What to do if your identity is stolen: Essential steps to take immediately

How does identity theft happen?

Identity theft typically happens through one of these methods:

• Social engineering. Social engineering is a scam technique that encompasses attacks such as phishing, smishing (SMS phishing), or vishing (voice phishing). Using social engineering attacks, scammers manipulate victims into divulging private information through deceptive conversations or interactions.
• Phishing. Phishing is arguably the most common social engineering tactic that scammers use to perform identity theft. During phishing attacks, malicious actors trick victims into revealing personal information through fake emails, websites, or messages.
• Data breaches. Data breaches refer to incidents during which victims’ data gets exposed to outsiders. While often caused by human error, data breaches can also occur due to hackers accessing sensitive information from organizations or companies. Malicious actors may use brute-force attacks, malware, or social engineering tactics to breach a company's cybersecurity and use breached data to perform identity theft.
• Public Wi-Fi interception. This cyber risk is also known as a man-in-the-middle attack and occurs when cybercriminals intercept data transmitted over unsecured public Wi-Fi networks. That allows malicious actors to steal personal information and potentially use it for identity theft.
• Mail theft. While more rare than other identity theft techniques, mail theft is a recurring threat, where criminals steal personal mail, including bank statements or credit card offers, to gather private details.

It’s important to mention that, along with identity theft, users can also experience synthetic identity theft — a type of fraud that combines stolen information (for example, Social Security number) with fake personal details (such as name, birthdate, or home address). However, in this article, we’ll focus on the traditional case of identity theft and the steps necessary to avoid or mitigate the damage.

What to do if your identity is stolen 

If you’re wondering what to do if your identity is stolen, the answer is to act quickly. Upon suspicion of identity theft, it’s crucial to inform all the authorities — from the Federal Trade Commission (FTC) to your bank — and freeze your bank account before scammers can steal all your money. Here’s a detailed breakdown of everything you must do when experiencing identity theft.

Change passwords

Changing compromised passwords (along with reporting the crime to the authorities) is the first crucial step to take when suspecting identity theft. It can help you prevent account takeover and regain control of your online accounts. Change the password of your email, financial accounts, and any government service portals like SSA.gov if applicable. Never use the same password for different online services!

Freeze or close the accounts 

Once you secure your online accounts, contacting your bank to report suspected fraud and freezing your account is the next crucial step. Though it’s likely the bank will contact you first (upon noticing suspicious activity in your account), calling your bank as soon as you suspect identity theft may prevent you from suffering financial loss altogether.

To report suspicious account activity to your bank, either call the bank’s customer service number or report the incident via the bank's official website. Some banks may also have a hotline dedicated to reporting cases of identity theft. 

File a report to the Federal Trade Commission

If you're a US citizen, notify the FTC about identity theft right after securing your accounts. The FTC will create a report that helps dispute fraudulent charges, remove incorrect info from your credit report, and provide evidence of the crime to creditors and institutions. In addition, the FTC can offer assistance in recovering lost funds and filing police reports. To report identity theft to the FTC, visit IdentityTheft.gov to file a report and receive a personalized recovery plan.

If you’re not a US citizen, you should report identity theft to the FTC equivalent in your country. For Australians, that can be done using the Australian Competition and Consumer Commission’s (ACCC) ScamWatch platform, while Canadians should contact the Canadian Anti-Fraud Centre (CAFC). UK citizens should report identity theft to Action Fraud, while EU residents should seek help from the local police’s cybercrime unit.

Place a fraud alert on a credit report 

Placing a fraud alert on a credit report is a smart step when someone steals your identity. Doing so will alert creditors, in case malicious actors have already begun to apply for loans or withdraw funds using your bank account. With your alert, the creditors can then take extra steps before opening new accounts, preventing fraudulent accounts from appearing and damaging your credit score. To place a fraud alert, contact Equifax, TransUnion, or other reputable credit monitoring agencies in your country.

Report to the local police department

If you’re a US citizen, reporting identity theft to your local police may not be mandatory. However, if you live outside the US and your local police office has a cybercrime division, it’s best to contact it as soon as possible. Doing so may provide you with further guidance and steps on what to do to recover at least some of the lost assets. To report identity theft to your local police department, contact its non-emergency line or visit its website to file a report.

Recover your identity 

Recovering your identity may be the most difficult and time-consuming step to take. It may require you to dispute fraudulent charges, replace compromised Social Security cards, monitor and keep detailed records, and even seek legal assistance. Naturally, the process can drag out for months or even years, but with enough patience, you should be able to recover your identity. It’s also painfully evident that going through such a process will cause additional effort and stress. That’s why, as an alternative, we recommend that you consider investing in an identity theft protection service, such as NordProtect. 

NordProtect subscription offers an identity theft recovery feature, which provides up to $1 million in reimbursement for identity theft victims and up to $10,000 in online fraud coverage (available to those who suffered identity theft while already subscribed to the service). In addition, the service includes intuitive features designed to protect your identity and limit the damage in case of identity theft. From dark web monitoring to immediate malware breach alerts, NordProtect keeps a vigilant eye over your sensitive data, notifying you about any unwanted snoopers.

What to do if your identity is stolen in a foreign country

If your identity gets stolen while you’re in a foreign country, contacting the local authorities will not be enough. Here’s what you should do to recover your identity when abroad.

What to do if your identity is stolen in the United States

If your identity gets stolen while you’re in the United States, first change the compromised credentials. Then contact your bank and freeze your account. After you’ve done that, consider reporting the crime to local authorities or contact your embassy (or consulate) for further steps. If you’re an American citizen who lives in the US, you can also use NordProtect to try and recover your identity (provided you’ve subscribed to the service before suffering identity theft).

What to do if your identity is stolen in Australia

In case you suffered identity theft while in Australia, change the compromised passwords, freeze your bank account, and contact your embassy immediately. Reporting the crime to the local authorities may also be a good idea. For additional information, you can refer to the Australian Cyber Security Centre.

What to do if your identity is stolen in the United Kingdom

To those who became victims of identity theft while in the UK, securing compromised accounts, notifying local authorities, and contacting your embassy is crucial. Along with police, reporting the crime to Action Fraud and the Information Commissioner’s Office (ICO) could prove useful too. Finally, you shouldn’t forget to freeze your bank accounts so that malicious actors wouldn’t get the chance to withdraw your funds, take loans, or otherwise cause you financial damage.

What to do if your identity is stolen in Canada

If your identity gets stolen while you’re in Canada, the process remains the same as usual — secure your online accounts, notify local authorities, freeze your bank accounts, and contact your embassy if necessary. Along with local Canadian authorities, you might consider notifying CAFC and the Office of the Privacy Commissioner of Canada (OPC).

What to do if your identity is stolen in South Africa

If you suffer identity theft while in South Africa, you should contact local authorities and your embassy, change compromised credentials, and freeze your bank accounts (if you suspect, malicious actors may have access to them). Notifying the South African Fraud Prevention Service (SAFPS) is also a good idea and can help you get additional support in recovering your stolen identity.

How to protect yourself from identity theft

To protect yourself from identity theft, consider using these tips:

• Sign up for credit monitoring. A credit monitoring service will send alerts about any suspicious activity on your credit report, such as unauthorized new accounts or changes to your credit score. So you’ll have a heads up if someone tries to steal money using your identity.
• Enable two-factor authentication (2FA). Using 2FA for all sensitive accounts (email, banking, social media) adds an extra layer of protection and notifies you when someone’s trying to access your online accounts. It’s important to stress that you should never approve a suspicious 2FA request, especially if you didn’t try to sign in, complete the purchase, or otherwise trigger a 2FA pop-up.
• Never reuse passwords. Reusing passwords increases the risk of losing accounts in case of a phishing attack. Malicious actors are likely to try the same email and password to access your other online accounts to maximise the damage of the attack. So be sure to create strong, unique passwords and consider using a password manager to store and generate secure passwords.
• Closely monitor your bank and credit card statements. Regularly reviewing your bank and credit card statements is a healthy habit to have. It helps avoid suffering huge losses in case of identity theft, so make sure to check for any unauthorized transactions and immediately report any suspicious activity to your bank or card issuer.
• Place fraud alerts or credit freezes. Consider placing a fraud alert or a credit freeze on your credit file with the major credit bureaus. A fraud alert notifies lenders to take extra steps to verify your identity, while a credit freeze prevents anyone from accessing your credit report.
• Be careful when using public Wi-Fi. Public Wi-Fi can be a haven for malicious actors who look to intercept users’ online traffic. Avoid accessing sensitive accounts (like online banking) over public Wi-Fi networks. In addition, use a VPN to encrypt your internet connection and safeguard yourself online.
• Protect your Social Security number (SSN). Keep your SSN card in a safe place and avoid sharing your SSN unless absolutely necessary. Be extremely cautious of unsolicited requests for your SSN, especially via email or phone, and always independently verify the legitimacy of the request with the organization before providing it. Additionally, make sure to learn what to do if someone has your Social Security number.
• Be cautious of phishing scams. Be wary of unsolicited emails, messages, or phone calls asking for personal information. Always verify the source before clicking on links or sharing sensitive data.
• Review your credit report regularly. Request a free copy of your credit report from the three major credit bureaus (in the US — Experian, Equifax, or TransUnion). Each bureau offers one annual credit report, which means you can get up to three reports per year, if you choose so (via annualcreditreport.com website). When you get your report, check for any inaccuracies or signs of fraud and learn how you can spot identity theft by looking at the personal section of your credit report.
• Use NordProtect. Consider investing in additional identity theft protection services, such as NordProtect. They can offer you assistance in identity theft recovery and additional measures to monitor your sensitive data. If you use NordProtect, you can also enjoy features such as dark web monitoring and actionable security alerts, designed to inform you and offer assistance as soon as breached data appears online.