Start with the actions that limit damage

If someone has used your personal information, don't wait for a police report or for one organization to finish its investigation. Contact the company where the fraud occurred, report the identity theft to the FTC, and protect your credit. Those actions can happen at the same time.

In the United States, there isn't one complaint form that fixes every identity-theft problem. A bank handles an unauthorized transaction, a credit bureau handles inaccurate report information, the FTC creates an identity-theft record and recovery plan, and the IRS handles tax-related misuse. A police report can support those cases, but it doesn't replace their separate procedures.

Use this order when you first discover the problem:

1. Call each affected bank, card issuer, lender, debt collector, utility, phone company, or other provider. Use a number from your card, statement, or the company's official website and ask for its fraud department.
2. Report the theft at IdentityTheft.gov. Save the FTC Identity Theft Report and any related documents the site creates.
3. Place a fraud alert or security freeze. A fraud alert can be placed through one nationwide credit bureau. A freeze must be requested separately from all three.
4. Secure your email, phone, and financial accounts. From a trusted device, change reused passwords, create unique ones, turn on multifactor authentication, and reset your phone-account PIN if needed.
5. Save evidence and reference numbers. Keep statements, letters, screenshots, call notes, report numbers, and proof that you sent disputes.
6. Make a police report when it supports the case. This is especially useful when documents were stolen, someone impersonated you, or a company specifically asks for law-enforcement records.
7. Use the agency connected to tax or benefits fraud. Tax identity theft may involve IRS Form 14039. A fraudulent unemployment or other benefits claim must be reported to the agency that issued it.

You can freeze your credit or place a fraud alert before obtaining a police report. Waiting for that report can give a thief more time to use your information.

Create an FTC identity-theft report

Go to IdentityTheft.gov and choose the description that best fits what happened. The questions cover problems such as new credit accounts, account takeover, stolen personal information, tax fraud, and benefits fraud.

The FTC's tool generally helps you:

• Describe the incident and the accounts involved.
• Build a recovery plan for your situation.
• Create an FTC Identity Theft Report and related affidavit information.
• Save a report number and printable documents.
• Identify the businesses and agencies that should be contacted next.

If you can't use the website, call the FTC identity-theft hotline at 1-877-IDTHEFT (1-877-438-4338).

Download the report as a PDF and print a copy if you can. The FTC says its report can show businesses that someone used your identity and make it easier to correct the resulting problems. Keep the report number with the rest of your records.

What an FTC report won't do

An FTC report is not a police report. It also doesn't automatically:

• Cancel a debt.
• Reverse a card charge, transfer, or withdrawal.
• Remove an account or inquiry from a credit report.
• Make a company approve your dispute.

Contact every business where the fraud occurred and follow its own dispute process. The FTC's recovery guidance recommends calling the affected companies, reviewing your credit reports, and taking steps to reduce further misuse.

Contact the companies where the fraud occurred

Call the fraud department as soon as you see an unauthorized transaction or an account you didn't open. Use a trusted number, not a link or phone number in a suspicious text, email, or voicemail.

Tell the representative exactly what you dispute and ask the company to:

• Block, secure, or restrict the affected account.
• Stop pending transactions if that is still possible.
• Close a fraudulent account and issue a new account number when appropriate.
• Open a dispute for unauthorized charges or transfers.
• Explain which documents it needs and where written disputes must be sent.
• Give you a case or reference number.
• Confirm the outcome and any account correction in writing.

The payment method affects the process. Credit-card billing disputes, debit-card and other electronic fund transfers, ACH payments, wires, and peer-to-peer transfers can have different procedures and deadlines. Report each unauthorized transaction promptly and follow the provider's written instructions. Don't assume that a credit-card dispute process also applies to a debit-card or bank-transfer problem.

For a credit-card billing dispute, use the issuer's written billing-error instructions and the billing-inquiry address on the statement if one is provided. A phone call may stop additional fraud quickly, but a written dispute gives you a record of what you reported.

If a debt collector contacts you about an account you didn't open, say that you dispute the debt because of identity theft. Ask for the collector's mailing address and instructions for sending identity-theft documentation. Keep the collector's letter, envelope, and delivery record.

A short identity-theft dispute letter

Use the company's required format if it has one. Otherwise, this is a useful starting point:

Subject: Identity theft dispute for account ending [last four digits]

I did not open or authorize this account or transaction. I discovered it on [date].
Please secure the account, investigate the disputed activity, and tell me which
documents you need. Please confirm in writing how the account and any related
credit reporting will be corrected.

Attached are copies of: [list documents].

Name:
Address:
Phone:
Case or reference number:

Use the last four digits of an account when possible. Don't send your full Social Security number by ordinary email, and don't send original identity documents unless an agency specifically requires them.

Choose a fraud alert, a security freeze, or both

These protections address new-credit applications, not every kind of identity theft.

An initial fraud alert can make sense when you suspect your information has been exposed or misused. An extended alert is intended for a confirmed identity-theft case and generally requires an identity-theft report. A police report may support the request, but check the bureau's current instructions rather than assuming it is the only acceptable document.

A security freeze is usually the stronger choice for stopping new credit accounts. It won't stop every form of identity theft, though. Existing creditors and certain permitted users may still access your file, and a freeze doesn't prevent someone from taking over an existing bank, email, phone, or social-media account.

Place the freeze with each bureau through its official website or phone service. Store the login details or PINs securely. You may need to temporarily lift or remove the freeze when applying for credit, housing, insurance, or another service that checks your credit.

According to USAGov's credit-freeze guidance, online or phone requests generally must be completed within one business day, while mailed requests can take up to three business days. Online or phone requests to lift a freeze generally take effect within one hour.

You can use a fraud alert and a freeze together. Neither one replaces a dispute for an account, inquiry, or transaction that already appears in your name.

Review all three credit reports

Obtain reports from each of the three nationwide credit bureaus and compare them. Check for:

• Accounts you didn't open.
• Hard inquiries from unfamiliar companies.
• Incorrect addresses, phone numbers, or employers.
• Collection accounts for debts you don't recognize.
• Accounts that belong to you but show fraudulent activity.
• Duplicate entries for the same fraudulent debt.

Dispute inaccurate information with the bureau that displays it and with the company that supplied the information. A dispute sent to one bureau won't necessarily correct the same entry at the other two.

Include copies of the documents that support the specific item you are disputing, such as:

• Your FTC Identity Theft Report.
• A police report, if available or requested.
• Proof of identity.
• The page of the credit report showing the account or inquiry.
• Statements or letters from the affected company.

Send copies rather than originals. Keep confirmation that the bureau and the information provider received your dispute.

A credit report may not show utility, phone, medical, employment, tax, or benefits fraud. Contact the provider or government agency involved in those cases instead of treating a clean credit report as proof that no other misuse occurred.

When a police report is useful

A police report isn't required for every identity-theft complaint, an initial fraud alert, or a security freeze. It can still help when a creditor or bureau requests law-enforcement documentation, when a document was stolen, or when someone used your identity to impersonate you.

Start with the local police department's non-emergency line or reporting portal and ask how it handles identity theft. The department may ask you to report where the incident occurred or may direct you to another agency.

Take:

• Your FTC Identity Theft Report or affidavit.
• Government-issued identification and proof of address.
• A brief timeline.
• Statements showing unauthorized charges.
• Letters about fraudulent accounts or collections.
• Credit-report pages showing unfamiliar accounts or inquiries.
• The names, phone numbers, case numbers, and dates from companies you contacted.

Ask for both the report number and a copy of the completed report. A report number by itself may not satisfy a creditor or bureau that asks to see the report.

You can describe the facts without accusing a particular person:

On [date], I discovered that an account or transaction had been opened or made
using my personal information. I did not apply for, open, or authorize it.
The account or transaction is [description], and the amount is [amount].
I contacted [company] on [date] and received reference number [number].
Attached are statements, correspondence, my FTC identity theft report, and
identification documents with sensitive numbers redacted where appropriate.

If an officer says the department can't take the report, ask whether it accepts reports online, whether another agency is responsible, or what written alternative the company requesting the report is likely to accept. Record the agency, date, and instructions you receive.

Handle tax, benefits, utility, and phone fraud on separate tracks

Tax identity theft

Use the tax-related path at IdentityTheft.gov if someone used your Social Security number or taxpayer identification number for a federal tax purpose. The FTC explains that the process can guide you through IRS Form 14039 and, where available, securely transmit the form to the IRS.

If the IRS sent you a notice, follow the response instructions and deadline printed on that notice. Don't send tax documents to a phone number or email address supplied by an unknown caller.

Form 14039 is for tax-related identity theft. It doesn't replace a bank dispute or police report, and filing it doesn't remove the obligation to file a required tax return or pay taxes. The FTC's tax identity-theft guidance explains this distinction.

Benefits, utility, and phone accounts

If someone filed for unemployment or another benefit in your name, contact the government agency that issued the claim. Ask how to report identity theft and keep the claim number and every notice.

For a fraudulent electricity, gas, water, phone, or internet account, contact the provider's fraud department. Ask it to:

• Close or secure the account.
• Remove charges you didn't authorize.
• Correct information sent to a credit bureau.
• Confirm the correction in writing.

A suspected SIM swap or phone-account takeover needs quick attention. Contact the carrier through an official channel, add or reset the account's security PIN, and secure your email account. Access to email can let a thief reset passwords for other accounts.

Keep an evidence file

A running record is more useful than relying on memory after several calls. Use a simple log such as this one:

Keep these items together:

• A timeline beginning when you discovered the problem.
• Statements, notices, bills, and credit reports.
• The FTC report number and saved documents.
• The police report number and report copy.
• Copies of letters and attachments you sent.
• Call dates, times, names, departments, and promised actions.
• Screenshots of suspicious messages, account activity, or login alerts.
• Proof of delivery for mailed disputes.

Store the file in a password-protected location. Before sharing documents, redact unnecessary Social Security numbers, full account numbers, passwords, and authentication codes.

If a company rejects the dispute

Ask for the decision in writing. Then request:

1. The specific reason for the denial.
2. The documents or information the company relied on.
3. The correct address or portal for a second review.
4. The appeal deadline and required evidence.
5. Confirmation of whether the disputed information was sent to a credit bureau.

Send a focused package rather than every document you have. Identify each account or transaction separately and match it to the evidence that supports your claim.

If a bank, lender, debt collector, or credit-reporting problem remains unresolved after you contact the company, consider filing through the Consumer Financial Protection Bureau complaint portal. Your state attorney general may also offer an identity-theft complaint route. These escalation channels don't replace the original dispute and don't guarantee a particular result.

Mistakes that can slow recovery

• Waiting for a police report before securing accounts or freezing credit.
• Calling only general customer service and never asking for the fraud department.
• Assuming an FTC report automatically removes a debt or reverses a charge.
• Placing an alert with one bureau and forgetting that a freeze requires all three.
• Disputing an item with a bureau but not contacting the company that supplied it.
• Treating Form 14039 as a solution for non-tax fraud.
• Sending originals, full account numbers, or unredacted identity documents unnecessarily.
• Using phone numbers or links from suspicious messages.
• Failing to record case numbers, delivery confirmations, and promised dates.
• Naming a suspected thief without evidence.

There is no single timeline for identity-theft cases. A freeze request, bank investigation, credit-report correction, and IRS case follow different procedures. Before ending each call or submitting each report, ask what the organization needs, when it expects to respond, and how you should follow up.

Frequently asked questions

Do I need a police report to file an identity-theft complaint?

Not always. You can report to the FTC, contact affected companies, place a fraud alert, and freeze your credit without waiting for police paperwork. A police report may be requested for an extended alert, a creditor dispute, or a case involving stolen documents or impersonation.

Is a fraud alert better than a security freeze?

They provide different protection. A fraud alert tells businesses to verify your identity, while a freeze generally blocks access to your credit file for new-credit applications. A freeze requires separate requests with all three bureaus and may need to be lifted for a legitimate application.

Should I report attempted identity theft if I haven't lost money?

Yes, if someone used or attempted to use your personal information. An FTC report creates a record and recovery plan even when a bank, company, or security system stopped the attempt.

When should I use IRS Form 14039?

Use it for tax-related identity theft, such as a fraudulent federal tax return or another tax record filed with your taxpayer information. Follow any instructions on an IRS notice. Form 14039 isn't a general fraud affidavit for bank or credit-card problems.

What if the company says the account is mine?

Ask for the decision and dispute instructions in writing. Identify the account, state that you didn't open or authorize it, and send the relevant evidence, including your FTC report, police report if available, proof of identity, and statements. Keep the submission record and use the appropriate consumer complaint channel if the company doesn't address the evidence.

Begin with the affected company's official fraud channel and IdentityTheft.gov. While those reports are pending, place the appropriate credit protection and write down each reference number, deadline, and promised follow-up.