Identity theft: 7 legal tips and immediate actions to take

Call the three credit bureaus immediately and freeze your credit reports before identity thieves open new accounts in your name. This stops anyone from accessing your credit to apply for loans or credit cards, which limits the damage they can cause. Takes maybe 15 minutes total and it’s free.

Most people waste time calling banks or police first when the priority should be preventing additional fraud. Freezing credit doesn’t fix what already happened, but it stops thieves from racking up more debt while you’re dealing with the mess. You can always unfreeze temporarily when you need legitimate credit access.

After freezing credit, then file police reports and contact your banks about fraudulent transactions. But get that freeze in place first because every hour you wait is another opportunity for thieves to open accounts, destroy your credit score, and create problems you’ll spend years cleaning up.

As an attorney, I routinely assist clients to detect and mitigate instances of identity theft and the results thereof. I advise clients to act fast and treat your identity like a crime scene. Do not take the ostrich approach of burying your head in the sand and hoping it goes away.

I tell clients to freeze their credit immediately (same day) with all three bureaus, not just place a fraud alert. A fraud alert still allows new credit with extra steps, and thieves exploit weak verification. A freeze blocks most new-account openings, which stops the bleeding while you sort out what was compromised.

File a police report with your local law enforcement AND an online identity theft report with the Federal Trade Commission at identitytheft.gov before you start disputing. Both should be filed the same day the suspected identity

theft is discovered. Save the report number and affidavit.

Many banks, card issuers, and debt collectors demand this documentation before they will treat fraudulent accounts as identity theft instead of a customer dispute, and that difference controls timelines, chargeback posture, and whether the account stays on the credit file.

Expect the second wave and close the non-obvious doors.

I change email passwords, enable app-based multi-factor authentication, and lock down my mobile carrier account with a port-out PIN because criminals often pivot to SIM swaps and email takeovers after the first theft. I also pull bank account access logs, review Zelle (we are working on a major identity theft case involving Zelle right now because a client thought the texts she was receiving from Zelle showing large sums of money flowing out of her Bank of America account were phishing attempts and ignored them… resulting in a loss of over $400k) and ACH settings (we recommend activating a banking feature known as positive pay which blocks all payments except for those vendors on a pre-approved list and in defined amounts), file a report with ChexSystems, and remove saved payment methods from major merchant accounts.

Most identity theft is not accomplished by “hacking,” but rather by social engineering: using old school social techniques to exploit trust and empathy, usually coupled with fear, uncertainty, doubt, and urgency. My law firm has seen a sharp uptick in the use of AI (particularly when used against the elderly) to perpetuate theft and obtain banking and credit card numbers.

First, placing fraud alerts on your credit report is critical legal protection. A fraud alert requires lenders to verify your identity before opening new credit accounts. You gain legal standing to prevent that from happening for free when you put an alert on your credit report. Under the Fair Credit Reporting Act, you may request one free fraud alert. It will stay on your credit report for 1 year, after which you may request additional alerts. You need to contact your credit card companies and bank as soon as possible. Use the phone number on the bank statement and call them. Please don’t email or text them. Explain the situation and ask them to place fraud alerts on your accounts to monitor for suspicious activity. Many institutions can temporarily freeze your accounts to prevent additional unauthorized transactions while they complete their fraud reviews. Hours, not days, are the timeline you need to operate in to stop any currently active fraud.

Documentation is your friend throughout this process, and you need to document everything. Document every phone call and every email. Every single communication must be documented. You will have this documentation to provide to the FTC and/or law enforcement when you complete your report, and it will demonstrate your legal standing derived from prompt action. Putting your identity theft risks on a timeline to act quickly is your best defense, and it will help you prevent identity theft from digging in deeper.

The best advice for someone who is confronting an experience of being a victim of identity theft would be to treat it as a fraudulent use of their identification and not simply a customer service experience. The protections for consumers against identity theft provided by the Fair Credit Reporting Act and the Identity Theft and Assumption Deterrence Act are activated only when a consumer has formally documented a claim of identity theft. Informally reported identity theft through a phone call or by disputing with a representative of a bank or credit card company does not carry any legal significance and is more likely to lead to a temporary solution and not prevent the original unauthorized account from appearing again in the future.

Immediately upon discovering that a person is the victim of identity theft, they should go to the website of the Federal Trade Commission, www.IdentityTheft.gov, and complete the form for an Identity Theft Report prior to reaching out to any of the credit reporting bureaus or creditors. An FTC Identity Theft Report serves as an official sworn statement under federal law, and when filed correctly, it places an obligation on the credit reporting bureaus to block fraudulent accounts within four business days from the date of submitting the report to them and prohibits creditors from continuing collections on debts that have been reported as originating from identity theft.

When a person files an FTC report in the event that they are a victim of identity theft, they establish a written paper trail that legally can be utilized to escalate the problem if the individual credit reporting bureaus or lenders do not comply with their obligations under the law.

Act within 24 hours if possible. The faster you respond, the less damage an identity thief can do. Start by placing a fraud alert or freezing your credit with the three major credit bureaus. A freeze is stronger because it completely blocks access to your credit report until you lift it. Fraud alerts require creditors to verify your identity, but they don’t stop all access.

You’ll also need to file an identity theft report with the FTC through IdentityTheft.gov. The site generates a personalized recovery plan based on your situation. That plan includes step-by-step instructions and letters you can send to creditors, banks, and collection agencies. Having an official FTC report also strengthens your case if creditors question your claims.

Review your financial accounts and credit reports immediately. Look for charges, withdrawals, or new accounts you didn’t authorize. If you find fraudulent activity, report it to the financial institution right away. Most banks have specific fraud departments that handle these situations, and they’ll work with you to reverse charges and secure your accounts.

Don’t forget to file a police report. Some creditors won’t remove fraudulent charges without one, and having that report on file creates a legal record of the theft. It’s also worth keeping an eye on your mail and email for signs that someone’s trying to intercept sensitive documents or reset passwords on your accounts.

As a consumer protection lawyer, I can say with absolute confidence that one legal tip that gets overlooked by many identity theft victims is taking the proactive step to discuss your situation with a lawyer. Identity theft recovery can be tricky because it involves fighting fraud across multiple areas and under multiple laws. For instance, depending on the nature and extent of the fraud a consumer experiences, they may have legal protections under the Fair Credit Reporting Act, Electronic Funds Transfer Act, Fair Credit Billing Act, and Fair Debt Collection Practices Act. Some claims are time-barred and have to be dealt with rapidly, while other claims get lost in a system that is supposed to investigate and correct errors but frequently falls short. Consumer protection lawyers who practice in Identity Theft Recovery can help lay out a personalized recovery plan that takes all of these factors into account. And in most instances, consumers pay nothing upfront or out of pocket, so having a conversation with a lawyer is a smart move that helps ease the recovery process without adding to the stress.