To report identity theft, start at the federal government’s IdentityTheft.gov, where a single online submission creates both a sworn FTC Identity Theft Report and a personalized recovery plan that tells you exactly which banks, bureaus, and agencies to contact next. From that anchor step, the work branches: credit bureaus for fraud alerts or freezes, your financial institutions to close compromised accounts, local police for a report some creditors still require, and, depending on how your information was used, the IRS, your medical providers, the Postal Inspection Service, or the Social Security Administration. Move fast. Your legal liability for fraudulent charges often depends on how quickly you report them.
Start at IdentityTheft.gov
The Federal Trade Commission’s IdentityTheft.gov is the single most important starting point. Submitting a report there produces two things at once: an FTC Identity Theft Report that carries the legal weight of a sworn affidavit, and a recovery plan tailored to the type of fraud you describe.1Federal Trade Commission. IdentityTheft.gov Print and save both documents before you leave the page. Once you navigate away, you may not be able to retrieve the affidavit.
The report asks for your full legal name, Social Security number, date of birth, and details about every account or transaction you believe is fraudulent. Be specific. Include merchant names, dollar amounts, account numbers, and the dates you first noticed unauthorized activity. The more detail you provide, the more useful the recovery plan becomes. That plan tells you which companies and agencies to contact, in what order, and gives you pre-filled letters to send.
Many banks, credit bureaus, and creditors now accept the FTC Identity Theft Report in place of a police report. Some still require a police report, so filing one remains a smart backup.
Place Fraud Alerts or a Credit Freeze
You only need to contact one of the three major credit bureaus (Equifax, Experian, or TransUnion) to place a fraud alert. That bureau is legally required to notify the other two.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts An initial fraud alert lasts one year and tells lenders to verify your identity before opening new credit in your name.3Federal Trade Commission. Credit Freezes and Fraud Alerts You can renew it when it expires.
If you have an FTC Identity Theft Report, you qualify for an extended fraud alert that lasts seven years.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Request it if you have evidence of actual misuse rather than just a suspicion.
Credit Freezes
A credit freeze is stronger than a fraud alert. Instead of asking lenders to verify your identity, it blocks them from pulling your credit report at all, which stops most new accounts from being opened in your name. Freezes are free under federal law, and you place them separately with each of the three bureaus.4Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes, Yearlong Fraud Alerts You can lift a freeze temporarily when you need to apply for credit and refreeze afterward at no cost.
Placing a fraud alert also entitles you to a free credit report from each bureau.5Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act Review each one line by line for accounts and inquiries you don’t recognize. When you find fraudulent information, you have the right to demand the bureau block it from your report within four business days of receiving your identity theft report, proof of identity, and a statement identifying the fraudulent items.6Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
ChexSystems
Most people forget ChexSystems, but it matters. ChexSystems is the specialty reporting agency banks check before letting someone open a checking or savings account. If a thief opens bank accounts in your name, the damage shows up here, not on your regular credit report. You can place a security alert on your ChexSystems file online, by mail, or by phone at 888-478-6536. The alert lasts one year, or seven years if you provide a notarized identity theft affidavit.7ChexSystems. Identity Theft Security Alert
Call Your Banks and Card Issuers Right Away
Contact the fraud department at every institution where you hold an account or where the thief opened one. Most banks and card issuers have dedicated fraud lines and online forms. Give them your FTC Identity Theft Report number and, when you have it, your police report case number. Ask that compromised accounts be closed and new ones opened with fresh account numbers.
How much of a thief’s spending you’re on the hook for depends on the account type and how fast you report. This is where timing matters most.
Credit Cards
Federal law caps your liability for unauthorized credit card charges at $50, and the burden of proof falls on the card issuer to show even that $50 is owed.8Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card In practice, most major issuers apply zero-liability policies. If you report the card stolen before any fraudulent charges post, you owe nothing.
Debit Cards and Bank Accounts
Debit cards carry steeper risk. Your liability depends on how quickly you notify your bank after learning your card was lost or stolen:
- Within 2 business days, your liability is capped at $50.
- Between 2 and 60 days, your liability can reach $500.
- After 60 days from your statement date, you could face unlimited liability for transfers that occur after that 60-day window.9Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
The unlimited-liability tier is the one that catches people off guard. If you don’t review your bank statements and a thief drains your account over months, the bank can argue you should have noticed sooner. Check your statements.
Federal regulations generally require banks to resolve most claims within 10 business days or provide provisional credit. Credit card issuers generally must investigate a dispute and issue a temporary credit while the investigation is open.
File a Police Report
Take your printed FTC Identity Theft Report to your local police department and ask to file an identity theft report. Some departments handle this in person; others accept online submissions. Get the case number and a physical copy of the report. Certain financial institutions and creditors still require a police report before they will investigate a dispute or remove fraudulent accounts, so having one on hand prevents delays later.
If Someone Filed a Tax Return in Your Name
Tax identity theft usually surfaces when you try to e-file and the IRS rejects your return because someone already filed using your Social Security number. Other warning signs include a notice about wages from an employer you never worked for, a tax transcript you didn’t request, or an Employer Identification Number issued in your name.10Internal Revenue Service. When to File an Identity Theft Affidavit
If any of those apply, file IRS Form 14039 (Identity Theft Affidavit). You can complete it online, then print and mail or fax it to the IRS. Filing through IdentityTheft.gov transfers the form electronically. One important exception: if you received a letter from the IRS asking you to verify your identity (such as Letter 5071C or Letter 4883C), follow the instructions in that letter instead of filing Form 14039. The letter already gives the IRS what it needs.10Internal Revenue Service. When to File an Identity Theft Affidavit
Get an IRS Identity Protection PIN
Once the IRS confirms you as a victim, it typically assigns an Identity Protection PIN (IP PIN) that you’ll use on future returns. You don’t have to wait for identity theft to opt in. Any taxpayer with a Social Security number or ITIN can join the IP PIN program voluntarily, most easily through an IRS online account. If your adjusted gross income is below $84,000 ($168,000 for married filing jointly) and you can’t create an online account, you can submit Form 15227 instead.11Internal Revenue Service. Get an Identity Protection PIN (IP PIN) A new PIN is generated each year, and no one can file a return using your Social Security number without it.
If Someone Used Your Health Insurance
Medical identity theft can corrupt your health records with someone else’s diagnoses, allergies, and prescriptions. Contact every doctor, clinic, hospital, pharmacy, and insurance company where the thief may have used your information, and ask for copies of all medical records associated with your identity.12Federal Trade Commission. What To Know About Medical Identity Theft
If a provider refuses to release records citing the thief’s privacy, file an appeal with the person listed in the provider’s Notice of Privacy Practices. Once you have the records, report errors to each provider in writing. Include a copy of the record showing the incorrect information and explain why it’s wrong. Send the letter by certified mail so you have proof of delivery. The provider must respond within 30 days and notify other providers that may have the same errors.12Federal Trade Commission. What To Know About Medical Identity Theft
If Your Mail Was Stolen or Redirected
If someone stole your mail to get account numbers or personal information, or filed a fraudulent change-of-address to redirect it, report it to the United States Postal Inspection Service. File online or call 1-877-876-2455.13United States Postal Inspection Service. Report a Crime If you catch someone actively stealing mail, call 911 first.
A thief who redirects your mail can intercept new credit cards, bank statements, and tax documents before you notice anything is wrong. If you suspect a change-of-address was filed in your name, contact your local post office directly and verify the current mailing address on your file.
If Your Social Security Number Is Being Used
If your SSN was compromised, create a my Social Security account at ssa.gov if you don’t already have one so you can monitor your earnings record for suspicious activity. You can also add two protective blocks:14Social Security Administration. Fraud Prevention and Reporting
- An eServices block, which prevents anyone (including you) from viewing or changing your personal information online. Removal requires visiting a local SSA office in person.
- A Direct Deposit Fraud Prevention block, which prevents changes to your direct deposit or address information through the online portal or through a financial institution. Removal also requires an in-person visit.
These blocks are inconvenient by design. That inconvenience is the point: a thief can’t change your benefits information remotely.
In rare cases, the Social Security Administration will assign a new SSN. You must demonstrate that you’ve done everything possible to fix the problems caused by the misuse and that someone is still actively using your number despite those efforts. The SSA will not issue a new number simply because a card was lost or stolen, or to help you avoid bankruptcy or other legal obligations.15Social Security Administration. Identity Theft and Your Social Security Number
If a Debt Collector Contacts You
If a collector contacts you about a debt that resulted from identity theft, you have the right to dispute it in writing. Under the Fair Debt Collection Practices Act, if you send written notice within 30 days of the collector’s first communication disputing the debt, the collector must stop all collection activity until it provides verification.16Federal Trade Commission. Fair Debt Collection Practices Act Text
Send the dispute letter by certified mail with return receipt. Include a copy of your FTC Identity Theft Report and a clear statement that you did not incur the debt. If the collector cannot verify the debt, it cannot legally continue trying to collect. If it ignores your dispute and keeps calling, that itself is a violation of federal law and may give you grounds for a complaint with the FTC or a lawsuit.
If Crimes Were Committed in Your Name
The most alarming form of identity theft happens when someone gives your name and identifying information to police during an arrest. You may not discover it until a background check turns up a conviction you know nothing about, or until you’re pulled over and told there’s a warrant in your name.
Start by filing a police report with the department in the jurisdiction where the crime occurred. Ask officers to run your name through local, state, and federal databases to check for warrants or convictions you don’t recognize. Once your innocence is established, request a letter of clearance and ask that all law enforcement databases be updated to remove your name as the primary identity.
To clear the actual court records, you’ll need to petition the court for a finding of factual innocence and may need to seek expungement. This typically requires the citation or arrest warrant number and whatever documentation you used to prove your identity to police. Some states offer identity theft passport programs through their Attorney General’s office, which can serve as preemptive proof of your victim status during future encounters with law enforcement.
If the thief used your driver’s license, or the charges involve traffic violations or a DUI, contact your state’s Department of Motor Vehicles separately to clear your driving record.
Keep Records of Everything
Identity theft recovery is not a single event. It unfolds over weeks or months, across multiple agencies and institutions. Keep a dedicated log of every interaction: the date, the name and title of the person you spoke with, the organization they represent, and a summary of what was discussed and agreed to. Save confirmation numbers, reference numbers, and screenshots of online submissions.
Keep copies of every piece of correspondence you send and receive, by mail or email. When you mail anything, use certified mail with return receipt so you can prove delivery if a dispute arises. This paper trail is what separates victims who resolve their cases from those who spend years going in circles. It is tedious work, but a well-organized file makes every subsequent phone call faster and gives you leverage when an institution claims it never received your dispute.