Finding out that someone is using your name, your Social Security number, or your accounts is stressful. The good news is that the most important steps are free, and most of them take minutes. The order matters: lock down the accounts a thief can use to reach everything else, then stop new damage, then clean up.
Here is the checklist we walk people through.
In the first hour
- Secure your email first. Your email account is the master key: password resets for your bank, phone carrier, and shopping accounts all go there. Change the password, sign out of all other sessions, and turn on 2-step verification with an authenticator app rather than text messages.
- Call your bank and card issuers. Use the number on the back of your card, not one from an email or text. Report any charges you don’t recognize and ask them to lock or replace the affected cards.
- Change passwords on financial accounts. Give every account its own password. A password manager makes this realistic.
- Start a written log. Note dates, amounts, account numbers, and the name of everyone you speak with. You will need this later.
In the first 24 hours
- Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion each offer a free credit freeze. A freeze stops anyone from opening new credit in your name. You can lift it temporarily when you apply for a loan or card yourself.
- Add a fraud alert. An initial fraud alert lasts one year and tells lenders to verify your identity before opening an account. You only need to contact one bureau; it notifies the other two.
- Report it at IdentityTheft.gov. The Federal Trade Commission’s site creates an official Identity Theft Report and a personalized recovery plan you can follow step by step.
- File a police report if you need one. Some creditors ask for it. Bring your FTC report and your log.
In the first week
- Pull your credit reports. AnnualCreditReport.com gives free reports from all three bureaus. Look for accounts, inquiries, or addresses you don’t recognize, and dispute anything that isn’t yours.
- Protect your tax return. Request an Identity Protection PIN at IRS.gov. It blocks anyone else from filing a tax return using your Social Security number.
- Lock your phone number. Ask your mobile carrier to add a port-out PIN or number lock. This makes it much harder for a thief to move your number to their phone and intercept your security codes.
- Watch for follow-up scams. Victims often get calls or texts from people posing as a bank’s “fraud department.” A real institution will never ask you to read back a security code or move money to a “safe” account. Hang up and call the number you already trust.
Signs your identity may be in use
- Bills, collection calls, or credit approvals for accounts you never opened
- Password-reset or new-sign-in emails you didn’t trigger
- Your phone suddenly losing service (a possible SIM swap)
- A tax return rejected because one was already filed in your name
- Mail that stops arriving, or statements that go missing
When to get help
Working through all of this alone means hours on hold while you are already stressed. Cyber Vault USA classifies identity theft as a P1 incident, our highest priority. For Overwatch members and employees covered by QRF, an assigned specialist engages within one hour and stays on your case: walking you through the recovery steps above, helping you document what happened, and providing legal referral support for identity cases that need professional counsel. All support is delivered remotely.
Not a member yet? Contact us to talk through your options.
This article is general information, not legal or financial advice. Cyber Vault USA is not an insurance company. Overwatch and QRF are service subscriptions providing cybersecurity assistance, IT support, and identity restoration services; we do not issue insurance policies, pay claims, reimburse financial losses, or indemnify members against damages. QRF is a reactive support service and does not include monitoring of any kind. Service levels are response commitments, not resolution guarantees. Cyber Vault USA is not law enforcement or a 911 service. If you are in immediate physical danger, call 911.