Identity Theft First Steps for Tonight
Start with the accounts that can reset everything else: your primary email, mobile account and financial logins. Use a clean device if you suspect yours is compromised.
Contain before you investigate
A perfect explanation can wait. First prevent password resets, SIM changes and new transactions. Then build a timeline from reliable records.
Fraud alert and credit freeze are different
In the US, a fraud alert asks businesses to verify identity; a credit freeze restricts access to a credit file. Neither replaces contacting a company where fraud already occurred.
Protect evidence
Keep original messages and emails. Screenshots help, but preserve headers, transaction references and URLs when possible. Do not post identity documents or case numbers publicly.
Choose the branch that matches
If email controls the other accounts, begin with email recovery and persistence checks.
If mobile service stopped unexpectedly, follow the SIM-swap containment steps.
If the warning came from a breach notice, determine which exposed data requires action.
If a company says an account exists in your name, start the fraudulent-account closure and correction record.
If mail or an address change is involved, secure the missing mail and exposed items.
A tax notice or rejected filing requires the tax identity-theft authority process.
Incorrect treatment or insurance entries need the medical identity record correction steps.
A warning involving a minor needs the child identity-theft and protected-file process.
Questions people ask before acting
Which account should I secure first?
Start with the email and mobile accounts that can reset other logins. Then secure financial and other affected accounts from a trusted device.
Is a credit freeze available in every country?
No. The credit-freeze guidance on this site is US-specific. Use the official identity-theft or credit-reporting service for your location.
Should I delete suspicious alerts after changing a password?
Keep original alerts until you have recorded the affected account, time, device, reference and action taken. They may help explain the incident later.
TONIGHT.you cannot access accounts, file reports or determine coverage. Use official apps and websites; never send us account numbers, identity documents or claim files.