Someone Opened a Credit Card in My Name. Here's Exactly What I Did.
The letter showed up on a Tuesday. A welcome packet from a store card I never applied for, congratulating me on my new $4,500 limit. I didn't open the envelope with dread. I opened it with anger, then a clock started ticking in my head. Every minute between discovery and action is a minute someone else can spend with your credit, your accounts, or your tax refund.
Identity theft isn't a distant headline. In 2024, the FBI's IC3 logged over 2,000 cybercrime reports per day in the U.S. alone. The Federal Trade Commission received more than 1.1 million identity theft reports last year. Most victims don't find out until the damage is already on their credit report, which means the recovery window is already closing. I got lucky. I found out fast. What I did next is the same process I now teach in the Academy, and it's the process that kept my losses to zero.
Step 1: Freeze Everything Before You Explain Anything
I didn't call the card issuer first. I didn't spend an hour on hold trying to explain that I didn't apply. I froze my credit at all three bureaus in under twelve minutes.
If you do nothing else, do this.
A credit freeze blocks any new creditor from pulling your report, which means no new cards, no new loans, no new lines of credit in your name. It does not hurt your score. It does not block your existing cards. It is free, permanent until you lift it, and reversible in minutes when you actually want to apply for something legitimate.
Here's where to go:
You will need your Social Security number, date of birth, and a mailing address. You will create a PIN or account at each bureau. Write those down somewhere secure. I saved mine in my password manager immediately.
Freezing all three bureaus took me twelve minutes. Calling the fraudulent card issuer, disputing the account, and getting transferred to three departments took forty-seven. Freeze first, clean up second.
Step 2: Pull Your Credit Reports and Circle the Damage
Once the freeze is active, you're buying time. Now you need to see what else is hiding.
You can pull a free credit report from each bureau every week at AnnualCreditReport.com. That's the only official site. Everything else is either selling you something or collecting your data.
I pulled all three reports that afternoon and looked for:
One of my reports showed a second inquiry from the same week at a different retail card. The thief had tried twice. The first got through. The second didn't, probably because I froze the bureaus before it could clear.
I circled every suspicious line, took screenshots, and saved the PDFs. Documentation is not optional. Every dispute, every call, every follow-up letter will go smoother if you have the paper trail.
Step 3: File an FTC Identity Theft Report
Go to IdentityTheft.gov. This is the central hub the FTC built specifically for this situation. It is free, it walks you through the entire process, and it generates the official report you'll need for every creditor, bank, and police department.
The site will ask what happened: credit card fraud, tax identity theft, utility fraud, medical identity theft, etc. I selected "Credit Card Accounts." It then generates a personalized recovery plan, pre-filled letters you can send to creditors, and an official Identity Theft Report with an affidavit number.
Print that report. Save it as a PDF. Back it up in two places. You will quote that affidavit number repeatedly over the next few weeks.
The IRS also maintains an Identity Theft Central page if your problem involves a fraudulent tax return. If someone files taxes in your name, that's a separate and serious lane. The FTC site will point you there if needed.
Step 4: File a Police Report
This step frustrates people because local police often treat identity theft as a financial crime that happened "somewhere else." Some departments will take your report over the phone. Others want you in person. A few will push back and say they can't help.
Be persistent. You are not asking them to hunt down the thief. You are asking for a case number and a written report that proves to creditors and credit bureaus that you took this seriously and officially. That report number, combined with your FTC affidavit, forms the foundation of your dispute rights under the Fair Credit Reporting Act.
I walked into my local precinct with a printed copy of my FTC report, the fraudulent account letter, and my credit report showing the unauthorized inquiry. I asked for a case number. I got one in twenty minutes.
Step 5: Dispute Every Fraudulent Account Directly
Don't wait for the credit bureaus to investigate on their own timeline. You dispute directly with the creditor that opened the fraudulent account. Call their fraud department, tell them you are a victim of identity theft, and reference your FTC report and police case number.
I called the issuer of that store card, reached their fraud team, and said three things:
1. "I did not apply for this account."
2. "I have an FTC Identity Theft Report and a police case number."
3. "I need this account closed and removed from my credit report immediately."
They closed the account while I was on the line. They sent a confirmation letter. The credit bureau dispute followed, but having the creditor acknowledge fraud directly is faster and stronger than waiting for a bureau investigation cycle.
For good measure, I also disputed the unauthorized inquiry on my credit report through each bureau's online portal. That inquiry dropped off within three weeks.
Step 6: Set Fraud Alerts and Consider a Credit Lock
After a freeze, you can also place a fraud alert on your credit file. A fraud alert tells creditors to verify your identity more carefully before opening new accounts. Unlike a freeze, it doesn't block access. It just adds a warning flag.
You only need to contact one bureau to set a fraud alert. By law, that bureau must notify the other two.
There are two types:
I placed an extended fraud alert because I already had the documentation. It took one phone call to Experian.
A credit lock is different from a freeze. It's a product the bureaus sell, often bundled with credit monitoring. It works like a freeze but is managed through an app instead of the bureau websites. I skipped the lock. The freeze does the same thing for free.
Step 7: Get an IRS Identity Protection PIN
This is the step most people skip, and it's the one that can save you months of tax headaches. If someone has enough of your information to open a credit card, they have enough to file a fake tax return and steal your refund.
The IRS issues an Identity Protection PIN (IP PIN) — a six-digit number you must include on your tax return before the IRS will accept it. Once you opt in, you get a new PIN every year. Without it, no one can file taxes in your name electronically.
I applied for my IP PIN through the IRS online tool. It took about fifteen minutes and required identity verification. The online tool shows your PIN immediately; the mail-in route takes about three weeks. It now lives in my password manager next to my credit freeze PINs.
Step 8: Change Your Passwords, Especially Financial Ones
Identity theft rarely happens in isolation. If someone applied for credit in your name, they might also have access to an old password, a breached account, or a piece of mail they intercepted.
I spent an hour that evening changing passwords on every financial account: bank, brokerage, mortgage, retirement, and every credit card portal. Each password was unique, stored in my password manager, and paired with MFA where available.
If you don't have a password manager yet, this is the moment to get one. Bitwarden is free for personal use. I use it for everything. At the Academy, we walk through setup step by step.
The Truth About Recovery
Identity theft is not a single event. It's a process. The discovery is the scariest part because you're staring at damage you didn't cause and you don't yet understand the full scope. But the system does work if you move fast and follow the order: freeze, report, document, dispute, protect.
My credit card fraud was resolved within three weeks. The fraudulent account was removed entirely. My credit score was unaffected. The thief got nothing because I treated the Tuesday letter like an emergency, not an inconvenience.
Most people wait too long because they assume someone else will handle it, or because the process feels overwhelming. It isn't. The websites are built for non-technical people. The FTC site holds your hand through every step. The credit bureaus have dedicated fraud hotlines. You just have to start.
One Thing to Do This Week
If you haven't frozen your credit yet, do it this week. Not because you've been hit. Because it's free, permanent, and it removes one of the easiest paths a thief can use against you. I've written the exact steps before — it takes fifteen minutes and costs nothing. You can find that guide on the blog.
If you're already dealing with identity theft right now, start at IdentityTheft.gov. Do not spend another hour reading articles. Freeze your credit first, then work through the FTC recovery plan. Speed matters more than perfection.
Join the Digital Self-Defense list and I'll send you the complete Identity Theft Recovery Checklist — a printable, step-by-step guide you can keep on your desk if you ever need to run this process under stress. It's free, and it's the exact checklist I used.
And if you want to go deeper — learning how to lock down your accounts, spot scams before they land, and build a defensive system that protects your whole family — the Digital Self-Defense Academy covers it all in plain English. $29/month. Cancel anytime. First week free.
Think, track, verify. That's the job.
*Derek Ram runs DRAMCyber and writes about digital self-defense at derekram.com. He is not a lawyer and this is not legal advice. If you need legal help with identity theft, contact a consumer protection attorney in your state.*
Get the 5-Minute Digital Safety Checklist
Four things that make you harder to target. No jargon. No fear. Free.
Get the Checklist →