iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A data-breach notice does not prove that someone has stolen your identity, but it is a reason to act. First identify what information was exposed and secure affected accounts. If you find unauthorized accounts, charges, or other misuse, report identity theft at IdentityTheft.gov, follow its recovery plan, and preserve the documents and contact records that support your case.
Start by identifying what the breach exposed
Read the notice closely and record the organization, the affected account or service, the incident date if given, when you received the notice, the categories of information involved, and any response deadline or offered service. A notice may concern a password, Social Security number, bank information, or another type of data; the right next steps depend on what was exposed. The FTC directs consumers who receive a notice to use IdentityTheft.gov’s data-breach guidance to choose actions for the exposed information.
Keep the original notice, including any envelope or email headers that help establish when it arrived. Save a copy somewhere secure and accessible if you later need to contact the company or dispute activity.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Secure affected accounts and watch for misuse
If a password was exposed
Change the password on the affected account promptly. Change it anywhere else you reused it, because a compromised password can put those accounts at risk too. Turn on multifactor authentication where available. The FTC also suggests using a password manager as an optional way to create and manage unique passwords; see its personal-information protection guidance.
#1 Best Overall
If financial access or credentials may be compromised
Contact the bank, card issuer, or other company through a phone number or website you independently verify, such as the one on an official statement. Ask what protective steps are appropriate for the affected account. Note the date, the department or representative if available, what you reported, and the response or action promised.
If identity information was exposed
Review your credit reports for unfamiliar accounts or other activity you do not recognize. IdentityTheft.gov advises victims to obtain reports from Equifax, Experian, and TransUnion and flag anything unfamiliar. You can also place a free initial fraud alert: one credit bureau can add it and must notify the other two. IdentityTheft.gov says the initial alert lasts one year. A breach notice alone does not establish that you need an identity-theft report, but these checks can help you spot misuse.
Report identity theft when you find actual misuse
If someone has used your information to open an account, make a purchase, or commit another fraud, report it to the FTC through IdentityTheft.gov. The site provides an Identity Theft Report and a personalized recovery plan. IdentityTheft.gov describes itself as “the federal government’s one-stop resource for identity theft victims.” Follow the plan for the type of fraud involved and contact each business where the misuse occurred.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsKeep a record of each report and contact: the date, company or agency, method of contact, any confirmation number, and what follow-up was requested. Save copies of letters and replies. If you choose to file a local police report, IdentityTheft.gov says to bring photo identification, proof of address, your FTC Identity Theft Report, and other evidence, and to ask for a copy of the police report.
Preserve evidence in an organized, secure record
Evidence is most useful when it shows what happened, when you noticed it, and what you did in response. Keep copies of relevant records rather than relying on notes about what they said.
- The original breach notice and any follow-up messages from the organization.
- Relevant account statements, credit-report entries, unfamiliar transactions, and correspondence about disputed activity.
- Your Identity Theft Report confirmation, recovery plan, and any police report.
- Letters to companies, their replies, delivery receipts, and any report or case numbers.
- A dated contact log recording who you contacted, how you reached them, what you requested, and the outcome or promised next step.
Store these records securely. Provide sensitive identity documents only when the company or agency needs them, and use its secure submission method.
Request records from a company involved in the fraud
If identity theft involved a particular business, you may request relevant identity-theft records from that company in writing. The FTC’s Fair Credit Reporting Act guidance and its April 14, 2022 explanation for identity-theft victims describe a request that includes proof of identity, a completed FTC Identity Theft Report, and a police report. The FTC says the company has 30 days to provide the records free of charge when the victim supplies the specified materials. Records may include transaction documents or applications; identify the incident and request the records relevant to it. Keep a copy of the request and proof of delivery. Because the cited FTC explanation is dated 2022, check the current FTC instructions before sending a request.
Free tools Windows power users keep installed
One-click scans. No signup required.
Know which reporting route applies
Consumers who received a notice should use IdentityTheft.gov’s breach guidance to decide what protective steps fit the exposed data. Consumers who find identity misuse should use IdentityTheft.gov’s reporting and recovery process. These are different from the FTC Health Breach Notification Rule form, which is for covered organizations reporting a breach of health information—not for consumers filing an identity-theft report.
For that organization-facing rule, the FTC says covered breaches affecting 500 or more people must be reported as soon as possible and no later than 60 days after discovery; for fewer than 500 people, it gives an annual reporting deadline. Those deadlines concern an organization’s obligations under that specific rule, not a consumer’s deadline to report identity theft.
Quick Recap
How the response differs if you have only a notice or confirmed misuse
| Situation | What to do | Records to keep |
|---|---|---|
| You received a breach notice but have not found misuse | Identify what data was exposed, secure affected accounts, and monitor accounts or credit information as appropriate to that data. | The notice, account-security changes, relevant statements or credit-report entries, and contacts with the organization. |
| You found unauthorized activity or identity use | Report it at IdentityTheft.gov, follow the recovery plan, contact businesses where fraud occurred, and consider a fraud alert or local police report as appropriate. | The FTC Identity Theft Report, dispute correspondence, statements, credit-report entries, police report if filed, and a dated contact log. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
