What people usually discover first
The first signal is different for everyone. It can be a credit monitoring alert, an application declined for reasons that make no sense, a letter about a return you did not file, mail redirected to an address you have never lived at, or, in the hardest cases, learning that someone gave your name during a police stop. What these share is that the damage is already spread across institutions that do not talk to one another, each with its own process and its own idea of what proof looks like. Sorting it out is less a single case than a series of parallel ones, which is why the order you do things in matters.
Secure the records while they still exist
Pull your credit reports from each of the three major bureaus and place a freeze and a fraud alert. File a report with the federal identity theft site and with local police, and keep both report numbers where you can find them. Then capture evidence before it disappears: screenshots of the fraudulent accounts and their transaction histories, the notice or alert that first tipped you off, every letter with its envelope, and any online portal pages. Once an institution closes a fraudulent account, getting its records later becomes slower and sometimes needs a written request. Keep a dated log of every call, with names and reference numbers.
How the work is usually sequenced
Several tracks run at once. Disputes go to each bureau and to each company that furnished the bad information. If your name was used with law enforcement or a court, correcting those records follows a different and more formal route, and tax accounts have their own process again. Separately, there may be claims against a business that opened an account without checking properly. Whether the person responsible is ever identified is a separate question from getting your records corrected, and the two rarely move on the same timeline. In a first conversation we set the order of operations and say which parts you can handle yourself.
