Identity theft evidence is the paper trail connecting an unauthorized account, transaction, notice, or claim to what you discovered and reported. There isn't one packet that works for every case.

For most U.S. cases, start by securing any account still being misused. Then report the theft at IdentityTheft.gov and notify the bank, creditor, business, or agency involved. A local police report can help when an organization requests one or when you need a law-enforcement record. Tax-related identity theft follows the notice or procedure the IRS gives you.

What evidence should you gather?

You can report active misuse before your file is complete. If you have time to gather documents first, collect:

You don't need to know who stole your information. Report the activity as unauthorized, separate confirmed facts from suspicions, and don't guess about details the records don't establish.

Match the evidence to the report

An FTC report, police report, credit dispute, and bank fraud claim are different documents. Sending one doesn't automatically complete the others.

Document or action Send or report to Main purpose What it does not do
FTC Identity Theft Report Federal Trade Commission through IdentityTheft.gov Documents the facts and produces a recovery plan It isn't a criminal investigation
Police report Local law enforcement Creates a law-enforcement record and case number It doesn't guarantee an investigation or reimbursement
IRS Form 14039 or requested documents IRS Addresses suspected tax-related identity theft It doesn't correct credit or bank accounts
Credit dispute Credit bureau and the business that supplied the information Challenges inaccurate accounts or inquiries It doesn't report an unauthorized bank transfer
Fraud report Bank, card issuer, lender, or payment provider Starts that provider's review of an account or transaction It doesn't automatically remove every related record
IC3 complaint FBI's Internet Crime Complaint Center Shares information about cyber-enabled crime It doesn't replace a bank or police report

The Office for Victims of Crime guidance recommends keeping a log of contacts with authorities and financial institutions. That log can be as useful as the first report when you need to explain what happened later.

Build a usable evidence packet

Start with a timeline

Begin with the date you noticed the problem. Add each event in order:

  1. The date shown for the unauthorized transaction, account, notice, or other activity
  2. The business, agency, creditor, or provider involved
  3. What you did, such as calling the bank, changing a password, or disputing an account
  4. The person or department you contacted
  5. The case, confirmation, or transaction number
  6. The next promised action and any stated deadline

Use exact dates when you can. If a date is only approximate, label it that way. A spreadsheet or dated document is easier to update than notes spread across email, paper, and your phone.

Preserve records that show the misuse

Save copies of:

Don't edit a screenshot or delete the original message. Keep the original email, file, or letter and add any explanation separately. Keep originals in your files unless an agency specifically asks for one.

Limit the sensitive information you send

Send copies, not originals, unless the recipient's instructions say otherwise. Never send a password or one-time security code as evidence. Don't send a full Social Security number through ordinary email.

Use the secure upload site, mail address, or portal listed by the organization. If it asks for proof of identity or address, provide only the requested documents through that channel. Keep a copy of every page and file you submit.

Add a short victim statement

A concise statement gives the reviewer a clear starting point. Use the recipient's form if it has one. Otherwise, you can adapt this:

Subject: Identity theft report for [account, notice, or transaction]

I am [full name]. On [date], I discovered [describe the account, charge, return, or other activity]. I did not open, authorize, or benefit from this activity.

I notified [organization] on [date]. The case or confirmation number is [number]. Please investigate the activity and tell me what additional documents you need.

Attached are [list the relevant records].

This statement supports the organization's process; it doesn't replace a required dispute form, affidavit, or verification step.

Report the theft to the FTC

IdentityTheft.gov is the FTC's online starting point for many U.S. identity theft cases.

  1. Choose the option to report identity theft and answer the intake questions.
  2. Select the type of misuse, such as a new credit account, tax return, bank account, or benefit claim.
  3. Use your timeline to enter the facts. Identify uncertain information as uncertain.
  4. Save or print the FTC Identity Theft Report and the recovery plan the site provides.
  5. Record the report number and store the electronic file with the rest of your evidence.
  6. Follow the plan's instructions for creditors, businesses, government agencies, and credit reporting companies.

The FTC report can help document that you reported identity theft when a company asks for proof. It doesn't close an account, correct a credit file, investigate a crime, or guarantee that a bank or merchant will return money. The affected organization still has to review the account or transaction.

The FTC's identity theft guidance also points to warning signs such as missing bills and unexpected account changes. A missing bill may mean someone changed the billing address to hide activity, so check whether your contact information has changed.

File a police report when it serves a purpose

Call the local police department's non-emergency number or visit the station. Ask whether it accepts identity theft reports online and what documents it wants.

Bring or provide:

Describe the activity plainly. Ask for the incident or report number and how to obtain a copy or written confirmation. A department may record the complaint without opening an investigation. The record can still show when you reported the problem.

If the department says another agency handles the matter, ask for the correct reporting route and record the response. Don't state that the crime occurred in a particular location unless you know that it did. Call 911 only for an immediate safety emergency.

Do you need the police report before the FTC report?

No. You can create an FTC Identity Theft Report first and use it to organize the next steps. A police report may be useful later if a creditor, business, credit bureau, or government agency requests one.

Protect your credit reports

A fraud alert and a credit freeze help prevent new credit fraud, but neither one is an identity theft complaint.

The FTC's credit freeze and fraud alert guidance explains how to use either protection.

Next, obtain your reports from AnnualCreditReport.com. Mark every account, inquiry, address, or collection item you don't recognize. Dispute inaccurate information with each bureau reporting it and with the business that supplied the information. Include, when requested:

Keep the dispute, delivery confirmation, response, and any updated report together. A credit bureau dispute doesn't notify a bank about an unauthorized debit and doesn't replace the bank's separate fraud process.

What if a creditor asks for an FTC or police report?

Send the report through the creditor's requested channel, along with only the records relevant to the account. If the creditor asks for more proof, request the details in writing. Keep a copy of your submission and the date it was sent.

Handle bank, card, and payment fraud separately

Call the fraud department using the number on the back of your card, an official statement, or the provider's official app or website. Don't use a number supplied in a suspicious email or text.

Tell the provider what happened and ask:

Identify the payment type accurately. A credit card charge, debit-card transaction, electronic funds transfer, wire, and peer-to-peer payment may follow different procedures. An FTC or police report does not automatically produce a refund.

If a thief opened an account in your name, ask the provider to record that you didn't authorize it. Ask how it will handle statements, collections, and credit reporting. If an existing account was taken over, secure the device first, then change the login credentials and enable multifactor authentication.

Report tax identity theft to the IRS

Tax identity theft has its own process. If the IRS sends a notice, follow that notice rather than automatically using a general form.

Letters such as 4883C, 5071C, 5747C, or 5447C may contain different verification or document-submission instructions. Respond promptly using the contact method and address printed in the letter. For example, a Letter 5447C may give you the option to mail documents to the address in the letter.

If you suspect that someone filed a fraudulent tax return but haven't received an IRS notice, check the IRS's current procedure for Form 14039, Identity Theft Affidavit. The Taxpayer Advocate Service identity theft guidance explains that, in an appropriate case, a police report may be submitted instead of Form 14039.

Keep copies of:

Don't use a general mailing address when the IRS notice provides a special address or submission method. Tax cases can take longer than a routine account dispute, so use the notice's instructions for follow-up. After the immediate problem is addressed, consider an IRS Identity Protection PIN as a preventive measure.

Handle Social Security, benefits, and license misuse through the issuing agency

The agency that issued the record or benefit usually controls the correction process:

Provide an FTC or police report if the agency requests one. State forms, deadlines, and correction procedures vary, so don't assume a form from one state will work in another.

For a cyber-related crime, you can also file with the Internet Crime Complaint Center. IC3 collects complaint information and shares it with law enforcement and other agencies. It doesn't replace a report to your bank, the affected company, or local police.

Keep the follow-up organized

Create one digital or physical folder for the case. Use file names such as YYYY-MM-DD-bank-case-1234.pdf so records stay in date order.

Your contact log should include:

If a bank, creditor, bureau, or agency says it needs more proof, ask what it needs in writing. Send a focused packet instead of every personal record you have. If the organization doesn't respond, follow its stated escalation process and keep proof of the original submission.

There is no single resolution deadline for every identity theft case. Bank, credit, police, and IRS procedures have different timelines. A date printed on an agency notice takes priority over a general estimate.

Mistakes that can slow the case

Frequently asked questions

Is an FTC Identity Theft Report the same as a police report?

No. The FTC report documents the identity theft and provides a recovery plan. A police report is a local law-enforcement record. Neither one automatically guarantees a refund or correction.

Can Form 14039 be used for any identity theft?

No. Form 14039 concerns tax-related identity theft. Bank, credit, employment, benefit, medical, and driver's-license misuse may require different reports and evidence.

What if I don't know who stole my information?

Report the unauthorized activity and identify the suspected thief as unknown. Give the organization dates, account details, records, and communications. Don't try to determine the person's identity yourself.

Should I send original documents?

Usually not. Keep the originals and send copies unless the recipient specifically instructs you otherwise. Use the secure submission method listed by the organization and retain proof of delivery.

What should I do first?

If transactions or account changes are still happening, contact the provider's fraud department first using an official number or app. Secure the account, save the case number, and then create the FTC report and work through the instructions for the specific bank, creditor, bureau, agency, or IRS notice.