For U.S. consumers, identity theft usually has no single nationwide deadline for reporting it. Report the problem when you discover it. Waiting for an FTC or police report can leave accounts exposed and may cost you important protections.

Two payment deadlines deserve immediate attention:

• For certain unauthorized electronic fund transfers, notifying your bank within two business days after learning that a card or access device was lost or stolen can limit liability.
• If an unauthorized electronic transfer appears on a bank statement, the 60-day notice period can affect responsibility for later transfers.
• A written dispute for a covered credit-card billing error generally must reach the card issuer within 60 days after the statement containing the error was sent.

Identity theft deadlines at a glance

A report to one organization doesn't notify the others. The FTC report won't dispute a bank charge, a police report won't automatically remove a debt, and a credit freeze won't stop tax or benefits fraud.

When money is involved, move first

Debit cards and electronic fund transfers

For a covered electronic fund transfer from a consumer account, Regulation E, 12 C.F.R. section 1005.6 makes prompt notice important.

• A lost or stolen access device: If you learn that a debit card or another access device was lost or stolen, notify the financial institution within two business days. Under the rule, liability is generally limited to the lesser of $50 or the unauthorized transfers made before notice.
• Notice after two business days: The potential liability can increase and, under the rule's conditions, may reach as much as $500.
• An unauthorized transfer on a statement: Notify the institution no later than 60 calendar days after the statement was sent. If you wait longer, later transfers may become your responsibility if the institution establishes that earlier notice would have prevented them.
• You discovered the problem late: Contact the bank anyway. Missing a deadline may affect your legal protection, but it isn't a reason to stop reporting the fraud.

These rules cover certain unauthorized transfers. They don't automatically apply to every wire transfer, business account, payment-app transaction or scam payment. If you were tricked into authorizing a payment, the analysis can be different. The bank still needs to hear from you right away.

When you call, give the date, amount and type of each transaction you don't recognize. Ask how to secure or close the account, replace the card, stop pending transfers and submit a formal error notice. Keep the confirmation number, and follow up in writing if the bank requires written notice.

Credit-card billing errors

Call the card issuer as soon as an unauthorized charge appears. To preserve federal billing-error protections, you generally must send written notice within 60 days after the statement containing the charge was sent.

Use the issuer's billing-inquiries address. It may not be the same address used for payments. The FTC's sample letter for disputing card charges can help you organize the notice. Keep the statement, transaction details, correspondence and proof that you sent the dispute. Send copies of supporting documents and keep the originals.

Contacting the merchant may help resolve the charge, but it shouldn't replace notifying the card issuer.

Filing an FTC identity theft report

There is no strict nationwide deadline for using IdentityTheft.gov. File as soon as you suspect identity theft. The service creates an Identity Theft Report and a recovery plan that can help organize disputes and other follow-up.

Save the completed report and the date you filed it. A creditor, lender or other organization may ask for the report, and it can support a request for an extended fraud alert.

The FTC report doesn't:

• Freeze your credit
• Close or secure a bank account
• Reverse an unauthorized transaction
• File a police report
• Notify the IRS, SSA or DMV

Those steps are separate. If money is leaving an account, call the financial institution before waiting for or completing the FTC paperwork.

Tax-related identity theft and Form 14039

Form 14039 is for tax-related identity theft. Use it when someone may have filed a federal tax return using your information or when the IRS directs you to complete the form. It isn't a general form for every stolen Social Security number, data breach or fraudulent credit account.

Follow the current Form 14039 instructions and any IRS notice. A notice may specify a response date, submission method or address. If the IRS asks you to verify your identity, use the instructions in that notice rather than sending documents to an unrelated address.

An IRS Identity Protection PIN can help prevent someone from filing a federal tax return using your information in the future. It's an annual six-digit code for tax returns only. It doesn't remove a fraudulent return, correct a credit report or secure a bank account.

The Taxpayer Advocate has reported processing delays for both IP PIN requests and identity-theft assistance. Its reports said the IRS aimed to process IP PIN requests within 120 days, but 60% of applications took longer than 120 days in fiscal year 2023. A separate report said Identity Theft Victim Assistance cases were taking about 22 months on average, reaching 675 days as of April 2024. Those figures describe reported delays, not a filing deadline or a guaranteed waiting period. File promptly instead of waiting for processing.

See the Taxpayer Advocate's guidance on Identity Protection PINs and identity theft refund delays.

Credit reports, fraud alerts and freezes

There is no general short deadline for reporting an unfamiliar account to a credit bureau. Dispute it once you find it, particularly if the account is still open or collection activity has begun.

A freeze and a fraud alert do different jobs:

• Credit freeze: Free, placed separately with each nationwide credit bureau, and left in place until you ask for removal. It can help block new credit accounts, but it won't stop activity on accounts you already have.
• Initial fraud alert: Free and generally active for one year. You can renew it.
• Extended fraud alert: Generally active for seven years. You'll need proof of identity theft, such as an FTC Identity Theft Report or police report.

The FTC's credit freeze and fraud alert guidance explains how to contact Equifax, Experian and TransUnion. A freeze must be placed with each bureau. For a fraud alert, start with one bureau and then confirm that the alert appears on the other reports.

When disputing an account, include the account details, a clear explanation and copies of relevant documents. Include an FTC or police report if the creditor or bureau requests one. A freeze or alert doesn't replace a direct dispute with the creditor that opened or reported the account.

Police, Social Security and DMV reports

Police reports

No single nationwide deadline requires an identity-theft victim to file a local police report. Departments have their own procedures. File promptly and ask which agency should take the report if the fraud happened online or somewhere else.

Have these materials ready if you can:

• Government-issued identification
• Proof of address
• Unauthorized account or transaction records
• Fraud notices and creditor letters
• Your FTC Identity Theft Report, if you've already filed one

Ask for the report number and a copy. A police report documents what you told law enforcement and may support later disputes. It doesn't automatically cancel a debt or guarantee that police will investigate.

Social Security identity misuse

Report Social Security-related misuse promptly through the official SSA or SSA Office of the Inspector General channel. No single nationwide victim deadline replaces the instructions in an agency notice.

Keep every letter if the problem involves benefits, an earnings record or an online account. Follow the response date shown. Identity theft involving employment records may also require contact with the employer or the relevant state agency.

Driver's license and DMV fraud

DMV procedures depend on state law and the notice issued by the agency. Report a fraudulent license or driving record immediately. If a letter gives you a hearing, revocation or appeal deadline, that date controls even if you've already filed an FTC or police report.

A general identity-theft report won't necessarily correct a driver's license record. Ask the DMV which documents it needs and whether you must attend a hearing or submit a separate correction request.

State deadlines that are easy to confuse

Several different clocks can appear in an identity theft situation:

• A data-breach notification deadline usually applies to the business that experienced the breach, not to your FTC or police report.
• A DMV hearing or appeal deadline applies to the government action described in the notice.
• A bank or creditor deadline may come from federal law, state law or the account agreement.
• A lawsuit deadline depends on the state, legal claim, defendant and discovery rules.

Don't assume that every identity-theft lawsuit has a two-to-six-year filing period. If you may sue a thief, creditor, employer or business, seek advice from a licensed attorney or state legal-aid service promptly. The applicable limitation period can't be determined from a general reporting guide.

A practical order of operations

Start with account security

1. Change the password for your email and affected financial accounts from a trusted device. Turn on multifactor authentication and sign out of unfamiliar sessions.
2. Call affected banks and card issuers using the number on the back of the card or an official statement. Don't use a link in a suspicious message.
3. Report a lost card or access device immediately. Ask whether pending transfers can be stopped and whether the account should be closed.
4. Place freezes with all three credit bureaus if someone may open new accounts. Add a fraud alert as well if appropriate.

Then create the paper trail

5. File at IdentityTheft.gov and save the completed report.
6. File a police report if a creditor, agency or other organization asks for one, or if you want an official local record.
7. Dispute unfamiliar accounts and charges in writing. Use the correct address or secure upload method for each organization.
8. Contact the IRS, SSA, DMV or employer when the theft affects taxes, benefits, a driver's license or employment records.

Keep watching the case

Monitor financial accounts and all three credit reports for small test charges, new inquiries, address changes and collection notices. Keep a case file with the date you discovered the activity, each call, the representative's name, confirmation numbers, documents sent and response deadlines.

Use copies instead of originals, and avoid sending a full Social Security number through ordinary email. If an institution denies a dispute, request the decision and the next escalation step in writing.

If you reported the theft late

Report it now. A late FTC or police report can still help, but delay may:

• Reduce protections under bank and electronic-transfer rules
• Allow additional charges or accounts to appear
• Make transaction records or device data harder to obtain
• Cause you to miss an agency hearing or appeal deadline
• Complicate a later dispute or lawsuit

Tell the bank or issuer when you discovered the activity and why notice was delayed. Ask it to review all related transactions, not only the first one you noticed.

Common questions

Is there a deadline for an FTC identity theft report?

There is no fixed nationwide deadline. File at IdentityTheft.gov when you suspect identity theft and save the resulting report.

Does the 60-day rule apply to every identity theft case?

No. The period can matter for an unauthorized electronic transfer shown on a bank statement and for a covered credit-card billing error. It isn't a universal identity theft deadline. The payment method and account type control.

Do I need a police report before contacting my bank or freezing my credit?

No. Contact the bank, card issuer and credit bureaus immediately. File a police report separately if it's needed for documentation or requested by an organization.

Should everyone with a stolen Social Security number file Form 14039?

No. Form 14039 is for tax-related identity theft or a situation in which the IRS tells you to use it. It doesn't replace FTC, bank, credit bureau or police reports.

Is a company's breach-notification deadline my deadline?

Usually not. A breach-notification deadline generally tells the company when it must notify affected people or regulators. It doesn't set a universal date for you to report identity theft.

Which deadline matters most?

If a debit card or access device was lost or stolen, notify the bank within two business days. If an unauthorized electronic transfer appears on a statement, watch the 60-day period. For a credit-card billing error, send written notice within 60 days after the statement was sent. Call the financial institution now, even if one of those periods has already passed.