Identity theft is usually documented through a connected evidence file, not one document. Start with the record showing the unauthorized account, filing, benefit, medical service, or transfer. Add a factual statement that you did not authorize or benefit from it, copies of the reports you made, and a timeline of what happened.

This evidence can support an investigation, account correction, or dispute. It usually won't identify the thief or guarantee a refund.

This article is for U.S. consumers. Documentation requirements and deadlines vary by payment method, company, and state. Report suspected unauthorized activity promptly even if you haven't identified the person responsible.

Start with this identity theft evidence checklist

Collect the items that fit your situation:

Save original files when possible. Download statements as PDFs, keep complete emails rather than only screenshots, and store copies in a secure location. Don't delay a required notice while trying to collect every possible document.

What documents can show identity theft?

Bank statements and transaction records

A statement showing a transfer or purchase you didn't make is often the starting point. It shows that the activity occurred, but it usually doesn't show who performed it.

Save:

Contact the bank through a phone number or website you know is genuine. Don't use contact information from a suspicious text or email.

Describe the payment accurately. An electronic transfer made by someone who accessed your account without permission may be treated differently from a payment you personally authorized after a scammer persuaded you to send money.

Credit reports and fraudulent accounts

Order reports from all three nationwide credit reporting companies through AnnualCreditReport.com. The reports may not contain identical information.

Look for:

An unfamiliar account isn't automatically identity theft. It could be a reporting error, an account on which you're an authorized user, or a name and address mix-up. Contact the creditor to investigate, then dispute information that isn't yours.

For an identity-theft block request, be prepared to provide an identity-theft report, proof of identity, and a clear list of the fraudulent accounts or inquiries. Follow the current instructions for each credit reporting company. Send the request to every company that displays the information, and keep the online confirmation or proof of delivery.

A credit freeze can help prevent some new accounts from being opened. It doesn't remove existing accounts, correct a credit report, or secure an account that has already been taken over.

The FTC Identity Theft Report and police report

The FTC report and a police report are different records:

A police report isn't a criminal conviction, and an FTC report doesn't prove who committed the theft. Both can strengthen your file when they accurately match your account and financial records.

When making a report, provide facts rather than guesses. Include dates, accounts, amounts, communications, and documents you can verify. Ask for a report or confirmation number, and keep the version you submitted.

Don't confuse the FTC report with IRS Form 14039. Form 14039 is an IRS Identity Theft Affidavit. The IdentityTheft.gov process creates a separate FTC Identity Theft Report.

Tax and government identity theft records

Tax-related identity theft may create a different paper trail from credit fraud. Useful evidence includes:

If you receive IRS Letter 4883C, 5071C, or 5747C, respond as soon as possible using the instructions in the letter. If you receive Letter 5447C, follow its instructions; the letter may provide an option to mail documentation to the address it lists. Don't send sensitive documents to an address or phone number from an unsolicited message.

The Taxpayer Advocate Service's identity theft guidance says that if you have filed a police report, you can submit it to the IRS instead of Form 14039. Follow the current IRS instructions for your situation rather than sending both documents automatically.

For suspected misuse of a driver's license, passport, Social Security number, or government benefit, save the agency's notice, case number, and any record showing an unauthorized address or application. The relevant agency's process determines what it will release and what documentation it accepts.

Medical identity theft can be documented with an explanation of benefits, provider bills, appointment records, prescriptions, or insurance correspondence for care you didn't receive. Ask the provider or insurer to investigate and correct the record.

Match the evidence to the type of identity theft

Problem Strong evidence First contact
New credit account or collection Credit report, creditor notice, FTC report, and proof of identity Creditor and each credit reporting company that lists it
Unauthorized bank, debit, or ACH activity Statement, transaction details, account alerts, and prompt dispute confirmation Bank or credit union
Fraudulent tax return IRS notice, tax records, income mismatch, and identity-verification correspondence IRS using the notice's instructions
Account takeover Login history, password-reset messages, device alerts, recovery emails, and provider case number Service provider, bank, or mobile carrier
Medical identity theft Explanation of benefits, medical bills, and provider records Insurer and healthcare provider
Misused government ID or benefit Agency notice, application record, altered address, and police report if available Issuing agency and law enforcement

One incident can involve several categories. For example, a stolen email account may lead to a bank takeover and new credit applications. Keep one timeline, but send each organization only the documents it needs.

Payment rules depend on the payment rail

For unauthorized electronic fund transfers, notify the financial institution as soon as you notice the problem. Regulation E covers certain consumer electronic transfers, including many ATM, point-of-sale, and ACH transactions. The NCUA's Regulation E guide explains the general scope.

Don't assume one dispute rule applies to every payment:

Tell the institution whether you authorized the transaction. Keep the date and method of your notice because timing can affect available protections. Ask how to submit written notice, how the investigation will work, and where to send supporting documents.

How to build an evidence file step by step

1. Secure the affected accounts

Use a trusted device to change your email password first, then update financial and other important accounts. Turn on multifactor authentication, sign out unknown devices, and contact your mobile carrier if you suspect a SIM swap.

Ask the credit reporting companies about a fraud alert or freeze. These measures may limit additional damage, but they shouldn't replace a prompt bank, creditor, or IRS report.

2. Create a dated timeline

Start with the first suspicious event and record:

Date and time What happened Supporting record Action and case number
Date noticed Unrecognized account or transaction appeared Statement or credit report Dispute submitted
Date reported Fraud department received notice Email, letter, or call record Case number
Follow-up date Company requested or rejected documents Written response Next action

Record what you know and label assumptions as unconfirmed. A clear timeline helps prevent inconsistent dates or explanations in later disputes.

3. Preserve the original records

Keep the original statement, letter, email, or downloaded file. Screenshots can show an alert or changing webpage, but they may omit dates, web addresses, or account details.

For suspicious emails, save the complete message or original file if your email service allows it. For texts and app notifications, capture the sender, date, time, and surrounding messages. Don't click a suspicious link just to collect more evidence.

Send copies rather than irreplaceable originals. Store documents securely and provide personal information only as required by the recipient's official instructions.

4. File the reports that fit the incident

Use IdentityTheft.gov for an FTC report. File a police report when an organization requests one or when the facts involve stolen documents, threats, losses, or a law-enforcement investigation. Report tax fraud through the IRS process and contact the relevant bank, creditor, insurer, provider, or agency.

You don't have to wait for a police report before notifying a bank or creditor. Delaying the first notice can make account recovery harder and may affect available protections.

5. Send focused disputes

Identify each fraudulent account or transaction separately. State that you didn't authorize it, explain when you discovered it, and list the attached documents.

A factual statement could read:

I did not open, authorize, or benefit from this account or transaction. I discovered it on [date]. Please investigate, correct or remove information that isn't mine, and tell me what additional documentation you require.

Use only statements that are true. Don't include more personal information than the recipient's official instructions require.

6. Track every response

Keep the submission date, delivery method, representative's name, confirmation number, and promised follow-up. Save denial letters and requests for more information. If a company says your evidence is insufficient, ask in writing which specific document or fact is missing.

If a fraudulent account remains on a credit report, dispute it with the creditor that furnished the information as well as with each credit reporting company that lists it. If the problem remains unresolved, consider a complaint to the appropriate regulator, help from a nonprofit legal-aid program, or advice from a qualified consumer attorney.

Digital evidence can support a case, but it has limits

Login histories, password-reset messages, device alerts, IP addresses, shipping details, call records, and account-recovery emails can show how an account was accessed. Ask the company to preserve relevant records if an investigation is still open.

These records are supporting evidence, not automatic proof of a person's identity:

Don't pay an unknown service that promises to "prove" identity theft or recover money before checking its credentials. An institution's own access logs and transaction records may be more useful than a marketing report.

Common evidence mistakes to avoid

Frequently asked questions

Is a police report required to prove identity theft?

Not always. A bank, credit reporting company, or government agency may accept other records, while another organization may specifically request a police report. File one when it is requested or when the incident involves stolen documents, threats, losses, or a law-enforcement investigation.

Do I need to identify the thief?

Usually not for the first recovery steps. Banks, creditors, credit reporting companies, and the IRS generally need evidence about the unauthorized activity and your identity. Identifying and prosecuting the person is a law-enforcement matter.

Is a suspicious charge by itself proof of identity theft?

It proves that a charge occurred, not necessarily that identity theft caused it. Check for merchant errors, recurring subscriptions, authorized users, and family or household access. If you still didn't authorize the charge, report it promptly and let the institution investigate.

Is the FTC report the same as IRS Form 14039?

No. The FTC Identity Theft Report documents a consumer's identity-theft complaint and recovery steps. Form 14039 is an IRS affidavit used in certain tax-related identity-theft situations. If you have a police report, the IRS may allow you to submit it instead, subject to its current instructions.

Can a credit freeze or fraud alert prove identity theft?

No. A freeze or fraud alert is a preventive measure. It can help limit new-account fraud, but it doesn't establish that an existing account or transaction was unauthorized.

What should I do if an organization rejects my evidence?

Request the decision and the exact missing information in writing. Correct factual errors, resend the documents through the official channel, and keep delivery records. For a persistent credit-reporting or financial-account problem, consider the appropriate regulator, nonprofit legal aid, or a qualified attorney who handles consumer issues. Start with the record showing the problem, then send the first prompt notice before spending time on less relevant evidence.