What should you do first if you think your identity has been stolen?

Contact your bank immediately so it can block further activity and monitor for suspicious transactions. Then change passwords, especially if you reused them across accounts, and report stolen documents to the issuing organisations. Check your credit report for unfamiliar accounts or loans, and ask for a fraud alert if you need extra verification on new applications.

What to do first when you suspect identity theft

The first move is to stop further misuse, which means alerting the institution that can immediately freeze or monitor the exposed financial activity. After that, you should reset any compromised login credentials, report lost documents to the issuing bodies, and review credit records for new accounts, loans, or other unfamiliar activity. Speed matters because identity theft often expands across multiple accounts fast.

Do not treat the first step as a paperwork exercise. If a bank, card issuer, or loan provider can block transactions and flag suspicious use quickly, you reduce the window in which an attacker can cash out, open new credit, or pivot into other accounts.

Why the bank call comes before the cleanup work

Financial institutions are usually the fastest point of containment because they can verify unusual transactions, block payments, place account restrictions, and start internal fraud monitoring. That immediate containment is more urgent than changing passwords alone, because changing passwords does not reverse transactions already in motion or stop misuse of payment instruments already exposed.

In practice, this is a containment decision, not a convenience decision. The account that is already being abused should be handled first, then you move outward to other credentials and documents that may have been exposed at the same time. If you reused passwords, treat that as a multiplier, because compromise of one account can expose several others.

What evidence and follow-up checks matter most

Once the immediate financial risk is addressed, the next task is to identify whether the theft is limited to one channel or whether it has already spread. That means checking for unfamiliar accounts, loans, address changes, credential resets, and any activity tied to stolen documents such as IDs, tax records, or account statements. If the stolen material can be used for verification, the attacker may be able to pass checks even without direct account access.

Credit monitoring is useful because it can reveal attempts to open new obligations in your name, but it is not a substitute for direct containment at the source. A fraud alert adds another layer when you want lenders to apply extra scrutiny before approving new applications, which is especially important if you cannot yet confirm the full scope of misuse.

Risk and Threat Considerations

Identity theft is risky because the attacker is not limited to one account type. A stolen credential, document, or payment method can be used for direct fraud, account takeover, or new-account abuse, and the impact often grows if the same information is accepted across multiple services.

Failure mechanism: The attacker uses compromised identity material, such as login credentials, personal data, or documents, to pass verification, authorize transactions, or open new accounts before the victim can contain the exposure.

Impact: You can see unauthorized payments, drained balances, damaged credit, denied applications, and longer recovery because multiple organisations may need to independently reverse or verify the misuse.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Identity theft response depends on rotating or revoking exposed credentials quickly.
	IA-2 — Identification and Authentication (Organizational Users)	Compromised personal identities often start with account access and authentication failure.
	AU-6 — Audit Review, Analysis, and Reporting	Suspicious transactions and unfamiliar activity require log review and fraud analysis.
Recommendation — Rotate compromised authenticators and revoke any exposed access material immediately. Re-validate account access and strengthen authentication on affected accounts. Review account and transaction logs for signs of misuse and escalation.
NIST CSF 2.0	RS.AN-01 — Investigations and Analysis	Identity theft response requires determining scope, entry point, and affected accounts.
Recommendation — Analyze the incident scope before deciding what must be reset, frozen, or reported.
CIS Controls v8	CIS-5 — Account Management	Stolen identity commonly affects account creation, access, and lifecycle control.
Recommendation — Disable or recover affected accounts and remove any unauthorized access paths.

Practitioner Guidance

What to prioritise: Containment first, investigation second. If a payment account, loan account, or online banking profile is exposed, the priority is to stop transaction abuse and then work outward to passwords, documents, and credit records.

What to verify: Confirm whether the compromised item is a credential, a payment instrument, or a document used for identity proofing. That distinction matters because it changes whether the next action is password rotation, card replacement, document replacement, or a credit file freeze request.

Common mistake: People often change one password and assume the problem is solved. If the same password was reused, or if the theft involved identity documents rather than just a login, the safer assumption is that other accounts and applications may also be at risk.

Practitioner takeaway: The best first response is the one that stops active abuse fastest, then narrows the blast radius across accounts, documents, and credit activity before the attacker can expand the damage.