Secure accounts, create an official recovery plan, and document every recovery step.
Identity Theft Recovery
What you will learn
- Respond to immediate risks
- Use IdentityTheft.gov
- Organize reports and records
- Monitor and escalate
Who this is for
People who suspect or have confirmed misuse of personal information.
This course does not include
A determination that identity theft occurred, forensic investigation, or legal representation.
What to gather
- Secure device
- Incident chronology
- Account alerts and statements
- Protected recovery folder
Module 1
Contain immediate risk
1.1Secure accounts and devicesReduce continuing access before completing paperwork.
Do this first, then next
- Use a trusted device.
- Change compromised credentials and enable multi-factor authentication.
- Contact financial institutions through official channels.
What to look for
- Unknown sessions
- Changed recovery details
- Unauthorized transactions
Document: Account security checklist
Avoid: Do not reuse passwords or click security links in unexpected messages.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: Why use a trusted device?
A compromised device could expose new credentials.
Authoritative sourcesFTC — IdentityTheft.gov ↗
1.2Understand alerts and security freezesCompare tools that can reduce new-account risk.
Do this first, then next
- Read the FTC and reporting-company instructions.
- Choose the tool appropriate to your situation.
- Store PINs or confirmations securely.
What to look for
- Scope
- Duration
- Lifting process
Document: Protection-options comparison
Avoid: Do not lose freeze credentials or publish them in notes.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: Are a fraud alert and freeze identical?
No; they operate differently and have different management steps.
Authoritative sourcesFTC — IdentityTheft.gov ↗CFPB — Credit reports and scores ↗
Module 2
Create the official plan
2.1Use IdentityTheft.govCreate a recovery plan tailored to the reported misuse.
Do this first, then next
- Go directly to IdentityTheft.gov.
- Complete only accurate information.
- Save the plan and report securely.
What to look for
- Assigned steps
- Documents to send
- Follow-up actions
Document: Recovery-plan tracker
Avoid: Never make an identity-theft report for an ordinary accuracy disagreement.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: Why must every statement be accurate?
The report is an official record and false claims can cause serious harm.
Authoritative sourcesFTC — IdentityTheft.gov ↗
2.2Build an incident chronologyConnect alerts, transactions, reports, calls, and actions in time order.
Do this first, then next
- Record the earliest known event.
- Add each contact and action.
- Link supporting evidence.
What to look for
- Unknown gaps
- Reference numbers
- Deadlines
Document: Incident chronology
Avoid: Do not backfill uncertain dates as exact facts.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: How should an uncertain date be recorded?
Label it approximate and explain the source.
Authoritative sourcesFTC — IdentityTheft.gov ↗
Module 3
Correct and recover
3.1Contact affected organizationsUse official fraud channels and document each response.
Do this first, then next
- Verify the organization’s fraud contact.
- Follow its documentation instructions.
- Save confirmations and correspondence.
What to look for
- Case number
- Temporary actions
- Required follow-up
Document: Organization contact log
Avoid: Do not send full identity documents by ordinary email unless expressly secured and required.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: What should be saved from each contact?
The channel, date, representative, case number, instructions, and confirmation.
Authoritative sourcesFTC — IdentityTheft.gov ↗
3.2Review consumer reports for misuseLook across nationwide and relevant specialty reports for unfamiliar activity.
Do this first, then next
- Obtain current reports.
- Mark unfamiliar inquiries and accounts.
- Use the reporting company’s identity-theft process.
What to look for
- New accounts
- Addresses
- Hard inquiries
Document: Identity-theft report review
Avoid: An unfamiliar item requires investigation; do not automatically label it fraud.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: Why check specialty reports?
Misuse may appear in banking, tenant, employment, insurance, or other reporting systems.
Authoritative sourcesFTC — IdentityTheft.gov ↗CFPB — Consumer reporting company list ↗
Module 4
Monitor and escalate
4.1Track recovery over timeConfirm that promised actions occurred and watch for new activity.
Do this first, then next
- Calendar follow-ups.
- Obtain updated records when appropriate.
- Keep closure letters.
What to look for
- Repeated activity
- Reopened accounts
- Unresolved balances
Document: Recovery monitoring calendar
Avoid: Do not discard records immediately after an account is closed.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: Why keep closure records?
They document the outcome if the issue reappears.
Authoritative sourcesFTC — IdentityTheft.gov ↗
4.2Know when to seek legal or law-enforcement helpEscalate threats, lawsuits, persistent misuse, or complex losses responsibly.
Do this first, then next
- Preserve the full file.
- Use official local and federal reporting channels.
- Consult a qualified attorney for legal advice.
What to look for
- Court papers
- Threats
- Large or continuing losses
Document: Professional-help readiness list
Avoid: Do not confront a suspected person or put yourself at risk.
If the expected result does not occur: preserve the record, verify the official process, and seek qualified help when rights, deadlines, or significant harm may be involved.
Knowledge check: When should safety override documentation steps?
Whenever there is a threat or immediate risk; contact appropriate authorities.
Authoritative sourcesFTC — IdentityTheft.gov ↗
Educational completion
Review, reflect, and choose the next responsible step.
Complete the knowledge checks, download or print your worksheets, and preserve only the records you need. A future completion certificate will document educational participation; it will not be a license or professional credential.