How Do I Report Credit Fraud to the FTC and Police

To report credit fraud, call your bank or card issuer’s fraud line the moment you spot an unauthorized charge, file an identity theft report at IdentityTheft.gov, place a fraud alert or freeze with the three credit bureaus, and file a police report. The order matters because your financial liability for unauthorized charges depends directly on how fast you notify the bank, and the FTC report unlocks rights you’ll need later with creditors and bureaus. Plan on a few focused hours. Each step triggers a specific legal protection, so skipping one leaves a gap the thief can still use.

Call Your Bank or Card Issuer First

Before anything else, phone the fraud department on the back of the card or on your bank’s website. Ask the representative to freeze or close the compromised account so no further charges go through, and get a confirmation number and the agent’s name before you hang up. That call is what starts the clock on your legal protections.

Follow the call with a written dispute. For credit card billing errors, federal law gives you 60 days from the date the statement was sent to notify the creditor in writing, and the notice has to go to the address the creditor designates for billing disputes, not the payment address. Once the creditor receives your written notice, it must acknowledge the dispute within 30 days and resolve it within two billing cycles, no more than 90 days.¹ Send it certified mail so you have proof it arrived in time. While the creditor investigates, it cannot try to collect the disputed amount or report it as delinquent.

This is where people make a costly mistake. Calling feels like enough, but without the written follow-up you haven’t formally triggered the billing-error protections that freeze collection activity.

Before you make the call, pull together your full legal name, Social Security number, current address, account numbers, and a list of the disputed transactions with dates, amounts, and merchant names. The same packet will serve every other report you file.

Know What You’re on the Hook For

How much you can be forced to pay depends on whether the fraud hit a credit card or a debit card, and how fast you reported. The two laws produce very different outcomes.

Credit Cards

Federal law caps your liability for unauthorized credit card charges at $50, and only if the issuer gave you notice of your potential liability, provided a way to report loss or theft, and the unauthorized use happened before you notified the issuer.² In practice, most consumers pay nothing. Visa’s zero-liability policy waives even the $50 for unauthorized purchases on most personal credit and debit cards as long as you report promptly,³ and Mastercard offers a similar guarantee. These are voluntary network policies, not law, but they effectively make your out-of-pocket risk zero on most consumer cards.

Debit Cards and Electronic Transfers

Debit cards are where delay gets expensive. The Electronic Fund Transfer Act sets liability in tiers tied to when you tell the bank:

Within 2 business days of learning about the loss or theft, your liability caps at $50.
After 2 business days but within 60 days of receiving your statement, your liability can reach $500.
After 60 days from the statement date, you can be liable for the full amount of unauthorized transfers that occur after that 60-day window.

The difference between a $50 loss and an unlimited one is a matter of days.⁴ If you see suspicious debit activity, call the bank the same day. The bank then has 10 business days to investigate, extendable to 45 days only if it provisionally credits your account within the first 10 so you aren’t out the money while it works.⁵

One boundary worth knowing: business credit cards don’t carry the same protections. When an issuer provides ten or more cards to a company for employee use, it can require the business to assume unlimited liability for unauthorized charges, and even with fewer than ten cards the $50 cap applies only to unauthorized use by someone outside the company, not by an employee.⁶ Check the cardholder agreement, and notify the issuer immediately regardless.

File an Identity Theft Report at IdentityTheft.gov

Your next official step is reporting the fraud at IdentityTheft.gov, run by the Federal Trade Commission. You answer questions about what happened, and the system generates an Identity Theft Report along with a personalized recovery plan. You can also report by calling 1-877-438-4338 if you’d rather not use the online form.⁷

This report is more than paperwork. It proves to businesses that someone stole your identity, and it unlocks specific rights under federal law. Creditors may require a copy before they’ll clear fraudulent debts, and credit bureaus must honor requests to block fraudulent information when you provide the report.⁷ If you don’t create an account on the site, print and save the report immediately. You won’t be able to retrieve it later.

File a Police Report

A police report creates a formal criminal record of the fraud with a case number. File in person at your local precinct, or through an online portal if your jurisdiction offers one, and bring a copy of your FTC Identity Theft Report so the officer has the detail they need to document the crime.

Many local departments won’t launch a criminal investigation, and that’s fine. The value of the police report is documentary. Paired with your FTC report, it strengthens your position when creditors or bureaus drag their feet on removing fraudulent accounts, and some creditors specifically request both before they’ll write off a fraudulent balance.

Place Fraud Alerts or Freeze Your Credit

Reporting fraud to your bank stops the bleeding on existing accounts. Alerts and freezes stop new accounts from being opened in your name. Most victims should use both tools.

Fraud Alerts

An initial fraud alert lasts one year and requires creditors to verify your identity before approving new credit in your name. You only have to contact one of the three major bureaus, Equifax, Experian, or TransUnion, and that bureau is legally required to notify the other two.⁸ If you supplied a phone number when placing the alert, creditors must call you at that number before opening new accounts.

If you’ve filed an identity theft report with the FTC, you qualify for an extended fraud alert that lasts seven years. You submit a copy of the report to the bureau to activate it.⁹ For most confirmed identity theft victims, the seven-year alert is worth the extra step.

Credit Freezes

A freeze goes further. It blocks access to your credit report entirely, so no lender can pull it and no new credit can be approved in your name. Unlike alerts, you must contact each of the three bureaus separately, each of which handles freezes online, by phone, or by mail.¹⁰ Placing and lifting a freeze is free under federal law.

Each bureau will give you a PIN or password that you use to lift the freeze temporarily when you need legitimate credit access, such as applying for a mortgage. By phone or online the bureau must remove the freeze within one hour. By mail, they have three business days.¹¹ Store the PINs somewhere safe; losing them creates a hassle later.

Get Fraudulent Accounts Blocked From Your Credit File

This step is separate from an ordinary dispute, and stronger. Once you have your identity theft report, you can ask any credit bureau to block fraudulent information from your file. The bureau must complete the block within four business days of receiving your request, your proof of identity, the identity theft report, and your identification of which items are fraudulent.¹²

The block is stronger because the bureau must also notify the company that furnished the fraudulent information, and that furnisher cannot report the blocked information to any credit bureau going forward unless it later confirms the information is accurate.¹³ A regular dispute leaves room for the same bad data to reappear. The identity theft block is built to stop that cycle.

If It Involves Your SSN or Taxes

If someone used your Social Security number to file a tax return or claim benefits, you have reports to make beyond the FTC and your bank.

For tax identity theft, file IRS Form 14039, the Identity Theft Affidavit. Use it if you suspect someone filed a federal tax return under your Social Security number, or if your own e-filed return was rejected because one was already submitted. You can complete the form online at irs.gov, fax it to 855-807-5720, or mail it in. If you’re filing a paper return because your e-file was rejected, attach Form 14039 to the back of it.¹⁴

If someone is using your Social Security number for employment or to file benefit claims, report it to the Social Security Administration’s Office of Inspector General at oig.ssa.gov or by calling 1-800-269-0271. The SSA fraud hotline is available weekdays from 10 a.m. to 2 p.m. Eastern Time.¹⁵ For SSN misuse tied to credit, such as loans or credit cards opened in your name, your FTC report and credit bureau filings cover that ground.

If the Dispute Isn’t Resolved

Sometimes a bureau confirms information you know is fraudulent, or simply doesn’t respond adequately. Re-filing the same dispute rarely helps. Other paths do.

You can submit a complaint to the Consumer Financial Protection Bureau online or by calling 855-411-2372. The CFPB forwards your complaint to the company and works to get a response.¹⁶ You can also dispute directly with the furnisher that reported the fraudulent account to the bureau. The furnisher carries the same investigation obligations and must report its findings within the same 30-day window.¹³

If neither path works, you have the right to add a 100-word consumer statement to your credit file explaining the dispute. It won’t fix your score, but it gives future creditors context. At that point, consulting an attorney who handles Fair Credit Reporting Act cases is worth considering. These claims sometimes carry statutory damages that make representation financially viable even for an individual consumer.

After the immediate reports are filed, keep checking your credit reports through AnnualCreditReport.com, where all three bureaus now offer free weekly reports on a permanent basis.¹⁷ Stolen personal information circulates for years, and watching for new accounts, address changes, and unfamiliar hard inquiries is how you catch the second attempt before it costs you again.

1
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
2
Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card
3
Visa. Visa Zero Liability Policy
4
Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
5
eCFR. Part 205 Electronic Fund Transfers (Regulation E)
6
Federal Deposit Insurance Corporation. Will I Be Liable for Unauthorized Transactions Made on Business Credit/Debit Cards?
7
Federal Trade Commission. IdentityTheft.gov: Steps to Take After Identity Theft
8
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
10
USAGov. How to Place or Lift a Security Freeze on Your Credit Report
11
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
12
Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft
13
Office of the Law Revision Counsel. 15 U.S. Code 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
14
Internal Revenue Service. Identity Theft Affidavit
15
Social Security Administration. Fraud Prevention and Reporting
16
Consumer Financial Protection Bureau. What If I Disagree With the Results of My Credit Report Dispute
17
Federal Trade Commission. Free Credit Reports