LIFE · BMC FIELD MANUAL
Identity Theft Recovery Case File: Contain, Report, Dispute and Close
Identity theft creates several problems at once: access, money, credit, taxes, records and deadlines. One controlled case file keeps the facts straight while each institution handles its own piece.
The useful answer
- Separate exposed information from confirmed misuse; the response and the evidence required are not identical.
- Secure the email and phone accounts that can reset everything else, then contact affected institutions through independently verified channels.
- Use IdentityTheft.gov for a personalized recovery plan and FTC Identity Theft Report when personal information has actually been misused.
- Place a freeze with each nationwide credit bureau when appropriate; a fraud alert and a freeze are different controls.
- Track every case number, deadline, file, call and written result until each disputed item is corrected or formally escalated.
Open one case file and preserve the first facts
Start a private record that does not live only inside the potentially compromised email or cloud account. Record when and how you learned of the problem, exactly what was observed, which identifiers may be exposed, every affected account and the actions already taken. Save notices, statements, credit-report pages, headers, envelopes, screenshots and transaction details in their original form when practical. Do not forward sensitive material widely or place complete Social Security, bank or card numbers into casual notes; use last four digits and a protected evidence index.
Do not decide too early that every strange message proves identity theft. A lost wallet, a breach notice, a password alert, an unauthorized card charge, a new account and a tax return filed in your name are different events. FTC and Social Security guidance distinguish exposed information from actual misuse. Mark each item as exposure, attempted access, confirmed account takeover, confirmed transaction, new-account fraud, benefits or tax misuse, or still unexplained. That classification controls the next call without pretending you know who did it.
- Discovery date, source and exact observation: ________
- Information exposed versus information demonstrably misused: ________
- Accounts, agencies and reports implicated: ________
- Protected evidence location and backup owner: ________
Contain access through trusted contact routes
If an account is being used, contact the institution promptly through the number on the physical card, a statement, the authenticated app or a web address you type independently. Do not use a phone number or link inside the alert that created the concern until you verify it. Ask what the institution can lock, replace or reverse; what evidence it needs; whether linked accounts or recurring payments are affected; and how it will confirm the result in writing. Record the representative, time, case number and exact promised next step.
Secure the email account, mobile account and password manager that can reset other services. From a device you reasonably trust, change reused or exposed passwords to unique credentials, review recovery addresses and phone numbers, revoke unknown sessions or devices, preserve needed evidence and enable the strongest supported multifactor method. A password change alone does not correct a fraudulent account or transaction. Follow each financial institution's dispute procedure, and use a qualified incident-response professional if a device, business system or large set of credentials may be compromised.
- Primary email, mobile carrier and password manager reviewed: ________
- Affected institution reached through independently verified route: ________
- Locks, replacements, disputes and recurring-payment effects: ________
- Case number, representative, promised document and deadline: ________
Build the official recovery plan for the actual misuse
When someone has used your personal information, report the facts at IdentityTheft.gov. The Federal Trade Commission service creates a personal recovery plan and an FTC Identity Theft Report based on the details supplied. Save the report, recovery plan and update credentials securely. The report can support rights and requests with businesses, but it does not replace the separate dispute, affidavit or police-report process an institution or circumstance may require. Give accurate facts; do not guess at an offender, loss or date.
If information was merely lost, stolen or exposed but there is no evidence of misuse, FTC and SSA materials direct consumers to protective steps rather than treating the event as confirmed identity theft. Monitor the relevant accounts and credit reports, preserve the breach or loss notice, and use the official plan for the kind of information involved. File a police report when required by the institution, insurer, local law, safety circumstances or recovery plan, and call emergency services for immediate danger. Keep report numbers and copies; never pay a caller who claims a government report requires a fee.
- IdentityTheft.gov report and recovery-plan reference: ________
- Police or specialized agency report, if required: ________
- Facts supplied, supporting documents and amendments: ________
- Next official-plan action and due date: ________
Control credit, deposit accounts and collection noise
A credit freeze restricts access to a credit report and is free to place and lift, but it must be placed with each of the three nationwide credit bureaus. A fraud alert tells businesses to verify identity before new credit and can be initiated through one bureau, which must notify the other two. These controls do not repair an existing fraudulent account, stop every non-credit use of personal information or replace account monitoring. Use the site's credit-freeze guide to record each bureau's official route, confirmation and lift method without storing unnecessary secrets in the worksheet.
Get credit reports through the official AnnualCreditReport.com route linked by the FTC and mark every unfamiliar inquiry, address and account. Dispute incorrect information with the relevant bureau and information furnisher using their current procedures, evidence and delivery method; keep complete copies and dates. Review bank and card statements, checks, payment apps and deposit-account notices separately because not every loss appears on a credit report. If a collector contacts you about an identity-theft debt, request and review validation information before paying or sharing more data, and preserve the collection timeline.
- Equifax, Experian and TransUnion freeze status and confirmations: ________
- Fraud-alert type, initiating bureau and expiration: ________
- Credit-report items disputed, recipients and delivery proof: ________
- Deposit, card, payment-app and collection cases still open: ________
Check tax, Social Security, benefits and identity accounts
Identity misuse can cross systems. Review the appropriate IRS, Social Security and benefits accounts through official government addresses you type yourself. The IRS Identity Protection PIN is a six-digit number known to the taxpayer and IRS that helps prevent another person from filing a federal return with that Social Security number or ITIN. It changes annually and must be handled as a sensitive filing credential. Use the current IRS eligibility and retrieval process; do not confuse an IP PIN with a commercial credit-monitoring code or share it with an unsolicited caller.
SSA directs people whose Social Security number was used for accounts or purchases to IdentityTheft.gov and provides separate routes for benefit fraud and account security. Check address, direct-deposit and benefit details when relevant, and preserve official notices. Do not seek a replacement Social Security number as a routine first step; SSA describes that as a limited measure after continuing misuse despite efforts to fix the problems. Add unemployment, health-insurance, driver's-license or passport agencies only when the evidence or official recovery plan makes them relevant.
- IRS Online Account and IP PIN action, if relevant: ________
- Social Security account, benefits or direct-deposit review: ________
- State benefits, license, passport or medical identity issue: ________
- Qualified tax, legal or agency help requested: ________
Run the deadline board and close only in writing
Create one row per problem with the institution, account suffix, issue, money involved, notice date, report or dispute sent, delivery proof, response deadline, current owner and escalation route. Calendar every promised callback and statutory or institution deadline; do not rely on a crowded inbox. Keep notes factual and distinguish what the institution said from what you inferred. When an address or phone number changes, verify it from the institution's official site rather than copying an old checklist.
Close a row only when the account is secured or closed as intended, money is credited or the decision is documented, credit reporting is corrected where applicable, replacement credentials work, and a final letter or statement is saved. Recheck credit reports and affected accounts after the stated update period. If an institution denies relief, record the reason and use the complaint, regulator, ombudsman, counsel or appeal route appropriate to that product and jurisdiction. Recovery is finished when the record proves the correction—not when the phone call felt reassuring.
- Open-item owner, next action and hard deadline: ________
- Written decision, corrected statement or closure proof received: ________
- Follow-up credit and account review date: ________
- Case-file retention, secure disposal and final review: ________
Frequently asked questions
Should I report a data breach as identity theft?
Not automatically. Exposure and actual misuse are different. Preserve the notice, follow the official protective steps for the information involved, and use IdentityTheft.gov when someone has actually used your identity or the site directs you to a specific report.
Is a fraud alert the same as a credit freeze?
No. A fraud alert tells businesses to verify identity before new credit and can be initiated through one nationwide bureau. A freeze restricts access to a credit report and must be placed with each bureau.
Does changing my password fix identity theft?
It may help contain account access, but it does not reverse transactions, remove fraudulent accounts, correct credit reports or complete official reports and disputes.
Should I get an IRS IP PIN?
An IP PIN can help prevent another person from filing a federal tax return with your SSN or ITIN. Review current IRS guidance and the consequences of enrollment, protect the annual PIN, and consult a tax professional for your situation.
Sources and further reading
Claims checked against these official or professional sources on October 19, 2026.
- Federal Trade Commission — What To Know About Identity TheftPrimary federal consumer guidance on warning signs, reports, credit freezes, account review and recovery.
- FTC — IdentityTheft.govOfficial federal reporting service that creates an FTC Identity Theft Report and a personalized recovery plan.
- FTC — Credit Freezes and Fraud AlertsCurrent explanation of each control, who contacts which bureaus, duration and cost.
- Internal Revenue Service — Get an Identity Protection PINCurrent federal guidance on the purpose, eligibility, annual use and protection of an IRS IP PIN.
- Social Security Administration — Fraud Prevention and ReportingOfficial routes for Social Security number misuse, benefit fraud, scams and IdentityTheft.gov recovery.
- FTC — Debt Collection FAQsFederal consumer guidance for validating and disputing debts, including accounts that may not belong to the consumer.