What to Do If Your Identity Is Stolen and Your Accounts Are Drained

Identity theft is the most common consumer fraud in the United States. The FTC received 6.5 million consumer reports through the Consumer Sentinel Network in 2024, with identity theft representing a major category. The most damaging form is when thieves drain your bank accounts, open credit in your name, and file tax returns using your Social Security number.

The 2026 Trends in Identity Report from the Identity Theft Resource Center reveals an alarming shift. More than 1 in 4 individuals (25.6%) who contacted the ITRC were dealing with two or more identity incidents, up from 23.5% the prior year. For the first time, unauthorized access to a computer or mobile device surpassed scams as the leading compromise method for adults between 35 and 64. Device access now accounts for 27.2% of all identity compromises, a 78% increase from the prior year.

The financial damage can be devastating, but federal law provides protections that most people do not know about. If you report a lost or stolen ATM or debit card before unauthorized transactions occur, you owe $0. If you report within 2 business days of learning of the loss, liability is capped at $50. If you report after 2 business days but within 60 days of the statement, liability is capped at $500. If you wait more than 60 days, you face unlimited liability for all unauthorized transfers. For credit cards, liability is capped at $50 if you report after unauthorized use, and $0 if you report before use.

The key is speed. Every hour you delay reporting increases your potential liability. The FTC provides a step-by-step recovery plan at IdentityTheft.gov that generates a personalized plan based on what happened to you. If you are searching for what to do if your identity is stolen and your accounts are drained, this guide covers the immediate response, federal liability limits, the credit freeze and fraud alert process, the FTC report, dealing with banks and creditors, and long-term protection.

The First 24 Hours

Step 1: Call the companies where fraud occurred

Call the fraud department of each affected bank or credit card company. Explain that someone stole your identity. Ask them to close or freeze the accounts. Change logins, passwords, and PINs for all accounts. The FTC identity theft recovery guide confirms this is the first step.

Step 2: Place a fraud alert and get your credit reports

Contact one of the three credit bureaus (Experian, TransUnion, Equifax). That bureau must notify the other two. A fraud alert lasts 1 year and requires businesses to verify your identity before opening new accounts. Get your free credit reports from all 3 bureaus at AnnualCreditReport.com. Review for accounts you do not recognize.

Step 3: Report to the FTC

Go to IdentityTheft.gov. Enter details about what happened. The system creates an Identity Theft Report and a personalized recovery plan. The Identity Theft Report guarantees certain rights, including the right to block fraudulent information from your credit report.

Step 4: File a police report

Go to your local police department with your FTC Identity Theft Report, ID, and proof of address. The police report strengthens your case when disputing fraudulent accounts and enables a 7-year extended fraud alert.

Federal Liability Limits

ATM and debit card liability (Regulation E)

• Report before unauthorized transfers: $0 liability
• Report within 2 business days of learning of loss or theft: max $50
• Report after 2 business days but within 60 days of statement: max $500
• Report after 60 days of statement: unlimited liability for all subsequent transfers

See the Federal Reserve Regulation E for the full liability framework.

Credit card liability (Truth in Lending Act)

• Report before unauthorized use: $0
• Report after unauthorized use: max $50
• Account number used but card not lost: $0 if you report within 60 days of statement

The critical difference

Debit card fraud means money leaves your account immediately. You are fighting to get your money back. Credit card fraud means the thief borrowed on your account. You are disputing a charge, not recovering lost cash. This is why credit cards are safer for online transactions. Your money is never at risk. The FTC guide on lost or stolen cards explains this distinction.

Credit Freeze vs Fraud Alert

Credit freeze (strongest protection)

A credit freeze restricts access to your credit report. No one can open new credit accounts while frozen. It is free to place and lift (federal law since 2018). You must place it with each bureau individually: Experian, TransUnion, Equifax. It does not affect your credit score. You can temporarily lift the freeze when applying for credit. For step-by-step instructions, read our guide on how to freeze your credit.

Fraud alert (lighter protection)

A fraud alert requires businesses to verify your identity before opening new accounts. A 1-year initial alert or 7-year extended alert (with a police report) is available. Place it with one bureau and they notify the other two. Less restrictive than a freeze. You can still open accounts.

Dealing with Banks and Creditors

Disputing fraudulent charges

Call the fraud department of each affected account. Follow up in writing within 60 days, which is required for electronic fund transfer disputes. Include the account number, date and time you noticed the fraud, and when you first reported it. Keep copies of all letters and notes from phone calls.

Closing fraudulent accounts

Call the fraud department of each business where an account was opened in your name. Ask them to close the account and send a letter confirming: the account is not yours, you are not liable, and it was removed from your credit report. Keep this letter in case the account reappears on your credit report.

Blocking fraudulent information from credit reports

Write to each of the three credit bureaus. Include a copy of your Identity Theft Report and proof of identity. Explain which information is fraudulent and ask them to block it. Once blocked, the information will not show on your report and companies cannot collect the debt from you.

Long-Term Protection

Preventive measures

• Place a permanent credit freeze at all 3 bureaus (lift only when applying for credit)
• Use multi-factor authentication on all financial accounts
• Use strong, unique passwords for each account (use a password manager)
• Monitor bank and credit card statements weekly
• Check credit reports annually at AnnualCreditReport.com
• Shred documents with personal information
• Do not carry your Social Security card

Tax-related identity theft

If someone files a tax return using your SSN, file Form 14039 (Identity Theft Affidavit) with the IRS. The IRS will issue an Identity Protection PIN (IP PIN) for future returns. The IP PIN is a 6-digit number required on all future tax returns. It prevents anyone else from filing with your SSN.

Identity Theft Response: Credit Freeze vs Fraud Alert

Three Real Identity Theft Scenarios

Example 1: $4,200 in unauthorized debit card transactions

A 35-year-old discovers $4,200 in unauthorized debit card transactions. She notices the transactions on a Tuesday morning and reports to her bank that same day, within 2 business days of the transactions appearing on her statement.

Under Regulation E, her liability is capped at $50. The bank provisionally credits $4,150 within 10 business days while investigating. The investigation confirms fraud. The $4,150 becomes permanent. She closes the compromised account, opens a new one, and places a credit freeze at all 3 bureaus.

Total loss: $50. Total time to resolve: approximately 2 weeks.

The lesson: speed matters. Reporting within 2 business days caps liability at $50. Waiting until the following month would have capped liability at $500. Waiting more than 60 days from the statement date would have meant unlimited liability. For securing your financial accounts, read our guide on how to set up automatic investing.

Example 2: $12,000 in fraudulent credit card accounts

A 42-year-old discovers someone opened 3 credit cards in his name, charging $12,000. He had not checked his credit report in 3 years. He discovers the fraud when he applies for a mortgage and is denied.

Steps taken: (1) Calls the 3 credit card companies' fraud departments. Closes all 3 accounts. Requests confirmation letters. (2) Places a fraud alert with Experian (notifies TransUnion and Equifax). (3) Files a report at IdentityTheft.gov. Gets his Identity Theft Report and recovery plan. (4) Files a police report with his FTC report and ID. (5) Writes to all 3 credit bureaus with his Identity Theft Report, asking them to block the fraudulent accounts. (6) Places a credit freeze at all 3 bureaus.

Outcome: the fraudulent accounts are blocked from his credit report within 30 days. The $12,000 in charges is not his liability. Credit card liability is capped at $50 per card, and he reported before the statements were 60 days old. His credit score recovers once the fraudulent accounts are removed. The mortgage application is resubmitted 60 days later.

The lesson: checking your credit report regularly catches identity theft early. The recovery process works, but it takes time. The FTC Identity Theft Report is the key document that unlocks your rights. For protecting yourself from financial harm, read our guide on when financial advice goes wrong.

Example 3: Tax-related identity theft with fraudulent tax return

A 55-year-old discovers his Social Security number was used to file a fraudulent tax return. He discovers the fraud when his e-filed return is rejected as a duplicate.

Steps taken: (1) Files Form 14039 (Identity Theft Affidavit) with the IRS. (2) Mails a paper tax return with the Form 14039 attached. (3) Reports to IdentityTheft.gov. (4) Places a credit freeze at all 3 bureaus. (5) Contacts the Social Security Administration to report the misuse.

The IRS investigation takes 6 to 9 months. His legitimate refund is delayed but eventually issued. The IRS issues an IP PIN for all future returns. The thief is not caught, but the IP PIN prevents future fraudulent filings.

The lesson: tax-related identity theft is common. File early to beat thieves to the return. If your return is rejected as a duplicate, file Form 14039 immediately. The IP PIN is a 6-digit number required on all future tax returns. It prevents anyone else from filing with your SSN. For broader financial recovery, read our guide on what to do if you lose everything financially.

Common Mistakes

Waiting to report. Debit card liability jumps from $50 to $500 after 2 business days and to unlimited after 60 days. Report immediately.

Not placing a credit freeze. A credit freeze is free and prevents new accounts from being opened. Everyone should have one.

Not filing an FTC report. The Identity Theft Report at IdentityTheft.gov guarantees your rights, including blocking fraudulent information from your credit report.

Not following up in writing. Phone calls are not enough. Federal law requires written dispute notices within 60 days for electronic fund transfers.

Using debit cards for online purchases. Debit cards pull money directly from your account. Credit cards give you dispute rights without losing cash.

Not checking credit reports regularly. You can check weekly for free at AnnualCreditReport.com. Catch fraud early.

Not using multi-factor authentication. MFA stops thieves even if they have your password.

Not filing a police report. The police report strengthens your case when disputing fraudulent accounts and enables a 7-year extended fraud alert.

Not filing Form 14039 for tax identity theft. This is the only way to alert the IRS and get an IP PIN.

Paying for identity theft insurance. Most policies do not reimburse stolen money. Your bank's fraud protection and federal law already cover you. Save the money. For a values-based approach to rebuilding after theft, read our guide on how to set financial goals that align with what you actually care about.

Act Fast and Use the System

Identity theft recovery is a race against the clock. The first 24 hours: call the companies where fraud occurred, place a fraud alert, report to the FTC at IdentityTheft.gov, and file a police report. Federal liability limits: debit card ($50 if reported within 2 business days, $500 within 60 days, unlimited after 60 days), credit card ($50 max, $0 if reported before use). Credit freeze (strongest protection, free, must place with each bureau) vs fraud alert (1-year, one bureau notifies others). The FTC Identity Theft Report guarantees your right to block fraudulent information from your credit report. Write to all 3 bureaus with your Identity Theft Report to block fraudulent accounts. Close fraudulent accounts and request confirmation letters. For tax-related identity theft, file Form 14039 with the IRS and get an IP PIN.

The 2026 identity landscape is shifting. The ITRC reports that 25.6% of victims now face two or more identity incidents. Unauthorized device access has surpassed scams as the leading compromise method for adults 35 to 64, accounting for 27.2% of all compromises. The FTC received 6.5 million consumer reports in 2024. The recovery process works, but only if you act fast.

Do three things today. Place a credit freeze at all 3 credit bureaus: Experian, TransUnion, and Equifax. It is free and takes 10 minutes. This prevents anyone from opening credit in your name. Enable multi-factor authentication on every financial account. Use a password manager for unique passwords. Go to AnnualCreditReport.com and pull your credit reports from all 3 bureaus. Review for accounts you do not recognize. For more strategies on protecting your finances from unexpected events, read our guide on how to financially prepare for a natural disaster.

The single most important thing you can do right now, before identity theft happens, is place a credit freeze at all 3 bureaus. It is free. It takes 10 minutes. It prevents anyone from opening credit in your name. If you do nothing else after reading this, do that. Go to Experian.com, TransUnion.com, and Equifax.com and place a freeze. Then, if identity theft does happen, the recovery process is straightforward: call the companies, place a fraud alert, report to the FTC, file a police report, write to the credit bureaus, and close fraudulent accounts. The system is designed to protect you. But it only works if you use it. The people who lose money to identity theft are the ones who wait. The ones who do not check their statements. The ones who do not know their rights. You now know your rights. Use them.

This post is for informational purposes only and does not constitute legal or financial advice. Federal liability limits and identity theft procedures are subject to change. Consult the FTC at IdentityTheft.gov for the most current recovery steps.