How to File an Identity Theft Report: FTC, Police, Credit Bureaus

To file an identity theft report with the FTC and police, start at IdentityTheft.gov to complete the FTC’s online report, then take the FTC Identity Theft Report it generates, along with your documentation, to your local police department to get a case number. Do one thing before either filing: call your bank and card issuers. Federal law ties your financial liability to how fast you report unauthorized transactions, and the clock is already running.

Call Your Bank Before You File Anything

For credit cards, your maximum exposure is $50 for charges made before you notify the issuer, and most major issuers waive even that. Once you report the card compromised, you owe nothing on future unauthorized charges.¹

Debit cards are harsher. Under the Electronic Fund Transfer Act, your liability depends entirely on when you notify your bank:

Within 2 business days of learning about the theft: no more than $50.
After 2 business days but within 60 days of your statement: up to $500.
After 60 days from your statement: no cap. You can lose everything the thief takes from that point on.

Someone who doesn’t check statements for a couple of months can find thousands gone with no legal right to recovery.² Call first. File later.

On the same calls, ask the bank and card issuers to freeze or close compromised accounts, issue new card numbers, and reset your online banking credentials. Change passwords on financial accounts and on the email address tied to them, and turn on multi-factor authentication. If a thief still has your email, they can intercept password resets for everything else.

What to Gather Before You File

Both the FTC and police reports go faster and stronger when you sit down with your evidence organized:

Bank and credit card statements showing the fraudulent charges, with dates and amounts.
Any correspondence from creditors about accounts you didn’t open.
Your personal identifying information: full legal name, Social Security number, date of birth, and current address.
A timeline of when you discovered the theft and what has happened since.

Filing the FTC Report at IdentityTheft.gov

The FTC’s reporting portal at IdentityTheft.gov walks you through questions about what happened, which accounts were affected, and what type of fraud occurred. It covers fraudulent credit card charges, new accounts opened in your name, tax-related fraud, and misuse of your personal information for employment. The system takes up to five fraud incidents per report, and you can add details about anything beyond that in a personal statement before submitting.³

When you finish, the system produces two things: your FTC Identity Theft Report and a personalized recovery plan. Save and print the report right away. The recovery plan includes pre-filled dispute letters for credit bureaus, businesses, and debt collectors, plus checklists tailored to your situation.⁴ Creating an account lets you track progress and update the plan as your recovery unfolds.

The FTC Identity Theft Report is a legal document, not just paperwork. Under the Fair Credit Reporting Act, it lets you demand that credit bureaus block fraudulent information from your file, place an extended fraud alert lasting seven years, and require businesses to give you copies of records tied to the fraudulent transactions.⁵ Filing a false report is a federal crime, so the document carries weight on both sides.

Filing the Police Report

A police report creates a law-enforcement record of the crime at the local level. Some creditors and insurers require it before they’ll close fraudulent accounts or process claims, especially for high-value fraud. Go to your local police station in person, or use the department’s online reporting system if it offers one.

Bring your FTC Identity Theft Report, your identification, and the documentation you gathered. The more evidence you hand the officer, the more complete the report will be. Before you leave, ask for the case number and a physical copy of the report. You’ll need both when disputing accounts with creditors.

Some departments are reluctant to take identity theft reports, particularly when the fraud originated online or in another jurisdiction. If you meet resistance, explain that the report is necessary for you to exercise your federal rights under the Fair Credit Reporting Act, including the right to block fraudulent accounts from your credit file. Showing the officer your FTC Identity Theft Report and supporting documentation often helps. If the department still refuses, the FTC report alone satisfies the requirements for most creditor disputes and all three credit bureaus.

Using the Reports: Credit Bureaus and Creditors

The reports do their real work once you send them out.

Fraud Alerts and Credit Freezes

Anyone can place an initial one-year fraud alert without an identity theft report. Once you have your FTC report or a police report, you qualify for an extended fraud alert that stays on your file for seven years.⁵ Contact one of the three bureaus and it must notify the other two.⁶ An alert flags your file and asks lenders to verify your identity, but it doesn’t block access to your report.

A credit freeze does block access. It stops the bureaus from releasing your report to potential lenders, which means no new credit can be opened in your name (including by you) until you lift it. Federal law requires all three bureaus to place and remove freezes at no charge, and phone or online removal requests must be honored within one hour. Mail requests take up to three business days.⁵ Contact each bureau separately to place one.

Blocking Fraudulent Information

With your FTC Identity Theft Report, you can also demand that credit bureaus block specific fraudulent entries from your file. The bureau must block the information within four business days of receiving your report, proof of identity, identification of the fraudulent items, and a statement that the transactions aren’t yours.⁷ A block is stronger than a dispute: the information can’t reappear on your report, and the bureau must notify the company that furnished it.

Disputing Accounts with Creditors

Contact the fraud department of every company where the thief opened accounts or made charges. The pre-filled letters from IdentityTheft.gov save time here. Send each dispute with a copy of your FTC Identity Theft Report and police report by certified mail with return receipt requested. That paper trail proves the creditor was notified and is legally obligated to investigate.

Once your bank is notified of unauthorized debit card transactions, it generally has ten business days to investigate. If it can’t finish in that window, it must issue a temporary credit for the disputed amount (minus up to $50) while it continues. The full investigation must wrap up within 45 days in most cases, though transactions involving foreign countries or new accounts can stretch that to 90 days.⁸

Log every call and letter: representative’s name, date, and what was discussed. Follow up if you don’t get written confirmation. Creditors sometimes acknowledge a dispute verbally and stall on the paperwork.

Situations That Need Their Own Filings

The FTC and police reports cover most identity theft, but a few types of fraud need separate reports on top of those.

Tax Identity Theft

Tax identity theft usually shows up when the IRS rejects your legitimate return as a duplicate, or when you get a notice about income you didn’t earn. File IRS Form 14039, the Identity Theft Affidavit. The fastest way is online through the IRS website; you can also fax it toll-free to 855-807-5720 or mail it to the IRS processing center in Fresno, California. If you’re responding to a specific IRS notice, send the form to the address or fax number on that notice instead. Use only one submission method.⁹ IdentityTheft.gov can also help you complete and submit Form 14039 electronically as part of your recovery plan.³

To prevent a repeat, enroll in the IRS Identity Protection PIN program. The IP PIN is a six-digit number you include on your return each year that prevents anyone else from filing under your Social Security number. Any taxpayer with an SSN or ITIN can enroll. The fastest route is through your IRS online account. If your adjusted gross income is below $84,000 ($168,000 married filing jointly), you can apply by submitting Form 15227.¹⁰

Medical Identity Theft

When someone uses your identity for medical treatment, fraudulent entries can mix with your real health history. Under the HIPAA Privacy Rule, you can request that healthcare providers amend your records, and the provider must act within 60 days, with a possible 30-day extension.¹¹ Request records from every provider where you suspect fraudulent treatment, review them, and submit written amendment requests with a copy of your FTC Identity Theft Report or police report attached.

Employment Identity Theft

If someone uses your Social Security number to get a job, the employer reports that income to the IRS under your number. You may not find out until a tax notice arrives about unreported wages. On top of filing Form 14039, report the fraudulent earnings to the Social Security Administration’s Office of the Inspector General at 1-800-269-0271, by fax at 1-410-597-0118, or by mail to the Social Security Fraud Hotline at P.O. Box 17785, Baltimore, MD 21235-7785.¹² Incorrect earnings on your record can affect your future benefits.

A Child’s Identity

Children’s Social Security numbers are attractive targets because the theft can go undetected until they apply for credit as adults. Parents and guardians can place a free credit freeze on a minor’s file with each of the three bureaus; the freeze applies to children under 16 and stays in place until you request removal.⁶ The process for minors differs from the adult one, so check each bureau’s website for its specific requirements. Parents can also request an IP PIN for a dependent, though children under 18 can’t use online enrollment and must apply by Form 15227 or in person at a Taxpayer Assistance Center.¹⁰

1
GovInfo. 15 U.S.C. 1643 – Liability of Holder of Credit Card
2
Office of the Law Revision Counsel. 15 U.S.C. 1693g – Consumer Liability
3
Federal Trade Commission. IdentityTheft.gov – Assistant
4
Federal Trade Commission. IdentityTheft.gov
5
Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
6
Federal Trade Commission. Credit Freezes and Fraud Alerts
7
Office of the Law Revision Counsel. 15 U.S.C. 1681c-2 – Block of Information Resulting From Identity Theft
8
Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
9
Internal Revenue Service. Form 14039 – Identity Theft Affidavit
10
Internal Revenue Service. Get an Identity Protection PIN
11
HHS.gov. Health Information Technology and HIPAA – Correction
12
Social Security Administration. How Do I Report Fraud in the Social Security, Supplemental Security Income (SSI) or Medicare Programs