Identity Theft: The First Steps Anywhere in the World

Identity theft can announce itself through the post rather than a security alert: a bill for a phone contract nobody in the house signed, or a letter from a debt collector about money nobody borrowed. The UK police’s Report Fraud service says the first you know of it may be exactly that kind of paperwork.¹

Wherever you live, the answer to what to do if your identity is stolen follows the same outline. Official guidance from Australia, Canada, New Zealand, the US and the UK agrees on the core: stop the money, tell the authorities, lock down your credit file and logins, and keep a paper trail. In order:

1. Call your bank and card providers
2. Report it to the police and your national fraud service
3. Freeze, ban or flag your credit file
4. Change key passwords and sign out everywhere
5. Keep a record of every call, letter and reference number
6. Watch your statements and credit reports for months

Do the first two today, even if the rest waits a few days: they protect your money and give you the reference number everyone else will ask for. If what happened is a single online account taken over, rather than your details used to get something in your name, start with the recovery order in the digital safety basics guide instead.

Identity theft means someone gets things in your name

Identity theft is when someone gets hold of your personal details, and identity fraud is when they use those details to get money, credit, goods or services by pretending to be you. Report Fraud draws the line that way: stealing the details is not yet fraud, using them is.¹

The uses are varied. Report Fraud lists opening bank accounts, getting credit cards, loans and state benefits, taking out phone contracts, taking over existing accounts, and obtaining genuine passports or driving licences in the victim’s name.¹ Australia’s privacy regulator, the Office of the Australian Information Commissioner (OAIC), adds that a thief who has only a few details can fill the gaps from public sources such as social media posts showing your birthday or your family.²

It works because banks, phone companies and many government agencies check who you are against a handful of facts: your name, date of birth and address. Anyone holding those facts can pass a basic check. Picture a stolen parcel with your address on the label, a birthday post on a public profile and a photo of a driving licence sent to a fake landlord. None of it looks dangerous on its own; together, it can be enough to apply for a loan.

The study

Strong evidence

What thieves did with stolen details: Australia's national survey

The Australian Bureau of Statistics estimates that about 1 in 100 Australians aged 15 and over experienced identity theft in the 2024-25 financial year. The most common use of the stolen details, reported by about a third of victims, was taking money from a bank account, retirement savings or investments. Others reported a fraudulent tax return, a loan or credit card, or new accounts such as phone and utilities opened in their name.³

In Australia’s official survey, the most common use of a stolen identity was taking money from bank, retirement or investment accounts, not opening new credit. That shapes the order of the steps below: the bank comes before the credit file. The survey covers one country, and people reported their own experiences, so read it as a picture of how identity theft plays out rather than a measure of your risk.

The pattern differs by country. America’s Federal Trade Commission (FTC) received about 1.1 million identity theft reports in 2024, with misuse of an existing or new credit card the most reported type.⁴ Those are complaints people chose to file, not a survey, so they show what gets reported rather than how common each type is.

The signs to watch for

The FTC’s list of warning signs is short: bills you don’t recognize, charges you didn’t make, withdrawals you didn’t make, accounts on your credit report you didn’t open, and bills that stop arriving, which can mean someone changed your billing address.⁵

Myth

A paid credit monitoring service will warn me about any identity theft.

Fact

The US FTC says credit monitoring won't alert you when money leaves your bank account or when someone files a tax return in your name.

Monitoring watches your credit file, and the FTC adds that most identity monitoring services also miss fake claims for benefits such as unemployment or Social Security in the US.⁵ So give a missing bill, a debt collector’s call or an unexpected letter from a tax or benefits office the same attention as a strange charge on your card.

What to do if your identity is stolen: the first week and after

Official guides broadly agree on an order for recovery: protect money first, create an official record second, then close the doors a thief could use next. Most of the steps apply wherever you live; where a tool exists in only some countries, the step says so. We found no study comparing recovery steps or their order, so this sequence rests on agreement between official bodies in five countries, not on trials.

1. First hourCall the bank and card providers
2. First dayReport it and note the reference number
3. First weekLock or flag your credit file, change passwords
4. Next monthsKeep checking statements and credit reports

1. Call your bank and card providers

Your bank is the first call because it can stop payments and cancel cards before more money leaves. Report Fraud advises asking the bank to hold pending transactions and to explain its claims process if money was taken.¹

Speed can also affect refunds. New Zealand’s government warns that if you don’t tell your card issuer about a lost or stolen card straight away, it may not be able to refund your losses; once the card is reported, the provider will usually cancel it and issue a new one. Use the number printed on your card or the bank’s official app, never a number from a message about the problem. If a loan or account you don’t recognize appears, contact that lender too and tell it you don’t recognize the debt.⁶

2. Report it to the police and your national fraud service

A police or fraud-service report creates the official record that banks, lenders and credit bureaus often ask for later. Australia’s OAIC recommends reporting to police and asking for a police report or reference number as evidence that you reported.²

Many countries split the job in two. Canada is a clear example: its national Anti-Fraud Centre (CAFC) wants victims to call in their local police, who investigate, and also to send the centre a report of their own, since it gathers reports that can link crimes together.⁷ The country table further down lists the routes in six countries.

3. Freeze, ban or flag your credit file

Your credit filecredit report: A record of how a person has borrowed and repaid, kept by a credit bureau (credit reference agency): accounts, balances, payment history and some public records. Lenders read it when deciding whether to lend, and in many countries you can check your own for free.Full entry in the glossary is the record lenders read before they lend, and in several countries you can lock or flag it so a thief cannot easily open new credit in your name. The tool, its cost and how long it lasts differ from country to country, and the details below are as of September 2026.

• In the US, the Federal Trade Commission explains that a credit freeze stops anyone, including you, from opening new credit until you lift it; it is free and lasts until you remove it. A fraud alert instead asks lenders to check it is you, and an initial alert lasts one year.⁸
• In Australia, the OAIC says you can ask the credit reporting bodies for a free ban period of 21 days, which can be extended if fraud is likely.⁹
• In the UK, the fraud-prevention body Cifas sells Protective Registration (£30 for two years, as of September 2026), a marker that asks member lenders to run extra checks.¹⁰ Report Fraud also describes a free Notice of Correction password that lenders must ask for before lending.¹

A lock on your credit file covers new credit, not everything else. For tax and benefits, contact the agency itself: Canada’s privacy commissioner suggests calling the Canada Revenue Agency to ask for extra security on your account.¹¹ If your country has no freeze, ask the credit bureaus what they offer and check your file more often. What a lender reads in that file is set out in how credit scores and credit reports work.

4. Change key passwords and sign out everywhere

Stolen identities and hijacked logins often travel together, so the OAIC advises signing out of your accounts on all devices, which logs the intruder out too, then signing back in on a safe device and changing your passphrases.²

Start with email, because a reset link for most other accounts lands there. Giving every account its own new password, rather than one new password shared across all of them, is far easier with a password manager you trust.

5. Keep a record of every call, letter and reference number

Identity theft recovery is often paperwork spread over weeks, and a written record is what lets you prove what happened. Canada’s privacy commissioner advises keeping records of recent transactions and of what you have done to deal with the theft.¹¹

A plain notebook or a single document works. For each contact, note the date, the organization, the person you spoke to, what they agreed and any reference number, and keep copies of letters. If a lender asks for proof weeks later, the record is ready.

6. Watch your statements and credit reports for months

Stolen details don’t always get used at once, and the OAIC warns that criminals may not take advantage of your personal information straight away.² Keep reading bank and card statements line by line, and check your credit report for applications you did not make. If you find one, report it to the credit bureau and the lender, and add it to your record.

Your first week after identity theft

• Call my bank and card providers from the number on the card
• Report to the police and my national fraud service
• Write down every reference number
• Freeze, ban or flag my credit file where available
• Tell the tax or benefits agency if it may be involved
• Change my email password first, then my bank and other key logins
• Sign out of my accounts on all devices
• Set a monthly reminder to check statements and my credit report

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

Official identity theft services in six countries

Each country has its own reporting route and its own tools for protecting a credit file, because policing and credit reporting are largely organized country by country. The table lists official or officially recommended services, as of September 2026. Names and phone numbers change, so confirm a detail on the service’s own website before relying on it.

If your country isn’t listed, look for three things on official government websites: the police or national service that takes fraud reports, the credit bureaus that hold your file, and any free victim-support service. Search in plain words, such as “report identity theft” plus your country’s name, and prefer results on a government website over ads. Your bank’s fraud team may also be able to point you to them.

When to get more help

The steps above handle the money and the paperwork; a dispute over a debt, court papers or an official record needs someone who knows your country’s rules. Rules on disputed debts and court papers differ by country, so your bank, the police or a legal adviser in your country can tell you what applies to your case.

• Now: if anyone threatens you or you feel unsafe, get help through your local emergency number; the paperwork can wait. If money is leaving your accounts, ring your bank’s fraud line straight away. If the worry becomes overwhelming or you have thoughts of harming yourself, contact your local emergency number or a crisis line in your country.
• Soon: if a debt collector, court or fines office contacts you about something you didn’t do, don’t ignore it. New Zealand’s government advises asking the lender to put the account on hold and investigate, and going to the court with identification if you receive notice of proceedings you knew nothing about.⁶
• Routine: if the problems drag on, ask a free victim-support or advice service for help. In the UK, Report Fraud lists support organizations such as Citizens Advice and Victim Support.¹² A legal adviser can help if a lender or agency won’t accept that a debt isn’t yours.

The bottom line

Call your bank first, then report the theft and keep the reference number. After that, lock or flag your credit file where your country allows it, change your email password, write down every contact and keep checking statements for months.