Identity theft isn't reported through one universal complaint form. For a U.S. case, start by contacting the company where the fraud occurred, then file a free report with the Federal Trade Commission at IdentityTheft.gov. Add a police report, IRS Form 14039, or an IC3 complaint only when the facts fit that route.
Place a credit freeze or fraud alert and preserve your evidence while you report. You don't need to know who stole your information or have every document before you begin. State what you know, identify what's uncertain, and update the record as new facts emerge.
If money is moving now: Call the bank, card issuer, payment provider, or other company using a trusted number from your card or statement. Don't rely on a number in a suspicious email or text.
Choose the right identity theft complaint route
| What happened | First contact or report | What it does |
|---|---|---|
| An existing bank, card, loan, or payment account was misused | The company or financial institution | Secures the account and opens its fraud or unauthorized-transaction process |
| Someone opened accounts or used your personal information | FTC and the credit bureaus | Creates a recovery plan and helps document and correct identity-theft information |
| You need a local law-enforcement record | Local police or the agency with jurisdiction | Creates a police report that a company, credit bureau, or other agency may request |
| Someone used your information for a federal tax return or refund | IRS | Handles tax-related identity theft through its own process |
| The theft involved phishing, hacking, an online scam, or another cyber-enabled crime | IC3 | Reviews the complaint and may share it with law enforcement or partner agencies |
You can file more than one report. An FTC report doesn't replace a police report, an IRS filing, or a complaint to a bank.
Stop ongoing misuse
Contact every company where you see unauthorized activity. Ask it to:
- Lock, close, or secure the affected account
- Stop pending transfers or transactions when possible
- Replace a card or account number
- Reset the login and review recovery email addresses and phone numbers
- Open a fraud investigation and give you a reference number
- Explain how to submit a written dispute and which documents it needs
For bank, debit, electronic-transfer, or payment-app fraud, ask about the company's reporting method and deadline. Reporting quickly can affect how the institution handles the claim, so don't wait for your FTC or police report.
Secure the email account connected to your financial accounts first. Use a new password, turn on multifactor authentication, review logged-in devices, and remove unfamiliar recovery methods. Save suspicious messages, account alerts, statements, and website addresses before deleting anything.
File an FTC identity theft report
Go to IdentityTheft.gov and complete the intake questions. Describe the type of information used, the accounts or transactions involved, when you noticed the problem, and which companies you contacted.
After you finish:
- Download or print the FTC Identity Theft Report and any other documents the site provides.
- Save the personalized recovery plan.
- Follow the plan's actions in order, including contacting businesses and disputing accounts.
- Keep a copy of everything you submit and record each response.
An FTC report is useful evidence, but it isn't a police investigation. It also doesn't automatically close an account, remove an item from a credit report, recover money, or notify the IRS. Those steps still require separate action.
Request a police report
Call the local police department's nonemergency number before visiting. Ask whether it takes identity theft reports online, by phone, or in person and whether another agency has jurisdiction. Procedures differ by department and state, so there isn't one reliable nationwide requirement.
Bring copies of:
- Your government-issued identification
- Proof of address, if requested
- The FTC Identity Theft Report, if available
- A short timeline of what happened
- Account statements, collection letters, bills, and transaction records
- Relevant emails, text messages, screenshots, and contact information
Give the officer a factual account. Separate confirmed fraud from suspicious activity you haven't verified. Ask for the report number, a copy of the report, and instructions for obtaining additional copies.
You don't have to wait for a police report before contacting the FTC, banks, creditors, or credit bureaus. A company or bureau may request the report later, and a police report can help document the incident. If an agency declines to take a report, note the date, agency, and reason, then continue the other recovery steps.
Report tax-related identity theft to the IRS
Use the IRS route if someone used your Social Security number or other personal information to file a tax return, claim a refund, claim a dependent, or create another federal tax problem.
Read the IRS Identity Theft Guide for Individuals and the IRS guidance on when to file Form 14039. The IRS says taxpayers may file Form 14039, Identity Theft Affidavit, online or complete the paper form and mail or fax it as directed.
Follow the instructions on any letter from the IRS. Keep the form, notice, and supporting documents together, and use only contact information from IRS.gov. An IRS Form 14039 is for tax-related identity theft; it isn't a general substitute for reporting a stolen credit card, bank account, or email account.
File an IC3 complaint for cyber-enabled crime
File at the IC3 complaint site when the identity theft involved an online scam, phishing, hacking, account takeover, fraudulent website, or another internet-related crime.
Include the facts that are most useful to investigators, such as:
- Dates and times
- Email addresses, usernames, phone numbers, and website addresses
- How the person contacted you
- Payment details and transaction records
- The accounts or information that were accessed
- Names or identifying details of the suspected person, if known
- Copies of relevant messages and documents
Save the confirmation screen and a copy of what you submitted. According to the IC3 FAQ, analysts review complaints and may forward them to law enforcement and partner agencies. IC3 doesn't conduct investigations and can't provide the investigative status of a complaint. It also may not respond directly to every person who files.
An IC3 complaint doesn't secure your bank account or correct your credit report. Continue working with the affected company, the FTC, and local police.
Credit freezes, fraud alerts, and credit reports
A credit freeze and a fraud alert do different jobs:
| Tool | What it does | Important limit |
|---|---|---|
| Credit freeze | Restricts access to your credit file for most new-credit applications | It doesn't close or monitor an existing bank, card, email, or payment account |
| Fraud alert | Tells potential creditors to take additional steps to verify an applicant's identity | It's temporary and doesn't block every new account |
| Credit report review | Helps you find unfamiliar accounts, inquiries, addresses, or collections | It won't reveal every type of account takeover |
A freeze is free. Follow the FTC's credit freeze and fraud alert guidance and place a freeze with Equifax, Experian, and TransUnion if you want all three reports protected. A freeze remains until you ask the bureaus to remove it.
A fraud alert is useful when you want lenders to verify applications more carefully. It can be renewed, and an FTC identity theft report or police report may be needed for certain longer-term protections. The FTC guidance explains the current bureau process.
Review all three credit reports through AnnualCreditReport.com. The reports may contain different information. Look for accounts you didn't open, hard inquiries you don't recognize, unfamiliar addresses, collection accounts, and changes to existing accounts.
Dispute fraudulent accounts
Handle the creditor and the credit bureaus separately:
- Contact the creditor or account provider. State that you didn't open or authorize the account or transaction. Ask for the fraud department, account closure or security measures, and written confirmation.
- Dispute the entry with every credit bureau that reports it. Use the bureau's official dispute or identity-theft instructions. Include the account name and number's last four digits, the dates involved, a copy of your FTC report or police report when requested, proof of identity, and proof of address.
- Dispute directly with the company that furnished the information. Use the address or online process listed for disputes, not an unrelated customer-service address.
- Keep a tracking log. Record the date sent, delivery confirmation, documents included, response, and next action.
- Review the reports again. Confirm that the fraudulent information was corrected or removed and that no related account remains.
Send copies rather than originals. Don't email a full Social Security number or identity document unless the recipient provides a secure method and specifically requests it. If a bureau or creditor rejects the dispute, ask for the reason in writing, correct missing information, and resubmit through its formal process.
Keep an identity theft evidence file
A simple chronological file is more useful than a large pile of unorganized screenshots.
| Keep | Record |
|---|---|
| Timeline | When you noticed the issue and each action you took |
| Account evidence | Company name, account type, last four digits, dates, amounts, and statements |
| Communications | Names, departments, reference numbers, dates, and promised follow-ups |
| Reports | FTC, police, IRS, and IC3 submissions and confirmations |
| Identity documents | Copies sent, the recipient, the date, and the secure submission method |
Don't alter original emails or messages. Save screenshots and, when possible, download statements or message records showing the date and sender.
FTC documents versus the IRS identity theft affidavit
These documents serve different purposes:
- FTC Identity Theft Report: A general record of identity theft created through IdentityTheft.gov, along with a personalized recovery plan.
- Business affidavit: A company may ask for its own fraud affidavit or a statement about a particular account. Complete the company's form if it requests one.
- IRS Form 14039: The IRS affidavit for qualifying tax-related identity theft.
Start with the official FTC or IRS website rather than a third-party "free affidavit" download. Don't notarize a document or send extra sensitive information unless the receiving company, police department, or IRS instructions require it.
Short identity theft complaint letter template
Use the recipient's secure portal or its published dispute address. Replace the placeholders and attach only relevant copies.
Subject: Identity theft involving [company or account ending in XXXX]
I'm reporting an account or transaction that I didn't open or authorize. I discovered it on [date]. The relevant dates and amounts are [brief facts].
Please secure the account, investigate the identity theft, and tell me what documents you require to complete your review. If this information is reported to a credit bureau, please identify the correct dispute process and confirm the action taken.
Attached are copies of [FTC Identity Theft Report, police report, statement, notice, or other evidence].
Please send written confirmation and use [safe contact method] for follow-up.
[Full name]
[Mailing address]
[Phone or email]
[Date]
A realistic recovery timeline
There's no single identity theft recovery deadline. The company, police department, IRS, credit bureau, and IC3 each follow different processes.
- Same day: Contact the affected company, secure email and financial accounts, preserve evidence, and begin the FTC report.
- Next few days: Place freezes or alerts, obtain credit reports, dispute obvious fraudulent entries, and request a police report if useful or required.
- Following weeks: Respond to document requests, follow up using reference numbers, and check for related accounts or notices.
- Until resolved: Keep the freeze or alert in place as appropriate, monitor statements and reports, and retain written confirmation of every correction.
Don't rely on promises that every account will be removed in 30, 90, or 180 days. IC3 may not provide a status update, police procedures vary, and tax matters have their own review process.
Common mistakes to avoid
- Reporting only to the FTC while leaving the affected bank or creditor uninformed
- Assuming a credit freeze will stop transactions on an existing account
- Sending original identity documents
- Using a phone number or link supplied in a suspicious message
- Filing IRS Form 14039 for a problem that has nothing to do with taxes
- Paying a third party for an FTC report or a guaranteed credit-report deletion
- Guessing about facts instead of clearly labeling unverified information
Frequently asked questions
Do I need to file with the FTC, police, IRS, and IC3?
No. File with the agencies that match the type of theft. The FTC is the general starting point; the IRS is for tax identity theft, IC3 is for cyber-enabled crime, and police handle local law-enforcement reports.
Can I file an FTC report before getting a police report?
Yes. Start with the affected company and IdentityTheft.gov. A police report can be obtained separately if a business, bureau, or agency requests it.
Is an FTC Identity Theft Report the same as a police report?
No. The FTC report documents the identity theft and provides a recovery plan. A police report is created by a law-enforcement agency and follows local procedures.
What should I do if I don't know who stole my information?
Report the accounts, transactions, dates, and evidence you do know. You can identify the suspected person as unknown and update the companies or agencies if new information appears.
General information for U.S. consumers, not legal or tax advice. Start with the company where the fraud occurred, then save the FTC report and use it to organize the remaining disputes.