Identity theft recovery: IdentityTheft.gov, credit freeze and IP PIN
Step-by-step identity theft recovery in the US: the FTC IdentityTheft.gov plan, 1- and 7-year fraud alerts, free credit freezes and the IRS IP PIN.
When a criminal gets your Social Security number, new cards, loans or even tax returns can appear in your name. The main defenses in the US are official and free. In 2025 the FTC received about 3 million fraud reports and $15.9 billion in reported losses, according to its March 2026 congressional testimony.
Why start with IdentityTheft.gov?
Reporting at IdentityTheft.gov (or 1-877-438-4338) produces an Identity Theft Report and a personal recovery plan. The FTC recovery guide warns that if you do not create an account you must print and save both right away. The report is usually enough for credit bureaus and most companies; a police report is needed only if you have suspect information or a company requires one.
Fraud alert or credit freeze?
| Tool | Lasts | How |
|---|---|---|
| Initial fraud alert | 1 year, renewable | Contact one bureau; it notifies the other two |
| Extended fraud alert | 7 years | Requires an Identity Theft Report or police report |
| Credit freeze | Until you lift it | Place it separately at Equifax, Experian and TransUnion |
All are free, and a freeze does not affect your credit score, per the FTC. Anyone can freeze, and parents can freeze credit for children under 16. Lift the freeze only at the bureau a lender uses, then reinstate it.
How do I stop tax identity theft?
The IRS Identity Protection PIN is a six-digit number that stops others from filing with your SSN or ITIN. Anyone who can verify their identity can get one through an IRS online account; it is valid for one calendar year and changes annually. If a return was already filed in your name, use Form 14039.
What else belongs in the plan?
- Check free reports at annualcreditreport.com and dispute unknown accounts in writing.
- Review your earnings record at ssa.gov/myaccount.
- Report a lost debit card within 2 business days to cap losses at $50.
- Write to debt collectors within 30 days.
In Brazil the equivalent tools are Registrato and BC Protege+; see our guide. Related: fake IRS/SSA agent scams, synthetic identity fraud and record US fraud losses.
Do I need a police report?
Usually not. The FTC says the Identity Theft Report is generally enough for credit bureaus and most companies. A police report is needed if you have information about the suspect or a company specifically asks for one; bring the FTC report, a photo ID and proof of address. Bureaus must block fraudulent information when you send a request with your Identity Theft Report and proof of identity.
What to do now
- Report at IdentityTheft.gov and save the report and plan.
- Freeze your credit at Equifax, Experian and TransUnion.
- Get an IP PIN through your IRS online account.
- Check your free reports and dispute anything you do not recognize.
- Change passwords and turn on MFA for email and banking.
来源
- FTC – Identity Theft: A Recovery Plan
- FTC Consumer Advice – What To Know About Credit Freezes and Fraud Alerts
- IRS – Get an Identity Protection PIN
- FTC – FTC Testifies before the Joint Economic Committee (25/03/2026)