# If someone is using your identity, take it one step at a time. If something already happened · 04 · 9 min read Identity misuse can involve several accounts, providers, and reporting systems. Start with anything still active, then build a record and work through the official process for each part. This page helps you - Stop anything still happening first - Keep one record of every report and call - Understand freezes, fraud alerts, and locks This is general guidance drawn from official sources. The provider involved, or the official body where you live, decides what happens in your case. If you are in immediate danger, contact your local emergency services. ## The order that keeps the case manageable Stop anything still moving. Then give every report a place in the same record. **The order, in three moves** 1. Stop: Contact any account or provider where activity is still happening. Especially one that can move money or reset another account. 2. Record: Record each report, date, decision, deadline, and reference number. 3. Connect: Keep every report in the same record. Check each new notice against it. Providers may use separate processes. Your log is the thread that connects them. ## Build your recovery plan Choose what happened and build a plan you can print. Set your region and tick what applies. The result starts with active accounts and provider contact, then moves to records, disputes, and follow-up. Confirm the current route with the organization or authority named in each step. Your choices stay in this browser, and printing uses your browser's print dialog. ### What applies to you? #### My existing accounts were accessed or changed - Use the service’s official site or app to regain the account, replace the sign-in credential, and log out other sessions. - Remove recovery details, forwarding rules, connected apps, or payment details you do not recognize. Ask the provider for a record of the changes if it offers one. - Secure the email account and phone number that can reset this account. Use the strongest second factor the service supports. - Review recent activity and statements, then keep the provider’s case number and written outcome in your recovery log. #### My phone number, mail, address, or utilities were changed or used - Contact the carrier, postal service, or utility through a channel you find independently. Ask it to reverse changes you did not make and secure the account. - If your phone lost service unexpectedly, ask the carrier whether your SIM or number was transferred. Restore the number before using it to recover other accounts. - Ask the relevant provider to cancel any unfamiliar mail forwarding, service, or address change and send you the history or written outcome it can provide. - Check the accounts that use that phone number or address for recovery, billing, or delivery. Record each correction and reference number. #### New accounts or loans were opened in my name - Contact each lender’s fraud department and tell them the account is not yours; ask them to close it and stop collection. - United States: Dispute each account with the lender and follow the IdentityTheft.gov plan for asking the credit bureaus to block or correct the entry. - United Kingdom: Dispute each account with the lender and ask each credit-reference agency showing it how to correct the entry. - EU: Dispute each account with the lender and ask the relevant credit-reporting body how to correct any entry. - Elsewhere: Dispute each account with the lender in writing, and ask the relevant credit-reporting body which notice or correction process is available. - Ask for written confirmation of the provider’s decision and next steps, then keep it with the rest of the record. #### An identity document was lost, stolen, or used - Report each passport, driver’s license, identity card, or residence document through the issuing authority’s current lost-or-stolen process. Ask how cancellation and replacement work. - If the document was used with a company or government service, contact that organization through its official channel and ask it to close or correct the record. - Ask the issuer or affected provider whether a separate police or identity-theft report is part of its process, then keep the report and reference number. - Do not send a copy of the replacement document in response to an unexpected message. Return through the official case channel you already recorded. #### It involves tax, benefits, or a government service - United States: Follow the current IRS or benefits-agency identity-theft instructions for the type of misuse involved. - United Kingdom: Use the current HMRC or benefits-service route for reporting activity you did not authorize. - EU: Contact your national tax or benefits authority and ask for its identity-misuse process. - Elsewhere: Contact your national tax or benefits office and ask about their identity-theft process. - Use the contact details on the authority’s official site or a notice you independently confirmed. Dispute any return, claim, payment, or account that is not yours. - Ask what protection it can add to the record, such as a PIN or identity notice, and what that protection does. - Keep every reference number and follow the authority’s stated status or appeal process. #### Employment or payroll records show work I did not do - United States: Contact the employer named in the record. If a tax form or Social Security earnings record shows wages that are not yours, follow the current IRS and Social Security instructions for correcting it. - United Kingdom: Contact the employer named in the record, then use the current HMRC or National Insurance route for wages or employment that are not yours. - EU: Ask the employer named in the record and your national tax or social-insurance authority how to dispute wages or employment that are not yours. - Elsewhere: Ask the employer named in the record and the relevant tax or social-insurance authority how to dispute wages or employment that are not yours. - Ask each organization how to correct the employment, wage, tax, or contribution record and how it will confirm the change in writing. - Check related tax, benefit, and social-insurance notices for income or claims that flowed from the same employment record. - Keep the unfamiliar employer name, reporting period, case numbers, and corrected records together. Do not contact a person using details from an unexpected message. #### It involves medical care or insurance - Ask each provider and insurer for the relevant medical, billing, and claims records. Mark each entry that is not yours in writing. - Ask each provider or insurer which correction process applies and how it will confirm the outcome. - Check explanation-of-benefits statements for treatment you did not receive, and keep both the original and corrected records. #### A police, court, or background record may belong to someone else - Contact the police, court, or justice agency named in the record through an official directory. Ask how to get the case identifier and challenge a mistaken identity. - If an employer, landlord, or other organization used a background report, ask which reporting company and source supplied it. Use each company’s formal dispute route. - If the record could affect an arrest, court deadline, immigration matter, job, or housing, consider qualified local legal help before sending documents or making a statement. #### A child’s identity is being used - If you are the child’s parent or guardian, contact each provider using the child’s information and ask it to close or correct the record. - United States: Use the child identity-theft plan at IdentityTheft.gov. The FTC says that for a child under 16, a parent or guardian can ask each nationwide credit bureau to search for a file and can request a free child credit freeze. - United Kingdom: Ask each affected provider and the UK credit-reference agencies which child identity-misuse process is available and what proof a parent or guardian must provide. - EU: Ask each affected provider and the relevant credit-reporting or consumer-protection body which child identity-misuse process is available and what proof a parent or guardian must provide. - Elsewhere: Ask each affected provider and the relevant credit-reporting or consumer-protection body which child identity-misuse process is available and what proof a parent or guardian must provide. - Contact only the school, health plan, tax office, benefits authority, or other organization connected to the unfamiliar activity. Ask what proof of guardianship it requires before sending anything. - Keep the child’s report, provider decisions, and follow-up dates in a separate private record. #### A late relative’s identity is being used - If you are authorized to act for the estate, contact each affected provider and ask for its process for identity misuse involving someone who has died. - Ask exactly what proof of authority and death it needs, and which official upload or postal route to use, before sending documents. - Ask the relevant credit-reporting body or public authority whether it accepts a deceased notice or identity-misuse report where the person lived. - Keep copies of provider decisions and reference numbers with the estate records, and continue checking statements for new activity. ### Region #### Identity theft · United States Illustrative. Agencies, freezes and reporting routes vary by country; confirm the current details in the United States. - Consider a credit freeze or fraud alert, which the FTC says are free. IdentityTheft.gov explains the differences and the current bureau contacts. - Use IdentityTheft.gov to create an FTC Identity Theft Report and recovery plan. File a police report if a provider or the plan asks for one. This plan draws on official guidance, but it is not the only route. Some of the places that can help: [IdentityTheft.gov report and recovery plan](https://www.identitytheft.gov/) · [FTC medical identity-theft guidance](https://consumer.ftc.gov/articles/what-know-about-medical-identity-theft) · [FTC child identity-theft guidance](https://consumer.ftc.gov/articles/how-protect-your-child-identity-theft). The organization named in each step can also confirm the current route for your situation. #### Identity theft · United Kingdom Illustrative. Agencies, freezes and reporting routes vary by country; confirm the current details in the United Kingdom. - Consider Cifas Protective Registration, a paid service that asks member organizations to make extra identity checks on applications in your name. Ask each credit-reference agency to correct any entry that is not yours. - Report it to Report Fraud if you live in England, Wales, or Northern Ireland, or to Police Scotland on 101 in Scotland. Keep any reference number. This plan draws on official guidance, but it is not the only route. Some of the places that can help: [Report Fraud, in England, Wales, and Northern Ireland](https://www.reportfraud.police.uk/) · [Cifas Protective Registration](https://www.cifas.org.uk/pr) · [UK government identity-theft guidance](https://stopthinkfraud.campaign.gov.uk/recovery-from-fraud/recovering-losses/what-to-do-if-your-identity-has-been-stolen/). The organization named in each step can also confirm the current route for your situation. #### Identity theft · EU Illustrative. Agencies, freezes and reporting routes vary by country; confirm the current details in the EU. - Ask your bank and the relevant credit-reporting or consumer-protection body which protective notice or restriction is available where you live. - Report it to local police or your national consumer-protection body, and keep any reference number. This plan draws on official guidance, but it is not the only route. Some of the places that can help: [National data-protection authorities, for incorrect personal data](https://www.edpb.europa.eu/about-edpb/our-members_en). The organization named in each step can also confirm the current route for your situation. #### Identity theft · Elsewhere Illustrative. Agencies, freezes and reporting routes vary by country; confirm the current details where you live. - Ask your bank and any national credit-reporting body which protective notice, restriction, or monitoring step is available. - Use your national police, cybercrime, or consumer-protection reporting route, and keep any reference number. This plan draws on official guidance, but it is not the only route. Some of the places that can help: [IDCARE, in Australia and New Zealand](https://www.idcare.org/) · [ReportCyber, in Australia](https://www.cyber.gov.au/report-and-recover/report). The organization named in each step can also confirm the current route for your situation. Reviewed July 2026. Official sources are listed with each region’s steps. ## Freeze, fraud alert, or lock? Three terms you may see around a credit file. Availability, cost, legal effect, and duration vary by country and provider. Ask the relevant credit-reporting body what each option changes before choosing one. - **Freeze:** Limits access to a credit file for new applications until you lift or remove it. Availability, cost, and exceptions vary by country. - **Fraud alert:** Adds a notice asking a prospective lender to take extra identity-checking steps where this option exists. Duration and placement vary. - **Lock:** A bureau or provider may sell an account control called a lock. It is not necessarily the legal equivalent of a statutory credit freeze. [How a freeze works, and living with one](https://explained.withpersona.com/your-identity-online/freezing-credit) ## Build the record while details are fresh Use the same eight fields every time you contact an organization. A reference number without the decision is hard to use later. Record what you reported, what the organization asked for, what it promised, and the next date as one entry. The blank template copies into notes or a document and stays on your device. 1. Organization and official channel used 2. Date, time, and person or team 3. Case or reference number 4. What you reported 5. What the organization asked you to send 6. Decision or action it promised 7. Next deadline 8. Date to follow up The template stays on your device. This page receives no entries. ## What you may keep seeing, and for how long Provider updates and new notices may arrive after the first reports. A closed account, corrected record, and investigation can each follow a different schedule. Check every new notice against the reference number and official contact channel you already saved. - Collection letter: A collection letter for an account you disputed. Use the collector’s formal dispute process, include the relevant reference, and keep a copy. - Credit file: An entry that remains on a credit file after a correction request. Follow the credit-reporting body’s status and escalation process. - New notice: A new attempt or provider notice. Add it to the record and ask the provider whether it changes any existing freeze, alert, or investigation. - Evidence request: A request for more evidence. Confirm it through the provider’s official channel before sending identity documents or account details. --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/identity-stolen_