Identity theft is usually proved by a trail of records. Connect your information to an account, application, transaction, tax return, or medical record you didn't authorize. Note when you found it. Record whom you contacted and what happened next. The person's name may never appear.
A company asks whether its record was used without permission. Law enforcement has a different job: building a case against a person. Protect the account first. Preserve the records next.
This is general information for U.S. consumers, not legal advice. The CFPB's identity theft guidance points consumers to IdentityTheft.gov for an FTC Identity Theft Report and recovery plan.
What evidence proves identity theft?
Useful evidence should answer four questions: what happened, when it happened, why it was unauthorized, and what loss or damage followed. One record rarely does everything.
| Record | What it can show |
|---|---|
| Credit reports | New accounts, hard inquiries, unfamiliar addresses, and dates |
| Bank or card statements | Unauthorized transfers, purchases, withdrawals, and account changes |
| Letters from lenders or collectors | Applications, balances, denials, collection activity, or account details |
| FTC Identity Theft Report | Your description of the incident and the recovery steps you took |
| Police or incident report | What you reported and when you reported it |
| Identity and address documents | That you are the person whose information was used |
| Emails, alerts, and call records | Password resets, login attempts, phone changes, and the discovery timeline |
The FTC Identity Theft Report organizes your description of the incident and the recovery steps. It isn't a court finding. It doesn't automatically require a refund.
Use that name unless a company gives you its own affidavit form. Some creditors, insurers, or investigators may ask for an affidavit or police report too. A police report records what you reported; it doesn't prove that a named suspect committed the crime.
What to do first
Start with the facts you have. Don't wait for a perfect file.
- Secure the affected account. Use a trusted device to change passwords, sign out other sessions, turn on multifactor authentication, and lock a card if the issuer offers that option. If someone took over your phone account, contact the carrier through an official number.
- Notify the right institution. Tell the bank, card issuer, lender, or provider exactly what happened: an unauthorized transfer, an account opened without permission, or an account takeover. Ask for a case number, written confirmation, and instructions for sending documents.
- Save the records. Download statements, credit reports, notices, emails, login alerts, and chat transcripts. Keep the originals. Work from copies.
- Complete the FTC report. Use IdentityTheft.gov to create an Identity Theft Report and recovery plan. Select only the incidents and accounts that actually apply.
- File a police report when it helps or is requested. Bring identification, proof of address, the FTC report, account records, and a dated timeline. An IC3 complaint may supplement local reporting for online crime, but it doesn't replace notice to the bank or credit bureau.
- Check your credit files. Place a freeze or fraud alert, then dispute unfamiliar accounts and inquiries with the relevant credit reporting companies.
Paperwork spreads fast. Then it spreads again. A bank may give you one case number, a bureau another, a police department an incident number, and the FTC report its own reference. Write them down as you go. You probably won't remember them later.
Deadlines depend on the type of fraud
Turns out, the payment rail sets the clock. Debit cards, electronic fund transfers, credit-card billing errors, wires, and peer-to-peer payments don't all follow the same rules. Apply the rule to the transaction you actually made.
| Situation | What to do | Timing point |
|---|---|---|
| Lost or stolen debit card or access device | Notify the financial institution and follow its fraud process | Under Regulation E, notice within two business days may limit liability to the lesser of $50 or the amount transferred before notice, in covered situations. Later notice can raise the possible limit to $500, and a missed applicable statement deadline can create more exposure. |
| Unauthorized electronic fund transfer | Report it even if the physical card is still with you | Tell the bank when you learned of the transfer and follow up in writing. |
| Credit-card billing error | Use the issuer's billing-dispute address and written process | Federal billing-error rules generally tie written notice to the statement, often within 60 days of the first statement showing the error. |
| Credit report account or inquiry | Dispute with the reporting company and the business that supplied the information | Start promptly. A standard investigation often has about a 30-day timetable, but that isn't a guaranteed removal date. |
| Tax identity theft | Follow the deadline and instructions in the IRS notice | Don't substitute a generic police report for the response procedure in the notice. |
| Medical identity theft | Notify the provider, insurer, and medical-records office | Ask for corrected records and keep every bill, explanation of benefits, and response. |
Read the CFPB's Regulation E text for federal liability rules covering certain unauthorized electronic fund transfers.
Thing is, a transfer you approved after someone tricked you may be analyzed differently from one you never initiated. Tell the bank whether you entered a code, clicked approve, gave another person access, lost a card, or saw a transfer you never made. Those details can change the review.
FTC reports and police reports do different jobs
The two reports can sit in the same file. They still do different jobs.
An FTC Identity Theft Report gives you a structured account of the incident and a recovery plan. It can support credit disputes and help explain the pattern to a bank, lender, collector, or insurer.
A police report adds a local law-enforcement record. A company may request one for an extended fraud alert, insurance claim, creditor investigation, or dispute involving a large loss. You don't need to wait for it before notifying your bank.
Write the timeline before you call or visit. Include the first date you noticed the problem, the account or application involved, the contact details shown on the record, the steps you took, and the money or services affected. Stick to facts. Guessing about the culprit can muddy an otherwise clear report.
If an agency says it can't investigate, ask whether it can provide an incident number or explain the correct reporting jurisdiction. Keep the date, department, and person's name in your notes.
How to dispute identity theft on a credit report
Pull current reports from all three nationwide credit reporting companies. Look for unfamiliar accounts, inquiries, collection entries, addresses, employers, and phone numbers. Save a copy before disputing anything.
Make the packet easy to review:
- [ ] Identify each fraudulent account or inquiry by name, number, and date.
- [ ] State that you didn't open, authorize, or benefit from the account.
- [ ] Attach copies of the FTC report, police report if available, statements, letters, and identity documents requested by the company.
- [ ] Send the dispute to the credit reporting company and the business that furnished the information.
- [ ] Use the dispute address or portal specified for credit-report disputes.
- [ ] Keep proof of delivery, confirmation numbers, and the written result.
Send copies, not originals. Redact unrelated account numbers and sensitive information when the recipient doesn't need it.
Ask whether the identity-theft blocking procedure applies. A bureau may require an identity-theft report, proof of identity, and a clear list of the fraudulent items. A simple balance or date error usually belongs in the ordinary dispute process instead.
A freeze and a fraud alert are separate tools. A freeze can help stop new creditors from accessing your file. An alert asks businesses to take extra steps to verify identity. Neither removes an existing account or proves that an account is fraudulent. A freeze stays in place until you ask the credit bureaus to remove it. The FTC's guidance on credit freezes and fraud alerts explains the difference.
Match the evidence to the identity theft
Different misuse leaves different tracks.
| Type of identity theft | Useful evidence | Next contact |
|---|---|---|
| Bank account takeover | Transaction history, login alerts, device or phone changes, and your notice to the bank | Bank fraud department |
| New credit card or loan | Credit report, application details, lender letters, and statements | Lender and credit reporting companies |
| Social Security number or employment misuse | IRS notices, wage records, employer records, and SSA information | IRS, employer, and relevant agency |
| Tax identity theft | IRS notice, tax-return records, wage information, and correspondence | Follow the IRS notice instructions |
| Medical identity theft | Bills, explanation of benefits, provider records, and disputed treatments | Provider, insurer, and medical-records office |
| Email or phone account takeover | Password-reset messages, carrier records, login alerts, and recovery emails | Email provider or mobile carrier |
Tax identity theft deserves extra care. Form 14039 isn't a universal response to every tax-related problem, so follow the IRS notice and process that match your situation.
Digital evidence, deepfakes, and account takeovers
Preserve the original digital record, not just a screenshot. Save the full email, headers when available, message thread, call log, file name, web address, and date and time. Don't edit or crop the only copy.
Ask the bank, platform, or employer to preserve relevant recordings and account logs. You may not receive all of that material. An early request can still help an investigator locate it.
A suspected deepfake may support a fraud report, especially if a video or voice call impersonated someone. It doesn't, by itself, prove who opened the account or moved the money.
To be honest, a free scanner's confidence score isn't authentication or a qualified forensic opinion. Whether a recording can be used in court depends on how it was obtained, preserved, authenticated, and connected to the dispute. Don't label a file genuine or fake without a reliable basis.
If the bank, bureau, or collector rejects the claim
Read the stated reason before sending anything else. A vague repeat complaint rarely changes the record.
| Response | Practical next step |
|---|---|
| Bank says you authorized the transfer | Ask for the written investigation result and explain precisely how the transfer occurred. Add device, account-access, or communication records that clarify what you did and did not approve. |
| Credit bureau says the item was verified | Request the result, dispute the information with the furnisher, and submit any new identity-theft evidence through the correct channel. |
| Collector demands payment | Dispute the debt in writing, state that the account resulted from identity theft, and keep the collection letters and delivery proof. |
| Police department declines an investigation | Request the incident information available, document the response, and report the fraud to the relevant bank, bureau, agency, or online-crime channel. |
After you've contacted the company, a complaint to the CFPB may create another review path for many financial products. It doesn't guarantee a refund or replace the company's formal dispute process.
Consider legal aid or a consumer-law attorney if the loss is substantial, your wages or tax refund are affected, a lawsuit has been filed, or a creditor keeps reporting the account after you supplied the required records.
Common questions
Do I need to identify the thief to prove identity theft?
Usually not for an initial bank or credit dispute. You need to show that your information was used without your authorization. Finding and prosecuting the person is a separate law-enforcement task.
Is an FTC Identity Theft Report enough by itself?
Usually not. Pair it with the account record, statements, notices, identity documents, and a clear explanation of what you didn't authorize. The report supports your account; it doesn't independently verify every disputed charge.
Do I always need a police report?
No. Some disputes can begin with the FTC report and financial records. A company may still request a police report for a particular procedure, extended fraud alert, insurance claim, or investigation.
How long does identity theft recovery take?
There is no reliable universal timeline. A card replacement, credit-report dispute, tax issue, and medical-record correction can move at different speeds. Treat an estimate such as three months or one year as a possibility, not a promise.
Can a deepfake prove identity theft?
It can help show impersonation or manipulation, but it doesn't automatically identify the person responsible. Preserve the original file and let the relevant institution or a qualified expert assess it.
Official starting points
Begin with the CFPB's identity theft guidance, the FTC's freeze and fraud alert guide, and the CFPB's Regulation E liability rule. Check the instructions for the kind of fraud involved.
Your next move
Make a dated folder before the next fraud call. Put current credit reports, statements, notices, and every confirmation number inside it.
Contact the institution handling the affected account. Give it a short, dated timeline.