Immediate steps to take within 24–72 hours

If a company you use confirms a data breach that exposed your personal information, act quickly. Speed matters because many forms of identity theft happen within days of exposure.

  1. Read the breach notice carefully. Note what data were exposed (e.g., Social Security number, credit card numbers, email, passwords) and follow any company-provided instructions. Keep copies of the notification for your records and any future disputes.

  2. Change passwords and enable two-factor authentication. For any account that used the same password as the breached service, choose a unique, strong passphrase and turn on two-factor authentication (2FA) where available. Use a password manager to generate and store secure passwords.

  3. Contact your bank and card issuers. If payment cards, bank account numbers, or online-banking credentials were leaked, call the financial institutions listed on your statements and ask them to monitor or reissue cards. Watch for unusual transactions and request provisional credits if fraud appears.

  4. Place a fraud alert or credit freeze. A fraud alert makes lenders verify your identity before opening new accounts. A credit freeze blocks new creditors from viewing your credit file, stopping most new-account fraud. Fraud alerts can be placed by contacting any one of the three nationwide credit bureaus; that bureau must notify the other two. Credit freezes must be placed separately with Equifax, Experian, and TransUnion. Freezes are free under federal law. For more on the difference and when to use each option, see our guide on Understanding Credit Freezes, Fraud Alerts, and Identity Locks.

  5. Monitor your credit reports and accounts. Request your free credit reports from AnnualCreditReport.com and review them for unfamiliar accounts, addresses, or hard inquiries. Consider enrolling in credit monitoring if the breach included SSNs or other highly sensitive data. Read our breakdown of Credit Monitoring Services: What They Do and When to Use One before choosing a plan.

  6. If your Social Security number was exposed, consider an Identity Theft Report. File a report at IdentityTheft.gov (FTC). That portal walks you through creating an Identity Theft Affidavit and an individualized recovery plan, which helps when disputing fraudulent accounts and working with creditors.

A prioritized 30‑day action plan (detailed)

Week 1 — Contain and document:

  • Make a list of all communications from the breached company and the dates you received them.
  • Put fraud alerts or credit freezes in place (see details below).
  • Change passwords, PINs, and security questions on financial and email accounts.
  • Set account alerts for transactions and enable text/email notifications.

Week 2 — Verify and dispute:

  • Pull your credit reports from AnnualCreditReport.com and look for unknown accounts, names, or addresses.
  • If you find errors, file disputes with the reporting bureau and the creditor. Our guide on How to Dispute Errors on Financial Accounts and Credit Reports explains the documentation to collect and the steps to take.
  • If you’re missing mail or suspect mail-forwarding fraud, check with the U.S. Postal Service.

Week 3 and beyond — recover and harden:

  • If identity theft already occurred, use the FTC’s IdentityTheft.gov to build your recovery plan and obtain an Identity Theft Affidavit.
  • Consider placing an IRS Identity Protection PIN (IP PIN) if tax-related information (like your SSN) was exposed. The IRS issues IP PINs to confirmed victims and through an opt-in program to help prevent fraudulent tax filings.
  • Regularly check and keep records of all communications with credit bureaus, banks, and collection agencies.

How to place a fraud alert vs. a credit freeze (practical steps)

  • Fraud alert: Contact any one of the three credit bureaus (Equifax, Experian, or TransUnion) to request an initial fraud alert (typically one year). The bureau you contact is required to notify the other two. If you’re a confirmed identity-theft victim, you can request an extended fraud alert that lasts seven years.

  • Credit freeze: To freeze your file you must contact Equifax, Experian, and TransUnion individually (online, by phone, or by mail). Freezes are free and remain in place until you lift them. You’ll be given a PIN or password to unfreeze temporarily for creditors or for a specified time.

For step-by-step instructions and timing considerations, see our article Understanding Credit Freezes, Fraud Alerts, and Identity Locks.

Monitoring and identity-protection tools — are they worth it?

Credit monitoring services can give earlier alerts for suspicious activity, but they do not prevent fraud by themselves. They are useful when the breach exposed sensitive data like SSNs. Before subscribing, compare coverage, alerts, and identity-theft remediation services (some plans include insurance and direct help dealing with restoration). See our Credit Monitoring Services: What They Do and When to Use One for a side-by-side look.

Consumer advice:

  • Use trusted services and read the fine print about identity-theft insurance and remediation. Some free monitoring products provide useful alerts but limited remediation help. Paid services may offer concierge recovery that saves time when fraud occurs.

What to do if fraud already appears on your credit reports

  1. Freeze your credit and document the fraudulent accounts.
  2. File a dispute with each credit bureau reporting the fraudulent account. Include copies of proof (police reports, FTC Identity Theft Affidavit, or creditor statements) when possible.
  3. Contact the creditor reporting the fraud. Ask them to close the fraudulent account and send you written confirmation.
  4. Send a fraud alert to the bureaus and consider filing a local police report if the theft involved financial loss.
  5. Use IdentityTheft.gov to generate official dispute letters and an Identity Theft Affidavit. This streamlines communications with creditors and bureaus.

Our How to Dispute Errors on Financial Accounts and Credit Reports guide walks through sample letters, the documentation you should attach, and timelines to expect from bureaus and creditors.

Real-world lessons from practice

  • Quick detection prevents much of the damage: In one case a client got an alert within 72 hours showing two hard inquiries after a retailer breach. By placing a freeze and disputing the inquiries, the client stopped new-account fraud before a loan was approved.

  • Don’t ignore tax-related anomalies: Another client could not electronically file taxes because the IRS had a prior filing under their SSN. We contacted the IRS and used their identity-protection process (including an IP PIN) to resolve the claim. If you see unexpected IRS notices or tax-return rejections, act immediately—tax fraud often signals wider identity misuse.

Common mistakes to avoid

  • Waiting to act until you see fraudulent charges. Fraud can begin with new accounts and missed bills that later become collection accounts.
  • Using the same passwords across multiple sites. A breached password is a master key for many accounts.
  • Assuming a free credit-monitoring offer from the breached company is sufficient. These offers can be helpful but usually work best when paired with proactive freezes and monitoring.

What recovery typically costs and how long it takes

There is no single timeline. Minor disputes can be resolved in weeks; complex identity theft—with new loans or tax fraud—can take months. Financial costs vary: credit freezes and fraud alerts are free, many banks will refund unauthorized charges, and some identity-recovery services are paid. Keep records of all losses, communications, and receipts for possible reimbursement or tax treatment.

Useful authoritative resources

Internal resources (read next)

Final checklist (print or save)

  • [ ] Save the breach notice and all company communications
  • [ ] Change passwords and enable 2FA on email and financial accounts
  • [ ] Place fraud alerts and/or freeze your credit files
  • [ ] Pull and review credit reports from AnnualCreditReport.com
  • [ ] Contact banks and card issuers to report exposure
  • [ ] If identity theft occurred, file an IdentityTheft.gov report and consider local police documentation
  • [ ] Track all steps, dates, and confirmations in a secure file

Professional disclaimer
This article is educational and not a substitute for personalized legal, tax, or financial advice. In my practice, I’ve helped dozens of clients through breach-related identity issues—if you face complex or ongoing fraud, consult a qualified attorney, tax professional, or your financial institution for tailored help.