How to Deal With Your Identity

1. File a police report with your local police station. What happens: you tell them what was stolen and used. Record the date, the time, the case number, and the officer's name, and keep your copy. A note the FTC gives: bring your FTC Identity Theft Report copy with you when you go, if you already have one.
2. Report it to the Federal Trade Commission at IdentityTheft.gov (or 1-877-438-4338). You receive an FTC Identity Theft Report and a personal recovery plan. Print or save your copies right away.
3. Report it to your state Attorney General's office — its consumer protection or identity theft unit. Record the date, the time, and any confirmation or case number, the same way.
4. Report it to the FBI — the Internet Crime Complaint Center at ic3.gov — for hacking and online fraud. Keep the confirmation in your records the same way. I have filed FBI complaints in my own case; my evidence record is kept cataloged in my own records place.
5. Call the fraud department of every company involved — banks, cards, lenders, your phone company. Ask them to close or freeze the accounts. Change logins, passwords, and PINs. Write down who you spoke to, the date, and the time.
6. Protect your credit file, your way. A fraud alert is free, lasts one year, and can be renewed — one bureau must tell the other two. A credit freeze is free at each bureau and stays until you lift it. Read my caution below before you choose, and choose for yourself.
7. Review your reports line by line, and dispute every account or charge that is not yours, in writing, with your FTC report attached. Bureaus must block proven fraud.
8. Keep going until it is closed. Follow the recovery plan, answer only through official channels, and keep every letter. The case is not done when the first calls end.

Resources, with their sources named: IdentityTheft.gov and FTC 1-877-438-4338; your local police non-emergency line; your state Attorney General consumer protection office; AnnualCreditReport.com; the fraud departments of your own banks and cards; Legal Aid via 2-1-1 for legal matters you cannot afford; 2-1-1 for local help of every kind.

This is my own method, the way my records are kept for my case, taught plainly:

• Catalog and index everything, as it happens: date, time, who, what, case and report numbers, what was sent and what was received — one running records page.
• Keep evidence in a records place, not only on a personal device. Phones and laptops get hacked, lost, and broken. Keep master copies in one secure records place, with a second copy in a different safe place. The index says what each item is and where it lives — without writing anyone's private numbers into the index itself.
• Do it ahead of time. When a court, an officer, or an agency asks, everything is already gathered, in order, with dates. You are not searching while you are hurting.
• Originals stay original. Keep messages and files as received. If you crop or copy something, note it, and keep the untouched version too.

What follows is my experience and my view, labelled as such. The official options stay on this page beside it, and the choice stays yours.

In my experience, every major credit reporting agency has been compromised and hacked — those breaches are documented public record — and in the data-breach lawsuits that followed, people were directed to sign up for credit monitoring programs. I do not recommend them. I do not trust handing more of my personal information to the same systems that already lost it, and I teach people to be careful about storing their personal information in databases they cannot control.

What happened to me, as I tell it: every "free" credit program sent to me was itself hacked. The free offer led to another page requiring a paid monthly membership to actually lock my credit report with an alert. I paid for the service on top of the free year. They still cancelled my membership every month while taking my money. My password was changed and my login failed. I could not run a scan on my own credit report, and I could not see my own personal information that was on the dark web — I was told I had to pay for a higher tier to see what was already mine. And the higher tier was breached too. My view, stated as my view: if they are going to offer free credit reporting, they need to include locking your credit report and putting alerts on it for free. Not making you pay. A program that truly protects identity must be free, must really work, and must let people see what is wrong with their own information. That is why the Identity Helper Program below exists.

The freeze conflict, in my experience: the normal direction is to put credit freezes and fraud alerts on — and a person can do that. But it creates a conflict for the victim. With a freeze on, when you need to verify your own identity for something important, your own credit reports are locked against you too. In my experience after a hack, unlocking does not open cleanly: you may have to leave it unlocked for 24 to 48 hours, verification can take a whole week, and that open week puts your identity at more risk, not less. So the tool meant to protect you can trap you and expose you at the same time. The practical middle path, printed beside my experience: if you freeze, plan important verifications ahead, unlock for the shortest window the bureau allows, and re-freeze the moment the verification clears. If you do not freeze, the other steps on this page — reports, disputes, and your evidence catalog — still stand. Nothing here removes anyone's free legal rights. The choice is the reader's.

And when the bureaus will not fix it: in my experience, I reported wrong information on my credit reports again and again, over months, submitting evidence multiple times — and the bureaus kept answering that the information was accurate, treating my evidence as if it did not exist. Reports left wrong for years block people from apartments, from work, from moving forward at all. My view, stated as my view: the credit reporting system itself should be shut down and ended, to stop people's information being hacked through it. Until then, the rights and steps above are the tools that exist today, and they are yours.

A credit bureau keeps your information in their database, and their databases get hacked. This program keeps nothing. Your records live with you, on your own device, in this browser. There is no account, no sign-up, and nothing here is sent to us or to anyone.

Free means free. Every part of this program — the log, the timeline, the checklists, the exports — is free, with no higher tier and no locked features.

Its honest limits: this program organizes what you tell it. It cannot search the bureaus' or companies' private systems, and it does not replace the official reports themselves. It walks you to each official door and stands beside you while you file.

You may check your own background. Do it source by source, at the official doors — never through a paid background-check company.

• Credit reports: free, every week, from all three bureaus at AnnualCreditReport.com — the only official source. FREE.
• Banking history: a free copy of your own ChexSystems report. FREE.
• Social Security record: your own earnings and benefits statement, free through your Social Security account. Wrong earnings are an early sign of misuse. FREE.
• Your record history: your own FBI Identity History Summary, and your state's own record check, exist for exactly this — to know what is under your name, including crimes a thief committed as you, and the correction steps for each. A few of these official copies carry a small government fee, set by the agency — the program marks each one before you start, and any fee is paid to the agency itself, never through us.
• Court records: many courts let you search your own name free on their official portals. Choose your own location and use that court's official door.
• Where your information is sold: free data-broker lookups and opt-outs, walked through one at a time in the sweep below.

Your log is one part. The other part is what is already out there carrying your information that you may not know about. Work this list calmly, one item at a time — once a season is a good rhythm, not daily fear. Tick each item as you finish it; your ticks are kept on this device only.

• Data brokers and people-search sites. Look up what each one shows about you, and use its opt-out or removal path. Log what you found and what was removed in your evidence log.
• Breach exposure. Run a free, email-based breach check that never asks for a card (for example, Have I Been Pwned — haveibeenpwned.com), and look through any breach letters you may have missed, so you learn which of your information is already out.
• Public records under your name. Court records, property records, voter registration status, licenses, and business filings, at the official doors for your chosen location. Anything you do not recognize becomes an incident in your log.
• Accounts and profiles you do not know about. Old and forgotten accounts, and profiles using your name or photos that are not yours. Log each one before reporting it — evidence first.
• Official records about you. Your Social Security earnings record, your tax account record, postal change-of-address activity, your driving record, and your own medical records request — the places where misuse shows early.
• Money in your name. A free official unclaimed-property search, on state official sites only. It finds money already owed to you — and it can reveal accounts and addresses tied to your name that you never knew about.
• What the sweep must surface. Any criminal history attached to your name — yours, a wrong person's, or a thief's recorded as yours — each with its correction route. Any attacks on you: posts, pages, or listings targeting you by name. And search results carrying your date of birth, your Social Security number, your address, your phone number, or your family members' names.

Getting it taken down

• Broker and people-search listings: use each site's own opt-out and removal path, and log what was removed and what is still pending.
• Search results: use Google's own personal-information removal request for ID numbers, addresses, phone numbers, and doxxing.
• Public records: correct or seal them at their source — the office that holds them.
• False listings: report the listing as false at the site that hosts it, then at the search engine that shows it.
• Nothing is marked "removed" until you re-check the source and see it gone. That confirmation, with its date, goes in your log.

In my experience, people made fake accounts of me with my stolen photos, cloned me, and the pages stayed up — while platform customer service said help existed and then did not help. So here is another way, as a ladder. Log each step, with dates and reference numbers, in your log: a pattern of refusal is itself evidence.

1. Find them all first. Search your name and photos across platforms, and log every fake page and clone — the whole account: its pages, names, photos, videos, posts, and older content carrying misinformation about you — before reporting anything. Pages vanish and reappear. Evidence first.
2. The standard report, done right. File the platform's impersonation report with your real account and ID proof ready, and your screenshots prepared, so the report cannot be dismissed as incomplete.
3. The no-account form. Every major platform has a web form for people who cannot or will not log in. Support menus hide it. Use it.
4. The copyright door — the stronger door. Stolen photos belong to the person in them or the photographer. A copyright (DMCA) takedown is a legal notice the platform must process, separate from the impersonation queue. Use it only for photos and content that are truly yours.
5. Search removal. Ask Google to remove the fake pages from search results, so the fakes stop being findable while the platform drags.
6. Outside pressure, documented. Complain to your state Attorney General and to the FTC or FBI IC3, naming the platform's inaction, with your logged report history attached. Platforms answer regulators differently than users.
7. Formal written notice. A dated letter to the platform's legal or agent address. Paper creates a record a support chat never does. Legal Aid or an attorney can send it where the case is serious.
8. Keep watch. Re-check removed pages and new clones on the calm schedule. New fakes enter this same ladder at step 1 — nobody starts over.

No step can be promised to work every time, and platforms are not controlled by us. That is exactly why the record matters: a person who has climbed the whole ladder holds proof that they did everything — and that is what regulators, courts, and attorneys act on.

The same standard I keep for my own case: every single email is cataloged and indexed as evidence, no matter who it is from — inbox, spam, and sent mail alike. Spam counts double: spam itself is evidence of identity exposure. The catalog lists each message by folder, date, sender, and subject, with a summary index on top. Identity-relevant mail is flagged into your timeline: court cases and settlements, data-breach notices, platform security alerts and account changes, insurance, banks and payment services, phone and internet providers, government and Social Security mail.

Why every email counts: you never know when someone is cloning an email — a message can look like it came from a real person or company and did not. A complete catalog is how you prove which messages were real, which were clones, and when each one arrived. And if a crime ever comes from opening a certain email — a theft, a fraud, a threat — you hold the original message, its date, and its sender, preserved before anything could be deleted or altered. Nothing is deleted until it is cataloged, indexed, and safe in your records. Deleting first is how evidence is lost.

When an identity is stolen, the victim today must personally contact the FTC, the local authorities, the Attorney General, every benefits office, every bank and card issuer, and medical insurance — and each must issue new numbers. My design: build your notify list once, calmly, ahead of any crisis — each place with the way it accepts notice — and keep it with your records. Then one tap sends your stolen-identity notification to your whole list at once, through each place's accepted channel. The precedent exists in law today: one fraud-alert call to a single credit bureau must by law be passed to the others.

What goes out is the notice, backed by your filings — never your evidence. Your evidence is your proof, and it is shown to no one unless a court legally binds you to show it. Every notification is tracked until it is confirmed, and every place that must issue a new number is tracked until the replacement is confirmed — the log records "new number issued" and the date, never the number itself. Answers come back through each place's own safest channel; for new numbers and cards, that is paper mail to your home. The honest limit, printed beside the button: a few places legally require your own voice or signature. For those, everything is prepared for you, and you are walked through that one call with the script in front of you. A notice is never shown as sent when it was not.

It already exists, in part. Several states run Identity Theft Passport programs: the Attorney General issues a carry card to a verified victim who has filed a police report, to present to law enforcement or anyone who challenges their identity — designed to protect victims from arrest or detention for crimes committed by someone using their stolen identity. Verified programs include Virginia (the Attorney General's Identity Theft Passport Program), Iowa (Iowa Code §715A.9A), Arkansas (Ark. Code §5-37-228), and Nevada (the Identity Theft Program Card, through the Attorney General and DMV). Where your state has one, the path is: police report first — step 1 above feeds it directly — then the Attorney General's application.

What you show at a window — and what you never show: your evidence is your proof, and it is shown to no one unless a court legally binds you to show it. No dates, no filings, no case numbers go on anything you hand over at a window, and no summary of your reports is a thing to show. At a window you say one neutral line only: "My identity has been reported stolen or compromised. Please check the flag on my record first." Then the system does its part: an official checks the record flag behind your ID and follows the protected handling for victims — different security checks that do not depend on the very information that was stolen. You tell no story, you open no evidence, and you are never asked to re-prove the compromise at every window. If no flag stands on your record yet, the filings in the steps above are how it gets there — file first, and keep your copies in your vault, private, until a court — and only a court — binds you to show them.

What I am working toward, as advocacy: a government-recognized mark on a person's own government ID itself — a designation, with a matching flag in the government record behind the ID — so that officials who see it know, on sight and in their checks, that this person's identity has been compromised, and handle them by different security checks that do not depend on the very information that was stolen. The victim shows no evidence and tells no story; the mark does the work, and the person misusing the identity never knows it is there. Only the government can put a recognized mark on a government ID, so this is a proposal to be carried by law — modeled on the state Passport laws and on the designations licenses already carry. It will be prepared in full, signed by me electronically, and sent from my own ministry email. Until a place enacts it, this section runs on that place's own honored instruments — and the state Passports above work from day one.

A person whose identity was stolen should be met by a system that starts from their filed record — not by doubt.

Everything on this page protects your identity going forward. Its other half gathers the paper of your life as it already stands. How to Investigate Your Own Life walks it in order: build your timeline first from your own papers, photo dates, and messages; gather your own records and your accounts' histories; check yourself the way others check you; file public-records requests for the files about you; and walk your digital trail — until it all stands together: dated, sourced, originals untouched. Your life, on paper, in your hands.

A lost wallet is its own emergency, and it is not the same fight as a stolen identity — it has its own order. Lost Your ID, Wallet, or Purse walks it step by step: lock and call the banks first, police report the same day if it was stolen, the FTC and the freezes that protect your identity, and then every replacement — card, license, Social Security card, passport, benefits card — with who to contact and the honest waiting time for each.

Free official doors for this section: your free weekly credit reports at AnnualCreditReport.com; the FTC's IdentityTheft.gov recovery plan; the USA.gov Benefit Finder screening for benefits you may qualify for; free legal help through Legal Aid (find yours at LawHelp.org or by dialing 2-1-1). No grant pays for a stolen identity directly — the free official filings and reports in this section are the path.

Shared for learning only from the named official source. Programs change — check the source before you apply. Applying is always free.