Identity theft recovery checklist
Choose each action because it matches evidence you have. Keep confirmation numbers so the recovery story does not depend on memory.
Classify the evidence before choosing a remedy
An exposed identifier, an attempted use, and a confirmed unauthorized account call for different levels of response.
Exposure
Information may be at risk, but there is no known transaction or account. Preserve the notice and seek official guidance.
Attempt
An alert or failed action suggests someone tried to use the information. Contact the relevant institution directly.
Confirmed misuse
An account, charge, filing, or service exists without permission. Build a timeline and use the formal fraud process.
Classify the event before choosing controls. Exposure means information may be available to someone else. An attempt adds evidence of use, such as a failed application or alert. Confirmed misuse includes an account, filing, service, or transaction created without permission. Each category calls for different provider and official steps.
Build a compact evidence packet rather than repeatedly retelling the event from memory. Keep a dated timeline, institution names, contact methods, case numbers, disputed records, and the next required action. Store copies securely and redact information when a recipient does not need it. Do not send further identity documents to an unsolicited recovery service.
- Separate exposure, attempted use, and confirmed misuse.
- Contact the affected institution through a known channel.
- Use the official recovery plan that matches your jurisdiction and evidence.
Why exposure and active misuse need different responses
- Do not send more identity documents to an unverified person offering help.
- A fraud alert, credit freeze, account closure, or police report may be appropriate in some situations, but the correct combination depends on the event and jurisdiction.
- Recovery takes sequence and records. Repeating the story from memory can lead to omissions.
Evidence basis: The cited sources support the checks above. They do not replace current provider, property, workplace, authority, or local requirements. Federal Trade Commission: What To Know About Identity Theft and Federal Trade Commission: What To Do if You Were Scammed.
Evidence packet
A useful packet contains the timeline, copies of unauthorized statements, provider case numbers, and the exact contact channels used. It should not be emailed widely or stored in an unprotected shared folder.
Credit and reporting rules vary by jurisdiction
Fraud alerts, credit freezes, account closure, identity reports, and police reports have different uses and local rules. Follow the relevant institution and official recovery guidance for the evidence you actually have.