I've Been Hacked
Take a breath. You can fix this. Follow this action plan in order — the most critical steps come first. Everything here is free.
Day 1Do these right now
These are the most critical steps. Do them today.
Freeze your credit at all 3 bureaus — right now
This prevents anyone from opening new accounts in your name. It's free and instant online.
Credit freeze guide →Change your email password first
Your email is the master key to all your accounts. Change it, enable 2FA, and check for forwarding rules an attacker may have set up.
Change your banking and financial passwords
Banks, credit cards, investment accounts, PayPal, Venmo — anything with your money.
Enable two-factor authentication (2FA) everywhere
Use an authenticator app (Google Authenticator, Authy) — not SMS, which can be SIM-swapped.
Check your bank and credit card statements
Look for any transactions you don't recognize, no matter how small. Thieves often test with small charges first.
Week 1Do these within the next few days
These steps build your official paper trail and catch more damage.
File a report at IdentityTheft.gov
The FTC will generate a personalized recovery plan and an official Identity Theft Report you can use with creditors.
Go to IdentityTheft.govPlace a fraud alert with one credit bureau
Call Equifax (800-525-6285), Experian (888-397-3742), or TransUnion (800-680-7289). One call covers all three — they're required to notify each other.
File a police report
Some creditors and banks require a police report. File one with your local department — you can usually do this online.
Get your free credit reports
Check all 3 bureau reports for accounts or inquiries you don't recognize.
Free credit report guide →Request an IRS Identity Protection PIN
This prevents someone from filing a tax return in your name. Apply at IRS.gov.
Get an IRS IP PINContact your bank's fraud department
Report the compromise, ask about fraud monitoring, and request new account numbers if needed.
Month 1Follow-up and long-term protection
Lock down the rest and set up ongoing monitoring.
Opt out of major data brokers
Remove your personal information from people-search sites so it can't be used for future attacks.
Data broker directory →Check your credit reports again
New fraudulent accounts may take a few weeks to appear. Check all 3 bureaus again.
Review your Social Security statement
Check ssa.gov/myaccount for any suspicious activity or earnings reported under your SSN.
Go to SSA.govConsider a paid monitoring service
After the immediate crisis, ongoing monitoring can catch new attempts early.
Set up ongoing freeze management
Remember to temporarily lift your freeze when you need new credit, then re-freeze after.