If someone used your personal information without permission, file at the FTC's free IdentityTheft.gov tool, then contact every company or agency that was actually affected. The FTC filing gives you an Identity Theft Report and a recovery plan. It does not, by itself, reverse a charge, remove a credit account, or open a police investigation.

These steps are for U.S. consumers. Deadlines and remedies change with the type of fraud: a credit card, debit transaction, electronic transfer, wire, tax return, benefits account, or another service.

Identity theft complaints aren't one filing

You may need several reports or disputes, and they don't stand in for each other.

Report or filing Main purpose What it does not do
FTC Identity Theft Report Documents the theft and creates a recovery plan It doesn't automatically refund money or close accounts
Police report Records suspected criminal activity and may satisfy a company's documentation request It doesn't correct credit reports by itself
Bank or creditor dispute Challenges an unauthorized charge, account, or application It doesn't notify other businesses
IRS Form 14039 Alerts the IRS to suspected individual tax-related identity theft It doesn't address bank, credit, or benefits fraud
IRS Form 14039-B Reports business identity theft involving an EIN It isn't the form for an individual's SSN or ITIN

An FTC report doesn't pause a credit-card billing deadline. A police report doesn't replace a written dispute with the card issuer.

What to do first

If money is still leaving an account, or someone can still open your email, skip the paperwork until those doors are closed.

Call the financial institution on a number you already trust: the back of the card, a statement, or the bank's own website. Ask them to lock the account, replace the card, stop recurring debits, or try a transfer recall.

Secure email before you reset other passwords. Password-reset links often go there. Change the password from a device you trust, turn on multifactor authentication, check recovery email addresses and phone numbers, and sign out of sessions you don't recognize.

Save statements, transaction records, emails, letters, screenshots, shipping details, call logs, and account notices. Write down the date you noticed the problem and every reference number.

Then file the FTC report with the facts you have, even if you don't yet know how far the theft goes. Don't click a link in a suspicious message to report fraud. Type the official website yourself or use a verified phone number.

How to file an FTC identity theft complaint

What you create at IdentityTheft.gov is an Identity Theft Report, not a police complaint.

  1. Go to IdentityTheft.gov and select the type of identity theft involved.
  2. Describe the accounts, transactions, notices, dates, and companies connected with the incident.
  3. Stick to what you know. If you don't know who committed the fraud, say so instead of guessing.
  4. Save or print the Identity Theft Report, report number, and personalized recovery plan.
  5. Use that plan to contact creditors, credit bureaus, banks, government agencies, and other affected organizations.

You can also call the FTC at 1-877-IDTHEFT (1-877-438-4338). Spanish-language help is available through RobodeIdentidad.gov.

The report is useful evidence. It is not a refund request or a universal dispute form, so you still have to meet each company's notification and documentation rules.

When to file a police report

Creditors, debt collectors, insurers, and credit bureaus sometimes ask for a police report. Ask your local police or sheriff's department how it handles identity theft; some take reports online, others want an appointment.

Bring or have ready:

Request the incident or report number, and a copy if the department provides one. Keep it with your FTC documents.

A department may send you to another agency for jurisdiction. If that happens, record the date, department, employee name if you get one, and the instructions. Then ask the creditor or bureau whether it will accept the FTC report and other evidence while you pursue the correct police report.

Disputing fraudulent charges and accounts

Notify the company that handled the transaction without waiting for the FTC or police to finish. The payment method controls what happens next.

Payment or account type What to do
Credit card Send a written billing-error notice to the billing-inquiries address on the statement. For FCBA protections, written notice generally must reach the issuer within 60 days after the statement showing the error was sent.
Debit card or electronic transfer Notify the bank immediately and ask how to submit an electronic-transfer error claim. Timing affects available protections, and the 60-day statement period can matter.
Wire transfer or peer-to-peer payment Contact both the provider and your bank immediately and request a recall or fraud review. Credit-card billing rules don't automatically apply.
New credit account or loan Contact the lender, report the account as identity theft, and dispute the account with every credit bureau that lists it.
Utility, mobile, or other service account Contact the provider's fraud department, request account closure or correction, and ask for written confirmation.

A phone call can stop further losses. It may not preserve a written billing dispute. Follow the statement instructions and send the notice through a trackable method or the company's secure upload system. Don't send original documents.

Sample identity theft dispute wording

You can adapt this short statement for a creditor or service provider:

Subject: Identity theft dispute for account ending XXXX

I did not open, use, or authorize the account or transactions listed below. Please investigate the activity, secure the account, and provide written confirmation of the result.

Account or transaction:
Dates and amounts:
FTC Identity Theft Report number:
Police report number, if available:

I have included the requested supporting documents. Please send your response to the address listed above.

For a credit-card billing dispute, send the letter to the billing-inquiries address, which may be different from the payment address. Keep a copy of the letter, attachments, delivery confirmation, and the issuer's response.

Neither an FTC report nor a police report guarantees a refund. The result can depend on the payment rail, whether the transaction was truly unauthorized or was authorized after a scam, how quickly you reported it, and the provider's investigation.

Correcting fraudulent information on your credit reports

A freeze doesn't delete fake accounts. You have to dispute the inaccurate items.

Pull current reports from Equifax, Experian, and TransUnion. Look for unfamiliar accounts, hard inquiries, collections, addresses, employers, and contact details. Dispute each item with every bureau that lists it; their files often don't match. Tell the company that furnished the information as well.

Include a copy of your FTC report, a police report if you have one, identification, proof of address if requested, and a clear list of what you want corrected. Save copies and check the reports again after the dispute is processed.

Use the instructions on each report or the FTC's guidance for disputing credit-report errors. Send documents through a verified secure channel, and redact unrelated sensitive information when the recipient doesn't need it.

Credit freeze versus fraud alert

The FTC's credit freeze and fraud alert guidance explains the difference:

Tool Duration How to set it up Best use
Initial fraud alert One year Contact one of the three major credit bureaus; that bureau should notify the other two A quick warning when you suspect misuse
Extended fraud alert Up to seven years Apply with an identity theft report and the required documentation A longer warning after confirmed identity theft
Credit freeze Until you remove it Contact Equifax, Experian, and TransUnion separately Blocking most new creditors from accessing your file

A fraud alert asks businesses to take extra steps to verify your identity. It doesn't block access to your file. A freeze is stronger against new-credit applications, but it won't stop an existing-account takeover, tax fraud, medical identity theft, or misuse of a bank account. It also doesn't erase accounts already on your report.

If you apply for credit while a freeze is active, you'll need to lift it temporarily or give the lender another permitted way to pull the file.

Tax-related identity theft and Form 14039

A fraudulent tax return is a separate track from bank and credit disputes.

Individual taxpayers

Consider Form 14039, Identity Theft Affidavit, when someone may have used your SSN or ITIN for a tax-related purpose, such as filing a fraudulent federal return. The IRS explains when to file and offers online and paper options in its identity theft affidavit guidance.

If you received an IRS letter such as 5071C, 4883C, or 5747C, follow that letter's verification steps first. Don't automatically send a separate Form 14039 without checking those directions. A 5747C letter may require in-person identity verification at a Taxpayer Assistance Center.

State tax problems go to the state tax department. An IRS filing doesn't fix a state tax account.

Businesses

Use Form 14039-B, Business Identity Theft Affidavit, when someone misuses a business EIN or files business tax documents without authorization. Use the current IRS form and instructions rather than adapting the individual form.

After the immediate issue is resolved, ask the IRS about an Identity Protection PIN for future federal returns. Keep tax records and IRS letters in the same evidence file as your other identity theft documents.

Identity theft involving benefits, medical care, or debt

The reporting route depends on the account:

One agency's case number usually doesn't notify the others. Send each organization the documents it asks for.

If a bank, creditor, or bureau denies your dispute

Ask for the decision and reason in writing, and which document or fact the company thinks is missing. Resubmit a focused package that answers that reason instead of sending the same pile of papers again.

Escalate through the company's formal complaint or executive-resolution channel. Dispute inaccurate credit reporting separately with each bureau and the information furnisher. If the company still doesn't address the issue, identify the state or federal regulator that supervises that institution and use its consumer complaint process.

Keep a contact log with dates, names, departments, promises, deadlines, and reference numbers. A clear timeline is often more useful than repeating the same large bundle.

Protecting yourself after the filing

Keep a credit freeze in place if you don't expect to apply for new credit soon. Turn on transaction and login alerts for financial, email, tax, and mobile accounts. Use unique passwords and multifactor authentication.

Review all three credit reports and your financial statements regularly. After an account takeover, check email forwarding rules, recovery settings, and authorized users. Replace compromised cards, account numbers, passwords, and government credentials as the issuing organization directs.

Store reports and correspondence securely, and shred duplicate documents that contain personal information. Be cautious of paid "recovery" services that promise guaranteed refunds or credit deletion. The FTC reporting tool is free.

Common mistakes to avoid

Frequently asked questions

Is an FTC identity theft report enough?

No. It documents the incident and creates a recovery plan, but you still have to contact the affected bank, creditor, credit bureau, tax agency, or service provider, and meet that organization's deadline.

Do I need a police report?

Not always for the initial FTC report. A creditor, bureau, insurer, or other organization may request one. Ask that organization what it accepts.

Should I file Form 14039 after receiving an IRS letter?

Follow the letter first. Letters such as 5071C, 4883C, and 5747C generally send you through identity verification, so don't automatically submit a separate affidavit.

Will a credit freeze stop all identity theft?

No. It mainly restricts access for new-credit applications. It doesn't stop account takeovers, unauthorized bank transfers, tax fraud, benefits fraud, or misuse of an existing account.

How long will recovery take?

There's no single timeline. FTC reporting is separate from the investigation clocks used by banks, credit bureaus, service providers, and the IRS. Report promptly and meet each payment or dispute deadline.

Official resources

This information describes general U.S. consumer procedures, not legal or tax advice. Secure any account that's still being misused, save your FTC report, and contact the affected company before its dispute deadline.