continue to report a debt as yours while a dispute is under investigation. Debt collectors cannot harass you for debts you've disputed with documentation. If a creditor or collector violates these rules, you can file a complaint with the FTC or your state attorney general. Your FTC Identity Theft Report is your evidence.

Review your recovery plan regularly. The FTC system generates a step-by-step recovery plan based on the information you provided in your report. This plan includes deadlines, sample letters, and instructions for disputing specific types of fraud. Revisit this plan weekly. Mark off completed steps. Update it as new fraudulent activity appears.

Prepare for bureaucratic friction. You will encounter institutions that make this harder than it needs to be. You'll reach representatives who don't understand identity theft procedures. You'll send documents that get lost. You'll be asked to provide the same information multiple times. This is not personal. This is how large institutions operate. Stay calm. Resubmit what they need. Escalate when necessary. Document everything.

Recognize that some damage is permanent. Even after you've resolved all fraudulent accounts and cleaned up your credit report, some effects linger. You may find it harder to get approved for credit in the short term. You may face higher interest rates until your credit score recovers. You may need to explain the theft to lenders, landlords, or employers who run background checks. These are real costs. They're also manageable. The alternative , doing nothing , is worse.

What This Looks Like in Practice

In How I Met Your Mother, Marshall discovers that his credit card has been used to buy things he'd never purchase. He calls the bank, they reverse the charges, and the problem is solved in one episode. That's not how identity theft works in 2026.

Real identity theft unfolds over weeks. You discover one fraudulent charge, then another. You freeze your credit and think you're done, then you get a collections notice for a loan you never took out. You dispute the loan, and three months later it's still on your credit report because the creditor claims they need more documentation. You send the documentation again. You wait. You escalate. Eventually, it gets resolved. Then you discover another account.

The analogy works because the show makes everything feel manageable and episodic. Real life is messier, but the structure is the same: you handle one thing, then the next thing, then the next. The first 24 hours give you the tools to handle each thing as it appears. The FTC report gives you legal standing. The credit freeze stops new fraud. The documentation proves your case. The monitoring catches the next attempt.

You don't need to solve everything in 24 hours. You need to stop the cascade and build the foundation for recovery. That's what these steps do.

Why Speed Matters

Identity theft is time-sensitive in ways that other security incidents are not. If your password gets compromised, changing it stops the threat immediately. If your identity gets stolen, the damage can continue for months before you even know it happened.

The operators move fast. They know that once you discover the theft, you'll freeze your credit and lock down your accounts. They have a window , sometimes hours, sometimes days , to extract as much value as possible. Every hour you delay gives them more time to open accounts, make purchases, and drain balances.

The institutions move slowly. Disputing a fraudulent account takes 30 days minimum. Removing it from your credit report takes longer. Recovering from tax fraud can take a year. The faster you start the process, the faster you finish.

The legal protections are stronger if you act quickly. If you report a fraudulent charge within 60 days, your liability is capped at $50 under federal law. If you wait longer, you may be responsible for more. If you file your FTC Identity Theft Report promptly, you have stronger standing to dispute debts and remove fraudulent accounts. Delay weakens your case.

This is why the first 24 hours matter. Not because you'll finish everything in 24 hours, but because you'll start everything. You'll file the report, freeze your credit, secure your accounts, and begin documentation. These actions stop the cascade and give you the tools to handle what comes next.