Identity Theft: The First Hour, the First Week, and the Paper Trail
By the Stoia team · September 7, 2026 · 6 min read
A text about a $2,400 purchase you did not make. A welcome letter for a card you never applied for. A tax return rejected because one was already filed under your number. Identity theft announces itself in small, odd ways, and the first hour after the announcement decides how much of the mess becomes yours to pay for. Everything after that is process, and process is easier with a list.
The first hour
- Freeze your credit at all three nationwide bureaus. A credit freeze stops new accounts from being opened in your name, it is free by law, and it takes effect immediately. If you cannot get through to one bureau, place a fraud alert at any of them; that bureau must notify the other two.
- Lock the account that was hit. Call the number on the back of the card or on a statement, never the number in the text or email that alerted you. Ask them to close or freeze the account and reissue credentials.
- Change credentials in the right order. Email first, because it is the reset key for everything else. Then the bank, the brokerage, the retirement plan, and the account with your phone carrier, where a PIN stops someone from moving your number to their device. Turn on two-factor authentication everywhere it is offered, preferring an app or a security key over text messages.
- File the official report. The federal government's identity theft reporting service, run by the Federal Trade Commission, produces a personalized recovery plan and an identity theft report that bureaus and lenders accept as proof. A police report is worth adding if a creditor asks for one or you know who did it.
Who pays for what, in words
For unauthorized credit card charges, federal law caps your liability at $50, and the card networks' own policies usually reduce it to zero. Debit cards and electronic transfers are different: your liability depends on how fast you report. Notify the bank within two business days of discovering the problem and you are capped at $50; wait up to 60 days after the statement showing the fraud and the cap rises to $500; after that the loss can be entirely yours. The bank must investigate, and it generally has to credit the money back provisionally within ten business days while it does. Ten days without your checking balance is a real gap, which is one more argument for a cushion sized with the emergency fund calculator and held somewhere a stolen debit card cannot reach.
One common confusion is worth clearing up here. FDIC insurance protects your deposits if the bank itself fails. It does not reimburse fraud; the transfer rules above do, and only if you report in time.
The account-by-account sweep
Thieves rarely stop at the account that tipped you off. In the first week, walk every account you hold, using the same inventory a net worth calculation needs. If you have never listed them all, the net worth calculator is a fast way to force the list: every bank, card, loan, brokerage, and retirement account, in one place.
| Account | What to look for | What to do |
|---|---|---|
| Checking and savings | Unknown transfers, new payees, changed contact details | Report within two business days, reset online access, add transaction alerts |
| Credit cards | Small test charges, new authorized users, address changes | Dispute each charge, request new card numbers |
| Brokerage and retirement | New linked bank accounts, withdrawal requests, changed beneficiaries | Remove unknown links, restrict withdrawals, add a verbal password |
| Loans and mortgages | Payments redirected, new loans you did not take | Confirm the payee, dispute unknown loans in writing |
| Phone carrier | SIM changes, new lines, call forwarding | Set an account PIN and a port-out lock |
| Government accounts | Tax, Social Security, unemployment, motor vehicle records | Create your own online accounts before a thief does; review activity |
| Health insurance | Explanations of benefits for care you never received | Report to the insurer; medical identity theft corrupts records, not just bills |
| Credit reports | Accounts, inquiries, or addresses you do not recognize | Dispute with the identity theft report attached |
Pull all three copies of your credit report at the end of the sweep, not the start, so that anything the thief opened in the last few days has had time to appear. Then pull them again a month later.
The paper trail
Recovery is a series of conversations with institutions that keep their own records, so keep yours. A single folder with a log of every call (date, time, who you spoke to, reference number), copies of every letter and dispute, certified mail receipts, the identity theft report, and each written result. Two legal rights depend on that folder. With an identity theft report, you can ask a bureau to block fraudulent items from your file, and it must do so within four business days of receiving the request. You can also demand from any business the records of the fraudulent transaction or application made in your name, which is how you learn what else the thief knew. Keep the folder for years; some consequences, like a collector chasing a debt that was never yours, surface long after.
Tax-related identity theft, in words
The usual sign is an electronically filed return bouncing because a return was already accepted under your Social Security number, or a notice about wages from an employer you never worked for. The recovery path runs through the IRS, not the bureaus: respond to any notice by the date on it, complete the identity theft affidavit the agency provides, and file your real return on paper with the affidavit attached. Expect the resolution to take months, and expect your refund to arrive only when it is done. Going forward, the IRS lets anyone opt into an identity protection PIN, a six-digit number issued each year that must accompany your return; with it in place, a return filed under your number without the PIN is rejected. Filing early closes the same window from the other side. And the agency initiates contact by mail, never by a call or text demanding payment or a PIN.
Prevention habits that hold up
- Keep the freeze on permanently and thaw for a few days only when you apply for something.
- One password per account, stored in a manager, with two-factor codes from an app or a hardware key rather than text messages.
- Transaction alerts on every account, set to a low threshold. Most theft is caught by the person who reads the alert, not by the institution.
- Read your credit reports on a schedule. They are free weekly by law, and a five-minute skim for unknown accounts is most of the job.
- Claim your own government accounts (tax, Social Security) and set the tax PIN before anyone else can.
- Opt out of prescreened credit offers, which a freeze does not stop and which are a favorite target of mail theft.
- Treat urgency as the tell. Real institutions do not need a decision in the next ten minutes.
An inventory problem first
Every step above starts from the same question: what accounts do I actually have, and what is in them right now? People who can answer that in one glance recover faster, because they notice the odd transaction the day it happens. Keeping the whole picture in one place is the quiet version of that readiness.