# Identity theft: first steps in the US, UK, Canada, Australia

> First steps after identity theft in the US, UK, Canada, and Australia: where to report it, and how a credit freeze, fraud alert, or credit ban protects you.

After **identity theft**, call the companies where the fraud happened, report it to your country's reporting service, and protect your credit file so nobody can open new credit in your name. The tools differ by country: a free credit freeze in the US, Cifas Protective Registration in the UK, a fraud alert or an Ontario security freeze in Canada, and a free credit ban in Australia.

**Key takeaways**

1. In the US, federal law makes a credit freeze free to place and lift, and it must be requested separately from Equifax, Experian, and TransUnion.
2. In the UK, Report Fraud replaced Action Fraud on December 4, 2025, and kept the same phone number, 0300 123 2040.
3. In Australia, a credit ban is free, lasts 21 days, and can be extended; one credit reporting body passes the request to the others.


## How to respond to identity theft

Act on three fronts the same day: stop the fraud where it happened, report it, and protect your credit file. The FTC's first steps for US victims are a good template anywhere: call the companies where the fraud occurred, place a fraud alert and get your credit reports, then report it at [IdentityTheft.gov](https://www.identitytheft.gov/), which builds a personal recovery plan. This page is the identity part of [recovering from a breach or a hack](/guides/account-security/hacked-accounts/); if the theft started with a hacked email account, secure that account first.

Keep a record from the first call: dates, names, reference numbers, and copies of letters. You will tell the same story to banks, credit agencies, and the police, and a written timeline saves time with each of them.

### Freeze, fraud alert, or ban: the tools by country

| | US | UK | Canada | Australia |
|---|---|---|---|---|
| Report or get help | IdentityTheft.gov, 877-438-4338 | Report Fraud, 0300 123 2040 (Scotland: police, 101) | Police, then the Canadian Anti-Fraud Centre, 1-888-495-8501 | IDCARE, 1800 595 160 |
| Block new credit | Credit freeze, free, at each of the three bureaus | No legal freeze; Cifas Protective Registration, £30 for two years | Security freeze, free in Ontario since July 1, 2026 | Credit ban, free, 21 days, extendable |
| Warn lenders | Fraud alert for one year, placed at one bureau, which tells the others | Experian notice of correction, free | Fraud alert at Equifax and TransUnion | — |
| Free credit reports | Every week, at AnnualCreditReport.com | Statutory report, free at Experian | Once a month online, in Ontario | Every three months |

A **freeze** blocks new credit accounts in your name, including your own applications, until you lift it. A **fraud alert** leaves your report visible but tells businesses to check with you before opening a new account. A **lock** is the word some agencies use for their own freeze product: in Ontario, the law's security freeze is what Equifax Canada calls Credit Lock, while in the UK Experian's lock needs a paid subscription. In the US, the FTC's page on freezes does not cover locks; the freeze is the tool whose price and timing are set by federal law.

### In the US

- **Report it** at IdentityTheft.gov or at 877-438-4338. The Spanish version is RobodeIdentidad.gov.
- **Freeze your credit** with Equifax, Experian, and TransUnion, one by one. By federal law, a freeze is free, placed within one business day of an online or phone request, and lifted within one hour; by mail, both take three business days. It stays until you lift it.
- **Or place a fraud alert** with one bureau, which passes it to the other two. It lasts one year and can be renewed; identity theft victims can get an extended alert for seven years.
- **Check your reports** at AnnualCreditReport.com or 1-877-322-8228. The three bureaus have made weekly free reports permanent.

### In the UK

- **Report it** to Report Fraud, at reportfraud.police.uk or 0300 123 2040. The service, run by the City of London Police, [replaced Action Fraud](https://www.gov.uk/government/news/report-fraud-new-service-from-city-of-london-police) on December 4, 2025. In Scotland, call the police on 101.
- **Consider Protective Registration.** [Cifas](https://www.cifas.org.uk/pr) places a warning flag on your details in its National Fraud Database, and its members then run extra identity checks. It costs £30 for two years, is requested online, and does not affect your credit score. It does not cover card transactions, and Cifas sends no reminder when the 24 months end.
- **Get your statutory credit report.** Experian, for one, provides it free, disputes fraudulent entries with lenders, and lets you add a free notice of correction that asks lenders to request a password from you.
- **Tell Royal Mail** if you suspect your mail is being redirected, as Cifas advises.

We found no UK equivalent of the US legal credit freeze.

### In Canada

- **Report it** to your local police, keep the file number, then contact the Canadian Anti-Fraud Centre at 1-888-495-8501.
- **Place a fraud alert** with Equifax (1-800-465-7166) and TransUnion (1-800-663-9980). Service Canada warns that there may be a fee; Equifax Canada says its Fraud Alert for confirmed victims is free and lasts six years.
- **In Ontario, freeze your file.** Since July 1, 2026, Ontario's [security freeze](https://www.ontario.ca/page/credit-reports) is free, at Equifax and TransUnion separately. The agency must place it within two business days online, five by phone, or 15 by mail. Equifax says the same option has existed in Quebec since 2023. We found no primary source for other provinces.
- **Your Social Insurance Number** is replaced only with proof that it was used for fraud, according to Service Canada.

### In Australia

- **Call IDCARE,** the national identity and cyber support service, on 1800 595 160, weekdays from 7 a.m. to 7 p.m. AEST. Small businesses have their own free service, funded by the Australian government, on 1800 595 170.
- **Request a credit ban.** According to the [OAIC](https://www.oaic.gov.au/privacy/your-privacy-rights/credit-reporting/fraud-and-your-credit-report), a ban is free, lasts 21 days, and can be extended as often as needed; you are told at least five business days before it ends. Ask one credit reporting body, Equifax or Experian (which now owns illion), and it passes the request to the others.
- **Check your credit report,** free every three months from each body.

### Where the data came from

Identity theft can follow a breach at a company that held your details. Our page on [reading a breach notice](/guides/account-security/hacked-accounts/email-in-a-data-breach/) explains what each type of leaked data allows.

### When a monitoring service raised the alarm

If the first warning was an alert from a credit agency or a security suite, check [what a dark web alert actually proves](/guides/account-security/hacked-accounts/dark-web-alerts/) before acting on its links.