How long an identity theft investigation takes depends entirely on which investigation you mean. Banks must resolve credit card disputes within two billing cycles and no later than 90 days, and debit card claims within 10 business days (extendable to 45 with provisional credit). Credit bureaus have 30 days, occasionally 45. The IRS is currently averaging about 20 months on tax identity theft cases. Criminal investigations have no legal deadline at all and routinely run from several months to several years. Most victims dealing with straightforward financial fraud finish the active recovery phase within weeks to a few months, even if the criminal case never closes.
Financial Investigation Deadlines Set by Federal Law
These are the timelines that decide when you get your money back and when fraudulent accounts come off your credit report. They’re the only deadlines in identity theft recovery that are actually enforceable.
Credit Card Fraud: Up to 90 Days
Under the Fair Credit Billing Act, your credit card issuer must resolve a billing dispute within two complete billing cycles after receiving your written notice, and never longer than 90 days.1Office of the Law Revision Counsel. United States Code Title 15 Section 1666 – Correction of Billing Errors You have 60 days from the statement date to submit the dispute in writing. Your maximum liability for unauthorized charges is $50, and most issuers waive that.
Debit Card and Bank Fraud: 10 Business Days, Extendable to 45
The Electronic Fund Transfer Act gives your bank 10 business days from your report to investigate and decide whether an error occurred.2Office of the Law Revision Counsel. United States Code Title 15 Section 1693f – Error Resolution The bank can extend to 45 days only if it provisionally credits the disputed amount to your account within the first 10 business days, and you must have full use of those funds during the extension.3Consumer Financial Protection Bureau. Regulation E Section 1005.11 – Procedures for Resolving Errors Point-of-sale debit transactions and international transfers get a longer 90-day window instead of 45.
Your liability on debit fraud depends on how fast you report. Report within two business days of noticing the problem and you’re capped at $50. Between two and 60 days, liability rises to $500. Miss 60 days entirely and you may be responsible for the full amount of any transfers after that point.4Consumer Financial Protection Bureau. Regulation E Section 1005.6 – Liability of Consumer for Unauthorized Transfers Reporting speed doesn’t shorten the bank’s investigation, but it controls how much of the loss lands on you.
Credit Bureau Disputes: 30 to 45 Days
When you dispute a fraudulent account or inquiry, Equifax, Experian, and TransUnion each have 30 days from receipt of your dispute to complete the investigation. If you submit additional information during that window, the bureau can add up to 15 more days, for a maximum of 45.5Office of the Law Revision Counsel. United States Code Title 15 Section 1681i – Procedure in Case of Disputed Accuracy If the bureau cannot verify the disputed information, it must delete the item.
Bureaus sometimes close disputes as “verified” without a genuine investigation. If a result doesn’t match the evidence you sent, dispute again with your documentation. The 30-day clock restarts on the new dispute.
Tax Identity Theft: About 20 Months
If someone files a fraudulent return using your Social Security number, you submit IRS Form 14039 and your case goes to the IRS Identity Theft Victim Assistance unit. As of mid-2026, the IRS held roughly 387,000 of these cases in inventory, with an average resolution time of about 20 months.6Taxpayer Advocate Service. National Taxpayer Advocate Issues Mid-Year Report to Congress 2026 Your legitimate refund is frozen for the duration.
The National Taxpayer Advocate has urged the IRS to bring that down to four months, but the backlog persists. If you’re facing documented financial hardship because of the delay, the Taxpayer Advocate Service can sometimes intervene to expedite. Their number is 1-877-777-4778.
Criminal Investigations Have No Deadline
No federal or state law requires police to complete an identity theft investigation within any set time. Duration depends on the agency and the complexity of the crime.
Local departments handle cases where the victim or suspect lives in their jurisdiction. Many lack the resources and technical expertise for digital financial crimes, and single-account cases often receive limited investigative attention. The police report matters anyway, because some creditors require it alongside your FTC Identity Theft Report before they’ll clear fraudulent debts.
Federal agencies enter when the crime crosses state lines, involves substantial losses, or connects to organized activity. The FBI works identity theft tied to wire fraud, mail fraud, and financial institution fraud.7Federal Bureau of Investigation. White-Collar Crime The U.S. Secret Service has primary federal authority over access device fraud (credit and debit card fraud) and pursues large-scale, cyber-enabled crimes against the payment system.8United States Secret Service. Financial Investigations The U.S. Postal Inspection Service handles identity theft involving the mail.9United States Postal Inspection Service. How We Do It Federal prosecutors work with all three to bring cases to trial.10Department of Justice. Identity Theft and Identity Fraud
Federal investigations routinely take months to years. Complex cases involving data breaches or international rings can run several years before charges are filed. Many local cases close without an arrest because the perpetrator can’t be identified or is outside the jurisdiction’s reach.
Your financial recovery does not wait for the criminal case. The FCBA, EFTA, and FCRA deadlines run on their own tracks, and they don’t require an arrest, a suspect, or a resolved investigation to complete.
What Makes Your Case Faster or Slower
Within the mandated windows, some cases resolve quickly and others push to the deadline. A few factors do most of the work:
- Number of compromised accounts. A single stolen card number may be resolved in weeks. A dozen accounts opened across multiple lenders means separate investigations at each institution, each with its own clock.
- Type of theft. Financial fraud with traceable transactions moves fastest. Medical identity theft and criminal identity theft involve healthcare systems and court records that are much harder to correct.
- Evidence quality. Transaction records, IP addresses, and digital trails speed investigations. VPNs and disposable payment methods slow them.
- Jurisdictional reach. A crime within one city is simpler than one spanning states or countries. International cases require coordination that often stalls.
- Agency resources. Federal cybercrime units move faster on complex cases than a small department investigating its first identity theft report.
Starting the Clock
None of the mandated timelines above begin until you formally notify the right institution.
File first with the Federal Trade Commission at IdentityTheft.gov or 1-877-438-4338.11USAGov. Identity Theft This produces your Identity Theft Report and a personalized recovery plan.12Federal Trade Commission. Identity Theft: A Recovery Plan Credit bureaus, banks, and debt collectors will all ask for it. Then file with your local police. Then contact each affected financial institution, close compromised accounts, and open new ones with new numbers.
Keep a running log of every call, email, and letter, with dates, names, and reference numbers. When a bank claims it never received your dispute or a credit bureau misses its 30-day deadline, that log is what forces compliance.
When a Bank Misses Its Deadline
If a bank or credit card company ignores your dispute, misses the 10-day provisional credit window, or refuses to investigate, the Consumer Financial Protection Bureau accepts complaints. Most companies respond within 15 days, and the CFPB allows up to 60 for complex cases.13Consumer Financial Protection Bureau. Submit a Complaint A CFPB complaint routes your file to a company’s compliance department rather than a frontline representative. It doesn’t replace the original dispute, but it adds pressure when an institution is dragging its feet.
How Cases End
On the financial side, banks reverse fraudulent transactions, close compromised accounts, and issue replacements. Credit bureaus remove verified fraudulent entries within the 30-to-45-day statutory window once they have your FTC Identity Theft Report and supporting documentation.5Office of the Law Revision Counsel. United States Code Title 15 Section 1681i – Procedure in Case of Disputed Accuracy For most victims of financial fraud, active recovery wraps up within weeks to a few months.
On the criminal side, outcomes are less predictable. Many cases close without an arrest. Federal cases that do go to prosecution can result in restitution covering not just your financial losses but the value of the time you spent recovering.14Office for Victims of Crime. Federal Identity Theft Laws Pursue both tracks at once. One has enforceable deadlines, and the other does not.