Identity · guides

Identity theft: the deadlines that attach to money

By Alberto Gulotta · Updated 10 September 2026 · 6 min read

This is the entrance to the identity theft tower. If an account of yours is being used by somebody else right now, do not read the atrium — the mailbox comes first, and closing the password that let them in is the first thing to do.

This building covers the moment somebody stops stealing your data and starts using it. That is a different problem from a breach, and it needs different actions in a different order. The damage spreads in a fixed sequence: the account they took first, the accounts that account can reset, the money, and then the slow paperwork of proving you are still you.

The single most useful thing on this whole floor is an order of operations, and it surprises people. The mailbox comes before the bank. Whoever controls your email can reset everything else you own, so a bank password changed while somebody still holds the mailbox is a wasted hour. Every recovery route here starts from that same principle.

The second most useful thing is knowing which of these problems has a deadline. Card fraud, unauthorised transfers and new credit opened in your name are all governed by rules that give you a window and then close it. What is written here says what the window is and where it comes from, rather than telling you to act fast without saying why.

The first five floors are open below. This page also names what already exists elsewhere on the island for the first hour, because the route in is nearly always a password that leaked in a breach somewhere else or a message that was not from who it said; the door you close is the reused password, and on an iPhone the saved ones are where to look first.

There is one more thing worth saying at the door, because it affects whether people act at all. Almost everybody who arrives in this building feels foolish, and almost nobody should. The routes into an identity are overwhelmingly not clever: a password that appeared in a breach somewhere else, a support agent at a phone shop who was talked into moving a number, a recovery question answered with a fact that is printed on a public profile — narrowing that is a setting rather than a repair, and on Facebook it is either the audience controls one at a time or the single lock. None of that requires a mistake on your part, and the shame that follows it is the single biggest reason people wait a week before telling their bank — which is the one delay that genuinely costs money. Everything in this tower is written to be read and acted on the same hour, by somebody who is embarrassed and would rather not be reading it.

Not covered here. It will not sell you identity theft protection. Those subscriptions sit at the top of every search here and they are enormously profitable; what is written here says plainly which of their features are genuinely useful, which are free elsewhere, and which are simply a monthly charge for watching something you could watch yourself.

It will not tell you to call a number found in a search result. In this category, the paid results above the official recovery pages are frequently the second attack, arriving while you are frightened. Everything here links to the platform’s own documented route and nowhere else.

And it will not treat stalkerware as a technical problem with a technical answer. Where the person with access to a device lives in the same house, removing the software can make things worse rather than better, and the page that covers it will say so first and link to people whose job this actually is.

On sourcing: where a page here states a deadline or an entitlement — how long you have to report a fraudulent transaction, whether a credit freeze costs anything — it names the rule or the regulator it comes from, and the country it applies in. Those rules differ enormously between jurisdictions and a page that states one of them as though it were universal is worse than no page at all. What holds instead is simple: every floor links to the platform’s own recovery route, and no floor carries an affiliate link.