An identity theft complaint rarely fits on one form. For U.S. consumers, the response usually combines a bank notice, an FTC report, credit protection, and sometimes a police or IRS filing.
If money is leaving a checking account or another account through a debit card, ATM, ACH, or electronic payment, call the bank or credit union first. Then use IdentityTheft.gov, protect your credit, and add a police or IRS process when the facts call for it.
The FTC report puts the facts in one place and creates a recovery plan. It won't freeze your credit, reverse a transaction, remove an account, or open a police investigation. Different organizations handle those jobs.
Start in the right order
Act on the active loss first. Then build the paper trail.
- Stop the money movement. Call the bank, credit union, card issuer, or payment provider through a number you trust. Ask about locking the account, replacing the access device, and opening an unauthorized-transaction case.
- Secure compromised accounts. Change passwords from a trusted device, sign out of unfamiliar sessions, and turn on multifactor authentication. Start with email because it may unlock other accounts.
- Preserve the trail. Keep statements, credit reports, emails, texts, screenshots, letters, and a dated timeline. Save suspicious messages before deleting them.
- Make the FTC report. Complete the report at IdentityTheft.gov. Save the report, any confirmation number, and the recovery plan.
- Protect your credit. Place a credit freeze or fraud alert, then review your credit reports for unfamiliar accounts and inquiries.
- Add the right agency. File a police report if a creditor or investigator requests one, or if local law enforcement needs the information. Contact the IRS separately for tax-related identity theft.
Don't wait for the FTC or police before notifying a bank about an unauthorized transfer. Bank deadlines can matter.
Choose the complaint that matches the problem
Identity theft has no single complaint channel. Start with the organization that can address the specific harm.
| Problem | First contact | What the report or notice does |
|---|---|---|
| Someone used your personal information generally | FTC through IdentityTheft.gov | Creates an FTC Identity Theft Report and recovery plan |
| Money left a checking, debit, ATM, or ACH account | Bank or credit union | Starts the payment investigation and helps protect your rights under the applicable rules |
| A new account or inquiry appears on your credit file | Credit bureau and the company involved | Starts a fraud dispute, alert, freeze, or identity-theft block request |
| A creditor asks for local documentation | Local police or sheriff | May provide an incident report or case number |
| Someone filed, or may have filed, a tax return using your information | IRS | Handles tax identity theft through its own verification and Form 14039 procedures |
Several tracks can run at once.
An FTC report does not replace timely bank notice. A police report does not replace a credit bureau dispute.
File the FTC identity theft report
Use IdentityTheft.gov as the federal starting point for most U.S. identity theft cases. The questions cover what happened, which information or accounts were affected, when you noticed the problem, and which companies you already contacted.
Enter exact facts when you have them. Mark dates or amounts as estimates if you're unsure. Don't guess.
Save the completed report and recovery plan in two places. Turns out, creditors, banks, and credit bureaus may use the report as supporting evidence, but it is not a police report, notarized affidavit, refund guarantee, credit freeze, or account-removal request.
Gather documents without exposing more information
Do not send every document to every recipient. Send only what the organization's instructions require, preferably through a secure upload portal.
| Document | Why it helps | Handling tip |
|---|---|---|
| Government photo ID | Confirms your identity | Use the recipient's secure method; don't send it to an unverified address |
| FTC Identity Theft Report | Describes the suspected theft | Save the full file and any confirmation number |
| Bank or card statements | Shows unauthorized transactions | Mark the relevant entries and redact unrelated details |
| Credit reports | Identifies fraudulent accounts and inquiries | Download reports from AnnualCreditReport.com |
| Timeline and correspondence | Connects dates, calls, letters, and case numbers | Keep a simple dated log |
| Police report or incident number | Supports requests that require local documentation | Ask for a copy or written instructions for obtaining one |
Never put a full Social Security number in ordinary email. If an agency legitimately needs it, use that agency's secure channel and follow its identity-verification instructions.
File a police complaint when it helps
Call the local department before visiting. Procedures vary: the department may use an online report, an incident number, or a different term instead of an identity theft affidavit.
Bring your photo ID and the records that support the incident, including the FTC report, relevant statements, credit report pages, screenshots, and timeline. Stick to what you know. Ask for the case number and a copy of any report created.
A police report can help when a creditor demands local documentation, when the theft involves a known person, or when an investigator needs records. It isn't required for every credit freeze or bank notification.
If the department says another jurisdiction should handle the matter, record the date, representative's name, and instructions. Give that information to the creditor or agency requesting the report.
Freeze your credit and consider a fraud alert
Freezes and fraud alerts do different jobs. A freeze restricts access to your credit file, while an alert asks businesses to add verification steps.
| Option | What it does | Main limit |
|---|---|---|
| Credit freeze | Restricts access to your credit file for most new-credit applications | It doesn't remove an existing fraudulent account or stop unauthorized withdrawals |
| Fraud alert | Tells businesses to take extra steps to verify your identity before opening new credit | It doesn't block every application or erase inaccurate information |
The FTC's credit freeze and fraud alert guidance explains how to contact Equifax, Experian, and TransUnion. A freeze is free and remains in place until you ask the bureau to remove it. An initial fraud alert generally lasts one year; an extended alert may be available to qualifying identity theft victims.
Check all three credit reports. A freeze protects future applications. A separate dispute or block request addresses information already appearing on a report.
For a federal identity-theft block, identify each fraudulent item and provide the materials required by 15 U.S.C. 1681c-2. The packet generally includes proof of identity, a copy of an identity theft report, identification of the information to be blocked, and a statement that the information does not relate to your transaction. The statute generally requires the bureau to block the identified information within four business days after receiving the required packet.
Notify the bank about unauthorized electronic transfers
Call the financial institution as soon as you notice an unauthorized electronic transfer. Regulation E covers many electronic fund transfers, including debit card transactions, ATM withdrawals, and some ACH payments.
| Situation | Timing that matters | Possible liability or investigation rule |
|---|---|---|
| A lost or stolen access device, reported promptly | Notify the financial institution within two business days after learning of the loss or theft | Liability generally cannot exceed the lesser of $50 or the amount transferred before notice |
| A lost or stolen access device, reported later | Notice comes after the two-business-day period | Liability may rise to the lesser of $500 or unauthorized transfers made after the loss and before notice |
| An unauthorized electronic transfer appears on a statement | Notify the bank no later than 60 days after the statement was sent | Waiting longer can expose later transfers to greater liability |
| The bank asks you to confirm the dispute in writing | Send the confirmation within 10 business days | Without it, the bank may not have to provide provisional credit during its investigation |
| The bank investigates the dispute | Follow the bank's instructions and preserve your records | The bank generally must resolve the matter within 45 days, subject to exceptions |
See the CFPB guidance on unauthorized transactions and 12 CFR 1005.6.
These rules depend on the payment method covered by Regulation E. They don't create one universal deadline for every credit card charge, check, wire, cryptocurrency transfer, or peer-to-peer payment. Tell the institution exactly how the transaction occurred and follow its written dispute process.
Thing is, the FTC report does not start the bank's notification clock. Call the institution first when an electronic transfer is involved.
Handle tax identity theft through the IRS
Tax identity theft has its own IRS track. If someone may have used your information to file a fraudulent federal tax return, review the Form 14039 guidance and complete the form online or on paper if the IRS instructions call for it.
If the IRS sends Letter 5071C, 4883C, or 5747C, follow the verification instructions in that letter. The IRS may direct you to verify your identity online, by phone, or in person.
A general FTC report does not replace the IRS procedure. A data breach alone also does not determine which IRS form to use. Read the official notice and keep copies of everything submitted.
Understand state and local differences
The FTC and federal credit rules apply nationwide, but police and state agency procedures vary. A department may use an online portal, require an appointment, limit reports to local incidents, or ask for a particular form.
The federal sources cited here do not establish a universal 30-day or 60-day deadline for every police complaint. Check the local police department or state attorney general for the procedure where the incident occurred.
If a creditor asks for a notarized affidavit, ask whether it wants a specific company form, an FTC report, a police report, or all three. A generic letter may not satisfy the request.
Request records from a business
Transaction records may help show who opened an account or made a purchase. Section 609(e) of the Fair Credit Reporting Act can require covered businesses to provide identity-theft transaction records to victims or law enforcement.
Review the FTC guidance on identity-theft transaction records before making the request. You may be able to authorize law enforcement to obtain the records or ask the business to send a copy directly to a law enforcement officer.
This request is separate from a bank dispute or credit report block. Keep the request, delivery proof, and response with the rest of your case file.
Templates you can adapt
Use these samples as starting points. Replace the brackets and send each document through the bank, creditor, or bureau's required method.
Bank or creditor notice
[Date]
[Company name]
[Secure mailing address or portal]
Re: Identity theft dispute for account ending in [last four digits]
I dispute the following account or transaction as unauthorized:
Date: [date]
Amount: $[amount]
Account or reference number: [number]
I did not authorize this account or transaction. I discovered the problem on [date]. Please open an identity theft case, restrict further activity where appropriate, and tell me what additional documents or written confirmation you need.
Please confirm receipt and provide a case number. I have enclosed or uploaded [FTC Identity Theft Report, statement page, police report, or other requested document].
Name: [name]
Address: [address]
Phone or secure email: [contact information]Credit bureau block request
[Date]
[Credit bureau]
[Address or secure submission method]
Re: Request to block information resulting from identity theft
Please block the following information from my credit file under FCRA Section 605B:
Company: [company]
Account number: [account number]
Item or inquiry: [describe it]
I did not open this account or authorize this transaction. The enclosed documents support my request:
1. Proof of identity
2. Copy of my identity theft report
3. Identification of the fraudulent information
4. My signed statement that the information does not relate to my transaction
Please confirm receipt and tell me if you need anything else through your secure process.
Name: [name]
Address: [address]
Date of birth: [only if required by the bureau]
Signature: [signature]Don't include a full Social Security number in a template unless the recipient's secure instructions specifically require it.
Track follow-up instead of relying on memory
Keep one physical or digital folder for the FTC report, statements, credit reports, letters, screenshots, and call notes. Use a simple log for the date, department, representative, case number, promised action, and next deadline.
Confirm that each recipient received your submission. Then check whether the fraudulent account, transaction, or inquiry was actually corrected. A delivery confirmation is not the same as a completed investigation.
To be honest, the log feels tedious until several companies ask for the same facts again. Then it saves time, even if you have to write the same thing down twice.
Common mistakes to avoid
Notify the bank before filing the FTC report if money moved. A credit freeze isn't a dispute, and an unverified email is not a safe channel for unredacted identity documents. Form 14039 isn't an automatic response to every breach. A police report may come later, while an FTC report may not satisfy a creditor's request.
Match the payment method, agency, and document request to the next action. That keeps the complaint focused and limits unnecessary exposure of your personal information.
Frequently asked questions
Do I have to file a police report?
Not for every identity theft response. You can contact the FTC, bank, credit bureau, or IRS without waiting for one.
A creditor, insurer, investigator, or local agency may request it later.
Is an FTC Identity Theft Report the same as a police report?
No. The FTC report documents the identity theft for recovery purposes. Local law enforcement creates a police report, which may contain different information.
Will a credit freeze remove a fraudulent account?
No. A freeze restricts access to your credit file for most new applications. Use a dispute or identity-theft block request for an account or inquiry already listed.
Does every tax identity theft case require Form 14039?
No. The proper IRS response depends on what happened and whether the IRS sent a verification notice.
Follow the IRS instructions for your situation.
How long will recovery take?
There is no single timeline. Bank investigations have specific rules for electronic transfers, while credit bureaus, creditors, police departments, and the IRS may use different procedures.
Track each written deadline separately.
If money moved, contact the financial institution now. Save the FTC report, add the credit protection that fits, and write down the next follow-up date.