Identity Theft: The First 48 Hours, Step by Step

The tell is almost never dramatic. A credit card you never applied for shows up in the mail. A collection notice names a wireless carrier you've never used. Your tax return bounces because one was already filed under your Social Security number. Somewhere in the past few weeks, someone started being you on paper, and the first you hear about it is a piece of routine correspondence.

What happens next is unusually well-defined for a money problem. The federal government publishes an actual recovery plan, in order, and several of its steps start legal clocks — deadlines a bank, a credit bureau, or a store has to meet, plus one or two you have to meet yourself or you lose protections you'd otherwise have. Here's the first 48 hours with the clock attached to each move.

Hour one: the accounts that are already bleeding

The FTC's recovery plan opens with the least glamorous step — calling the companies where you already know fraud happened and asking them to close or freeze those accounts. It goes first because the money protections in this area run on timers that started without telling you, and one of them is brutal.

Credit cards are the forgiving case. Under the Fair Credit Billing Act, the most you can be held responsible for on unauthorized charges is $50, and most issuers waive even that as a matter of policy. Debit cards are a different legal universe, because the money is already gone from your account while the argument happens.

Once you notify the bank, the clock flips to their side. Under Regulation E, the bank generally has 10 business days to investigate. If it needs longer, it has to put the disputed money back provisionally within those same 10 business days, and can then take up to 45 days total — stretching to 90 for point-of-sale transactions, transfers that started outside the US, and accounts opened within the previous 30 days. All of that assumes unauthorized activity, meaning someone moved money without you. A payment you were talked into sending yourself sits under much narrower rules, which is why the Zelle and wire cases end so differently.

Hour two: an alert and a freeze are not the same tool

People use these words interchangeably and then wonder why nothing happened. They do genuinely different work.

Hours three and four: read your own file, then make it official

Before you can tell anyone what's fraudulent, you have to see it. All three reports are free every week at AnnualCreditReport.com — the only site authorized under federal law, and permanently weekly since October 2023. You're reading for four things: accounts you never opened, hard inquiries you didn't cause, addresses that aren't yours, and employers you've never worked for. That last one is the quiet tell for someone using your Social Security number to get hired. If the report-versus-score distinction is fuzzy, they're separate products entirely — and it's the report you fix.

Then comes the step that converts a bad morning into enforceable rights. Reporting at IdentityTheft.gov, the FTC's official recovery site, produces a personal recovery plan, pre-filled letters to send to bureaus and businesses, and — the important part — your FTC Identity Theft Report.

That document is what activates three specific federal entitlements. Send it to the bureaus with proof of identity and a letter naming the fraudulent items, and they must block those items within four business days, a deadline the CFPB states plainly in its guidance on what to do if you're an identity theft victim. It also qualifies you for an extended fraud alert: seven years instead of one, two free copies of your file from each bureau within the following 12 months, and five years off the prescreened-offer mailing lists. And it lets you demand, in writing, the actual application the thief filled out — the company has 30 days to hand over those records free of charge.

A police report is a separate thing, and the FTC's own recovery plan says to file one only in two situations: you have information about a suspect, or a specific company requires one for its dispute process. For most people, the FTC report is the document that does the work.

Day two: the versions no credit report will ever show

Credit fraud is the loud kind. Three quieter kinds live entirely outside your credit file.

Tax. If your return is rejected as a duplicate, or you get an IRS notice about wages from an employer you've never heard of, that's tax-related identity theft, and Form 14039 (the Identity Theft Affidavit) is the entry point. One trap worth knowing: if the IRS wrote to you first — Letter 5071C, 4883C, or 5747C — you don't file Form 14039 at all. The IRS already caught it, and following the letter's instructions is the whole job. Separately, the IRS issues a six-digit Identity Protection PIN that has to appear on your return for it to be accepted; per the IRS page on getting an IP PIN, it's open to anyone with a Social Security number or ITIN who can verify their identity, and a new one is issued each year.

Social Security. The SSA doesn't investigate identity theft and doesn't hand out new numbers as a remedy — it points you to IdentityTheft.gov. What it does give you is the earnings record inside your my Social Security account, and that's where employment fraud surfaces as wages you never earned. Since your future benefit is calculated from that record, a wrong year in it is worth correcting long before you need it.

Medical. Someone using your insurance leaves a trail in your explanation-of-benefits statements and in the provider's own file. The same 30-day records right applies to hospitals and clinics — requesting the file is how you find out which treatments got written into a medical history that's now partly fiction.

Worked example: Priya's $1,112 and two very different clocks

Tuesday, 7:40 a.m. Priya's bank texts about a declined $60 purchase in a state she's never visited. She checks the app: three ATM withdrawals over the weekend — $400, $400, and $312. Total, $1,112.

She calls at 8:05, within two business days of learning about it, so her federal exposure caps at $50 — and the bank's own zero-liability policy takes it to nothing. The investigation runs past 10 business days, so the bank provisionally credits the full $1,112 on day nine and finishes on day 31. Had those statements sat unopened for two months, the $500 tier would have passed and the no-cap tier begun, and the same $1,112 would have been entirely hers.

That afternoon she pulls all three reports. Two items she doesn't recognize: a store card opened August 3 with a $1,840 balance, and a hard inquiry from an auto lender. She files at IdentityTheft.gov that night, freezes all three bureaus, and mails each one the FTC report plus a letter naming the two items — blocked within four business days. Then she sends the store card issuer a written request for the application. Thirty days later it arrives: a delivery address two states away, and an email one character off from hers. That single sheet is what ends every follow-up argument about whose account it was.

What 48 hours can't finish

The bottom line

Identity theft feels like a violation, and it is one, but the recovery is mostly clerical: four calls, one online report, three letters, and a calendar. The design of the system is that a single sworn document — the one you make at IdentityTheft.gov — converts your account of what happened into deadlines other people have to meet. What it can't do is reach backwards. The debit-card clock is the only one that runs out on you, which is why the boring habit of opening bank statements the week they arrive turns out to be the most valuable protection on this entire page.