Identity Stolen or Impersonated
Identity theft is slow to discover and slow to resolve. But there is a clear sequence of steps that limits the damage. Here is what to do.
The Accounts She Never Opened
Kavya was 28 and working in Bengaluru.
She had not thought about credit reports or identity verification since applying for her apartment two years ago. So when a bank statement arrived in her name for a credit card she had never applied for, she assumed it was a mailing error.
Then a collections agency called. Then another. Four accounts had been opened in her name over three months - two credit cards, a personal loan, and a mobile contract. Someone had used her Aadhaar and PAN details to pass KYC verification at multiple lenders.
The data had likely come from a breach at a service she had used. She had no way to know which one.
Kavya spent the next six months undoing the damage. She placed fraud flags with credit bureaus, filed reports with cybercrime.gov.in and the Income Tax Department, wrote formal dispute letters to each lender, and monitored her CIBIL report monthly. Her score took eleven months to return to its previous level.
The process was long. But it was finite. And she had a clear path through it.
The Scale of Identity Theft
15.4M
people affected by identity theft in the US alone in 2023
India's cybercrime portal received over 1.5 million complaints in 2024, with identity fraud among the top three categories.
Source: Javelin Strategy and Research, 2024; I4C Annual Report, 2025Average 200 Hours to Resolve
Most of that time is spent contacting institutions, filing disputes, and following up. Starting earlier and acting systematically reduces total time significantly. Use the checklist approach - track every contact and every reference number.
63% of Victims Had Damaged Credit for Over a Year
A credit freeze prevents new accounts being opened. Placing a freeze immediately after discovering fraud is the single most effective action for limiting further damage while you work through the recovery process.
1.5 Million Cybercrime Complaints Filed in India in 2024
Identity fraud using Aadhaar and PAN data from breaches is among the top categories. UIDAI's lock/unlock Aadhaar biometrics feature can prevent biometric-based KYC misuse. It is free and available at uidai.gov.in or via the mAadhaar app.
Check Your Breach Exposure at HaveIBeenPwned.com
Enter your email address to see which data breaches have included your information. Knowing which services have been breached tells you which passwords and linked accounts to change first. Free and maintained by a security researcher.
Credit Freeze: Do This First
A credit freeze (also called a security freeze) prevents new credit accounts from being opened in your name. It does not affect your existing accounts or your credit score. It is the most important immediate action.
India: Contact all three bureaus:
- CIBIL: freecibil.com or 1800-200-2030 (call to place a fraud flag)
- Experian India: experian.in
- Equifax India: equifax.co.in
US: Freeze at all three major bureaus:
- Equifax: equifax.com/personal/credit-report-services/
- Experian: experian.com/freeze/center.html
- TransUnion: transunion.com/credit-freeze
UK: Fraud alerts work differently - contact CIFAS at cifas.org.uk to add a protective registration. This flags your file to all member lenders.
A freeze can be temporarily lifted when you need to apply for credit, then re-applied. It costs nothing.
Reclaiming Your Accounts
For social media impersonation - someone has created a fake profile using your name and photos:
- Report the fake account to the platform immediately (most have a dedicated impersonation reporting path)
- Screenshot the fake profile before reporting - you may need it for a police report
- Search your name across all platforms to find any additional fakes
- Notify your contacts directly - a brief message that a fake account exists in your name prevents further harm
Platforms typically respond to impersonation reports within 24-72 hours. If the impersonation account is posting harassing content, include "imminent safety risk" in your report description to escalate review.
Reporting to Authorities
File within 72 hours of discovery where possible. Faster reports improve the chance of tracing the activity.
- India: cybercrime.gov.in or call 1930. Also report PAN misuse to the Income Tax Department at incometaxindia.gov.in. Report Aadhaar misuse at uidai.gov.in.
- US: FTC at IdentityTheft.gov - this generates a personalised recovery plan and can produce official letters for disputing with creditors
- UK: Action Fraud at actionfraud.police.uk (0300 123 2040)
- Australia: Australian Cyber Security Centre at cyber.gov.au + ACCC Scamwatch
Get a police report reference number. Creditors and financial institutions require this to process fraud disputes. Without it, disputes take much longer.
Long-Term Restoration
Monitor your credit report every three months for at least 12 months after an identity theft incident. Fraudulent activity sometimes appears weeks or months after the initial breach.
In India, you are entitled to one free CIBIL report per year at freecibil.com. Set a calendar reminder to pull it quarterly.
Set up fraud alerts where available - these require lenders to take extra verification steps before opening new accounts in your name. In the US, fraud alerts are free and last one year (seven years for victims who have filed a police report).
Keep records of every dispute letter, phone call, and email. Note the date, who you spoke to, and what was agreed. This record is essential if disputes need escalating.
Preventing Future Theft
- Minimise what you share digitally. Aadhaar, PAN, and passport numbers shared for KYC purposes should be watermarked with the date and purpose before sending (e.g., "for [company name] KYC, [date]")
- Check breach exposure at haveibeenpwned.com regularly - if your email address appears in a breach, change the password for that service and any others where you used the same one
- Freeze unused credit. If you do not plan to take new credit soon, keep the freeze in place permanently
- Use a password manager so every account has a unique, complex password that cannot be reused across breaches
Try It: Identity Recovery Checklist
Select what happened to you. The tool generates the relevant recovery steps across parallel tracks - credit, reporting, and account actions.
What That Just Showed You
1. Credit fraud and impersonation are separate tracks. Credit fraud requires action with bureaus and lenders. Impersonation requires action with platforms and your contacts. They have different steps and different timelines.
2. A police report is a tool, not just a formality. It unlocks the formal dispute process with creditors and financial institutions. Without it, disputes are treated as customer service complaints rather than fraud cases.
3. Recovery is long but finite. The average resolution time is around 200 hours - but that is spread over months, not weeks. Systematic tracking and a reference number for every action makes the process manageable.
Three Things Worth Doing
1. Place a credit freeze now - before anything happens. A freeze prevents new credit being opened in your name. You can lift it when you need to apply for something. It costs nothing and takes about 15 minutes across the relevant bureaus.
2. Check HaveIBeenPwned.com today. Enter your email address. If any of your accounts appear in a known data breach, change the password for that service and any other service where you used the same one.
3. Keep a dedicated record of every action you take. Date, institution, reference number, what was agreed. This log is essential if disputes need escalating or if evidence is needed later.
One Question Before You Continue
You discover someone has opened a credit card in your name. What is the most effective first step?