Identity theft cases usually involve several compromised accounts, and the instinct is to work through them alphabetically or by anxiety. That is the wrong order. A few accounts function as keys to all the others, and securing them first prevents an attacker from simply resetting their way back in behind you.

1. Email, from a clean device

Email is the reset path for nearly everything. Change the password from a device you are confident is not compromised, enable phishing-resistant multi-factor authentication — a passkey or hardware key rather than SMS — and then check the settings an attacker typically leaves behind: forwarding addresses, filter rules that archive or delete security alerts, connected applications, and recovery addresses or phone numbers that are not yours. Removing a rogue forwarding rule is the step most often missed, and it is the one that keeps an attacker in after you think you have locked them out.

2. Your mobile number

SIM-swap attacks defeat SMS-based recovery entirely. Contact your carrier and add a port-out PIN or account passcode. Where an account still relies on SMS codes, move it to an authenticator app or passkey — particularly banking and email.

3. Financial accounts

  • Change passwords and enable the strongest available second factor.
  • Review payees, standing orders, and any linked external accounts.
  • Ask about a fraud marker or additional verification on the account.
  • Set transaction alerts so unusual activity reaches you immediately.

4. Credit files

Place a freeze or equivalent lock with the credit bureaus operating in your country. A freeze prevents most new accounts being opened in your name and is usually free. Do this before chasing individual fraudulent accounts, because otherwise new ones can be opened faster than you dispute the old ones.

5. Sessions and authorisations

Changing a password does not always end existing sessions. In each major account, sign out of all devices and review authorised applications and API tokens. An attacker with a live session or connected app retains access long after the password changes.

6. Document everything as you go

Keep a log of what you changed and when, plus reference numbers from every report. You will need it repeatedly — for banks, for credit bureaus, and for any account you later have to prove was compromised rather than used by you.

What to expect afterwards

Attempts often continue for months, particularly if identity documents were exposed. Expect phishing that references real details about you, and treat any unsolicited contact about the incident as unverified until you call the organisation back on a number you looked up. The people contacting you already know what happened — that knowledge proves nothing.