Identity theft doesn't have one U.S. dispute deadline. The clock depends on where the fraud appears: a credit report, credit-card statement, bank account, or tax return.

The fastest deadlines are usually these:

• A missing debit card or other access device: notify the bank within 2 business days after learning it was lost or stolen.
• An unauthorized electronic transfer: report it within 60 days after the statement showing it was sent.
• A covered credit-card billing error: send written notice within 60 days after the statement containing the charge was mailed.
• A complete FCRA identity-theft block request: the credit reporting company generally must block the item within 4 business days after receiving the request. That is the bureau's action deadline, not a four-day limit on making your request.

Report the fraud as soon as you find it. A credit-report block, a credit-card billing dispute, and a debit-card error claim are separate processes, so completing one doesn't automatically complete the others.

Identity theft deadlines at a glance

Fraudulent accounts and inquiries on a credit reports

A credit-report entry and the underlying fraudulent account are separate problems. If someone opened a card in your name, you may need to contact the card issuer to close and investigate the account. You should also contact every credit reporting company that lists it.

The FCRA identity-theft block

The FCRA has a specific blocking process for information that resulted from identity theft. Send each reporting bureau that shows the item:

1. An identity-theft report, such as an FTC Identity Theft Report or a police report.
2. Proof of your identity.
3. A clear list of each fraudulent account, collection, inquiry, or other item.
4. A request to block the information because it resulted from identity theft.

When the request is complete, the bureau generally must block the information within 4 business days after receiving it. It can refuse or later remove the block if required information is missing, the request is materially misleading, or the item is not shown to have resulted from identity theft.

Send the request to every bureau reporting the item. Use the bureau's current dispute instructions and address; old forms and mailing addresses can cause delays. Keep the submission confirmation, your attachments, and proof of the date the bureau received the request.

A block doesn't close the fraudulent account or cancel a debt by itself. Contact the creditor or collector too. Ask it to close the account, stop collection or further activity, and investigate the identity theft.

The ordinary credit-report dispute timeline

If the identity-theft block process doesn't apply, use the ordinary FCRA dispute process. A credit reporting company generally has 30 days to investigate after receiving a dispute. The period can extend to 45 days in specified circumstances, including when you provide relevant additional information during the investigation or when the dispute is connected to certain free credit-report requests.

Dispute the item with the bureau and, when appropriate, with the company that supplied the information. A direct dispute with a creditor or collector doesn't replace a bureau dispute when the same item appears on your credit reports.

The seven-year reporting limit for many negative items isn't a deadline for disputing identity theft. Inaccurate information can be challenged while it is being reported. Accurate information may remain reportable for the legally permitted period, and bankruptcy reporting follows a different limit.

Fraud alerts and credit freezes

A fraud alert or security freeze helps prevent new-account fraud. Neither one removes an account already on your report or reverses an unauthorized charge.

• Initial fraud alert: Contact one of the three major bureaus to place a one-year alert. That bureau generally must notify the other two. You can renew the alert.
• Extended fraud alert: An eligible identity-theft victim can request an alert lasting 7 years with the required identity-theft documentation.
• Security freeze: A freeze is free, but you must place it separately with each major bureau. It stays in place until you ask the bureau to lift or remove it.

A freeze can help stop someone from opening a new account in your name. It won't stop every account takeover and won't correct information already on your report. The FTC's credit freeze and fraud alert guidance explains how to use both options.

Unauthorized credit-card charges: the 60-day FCBA rule

For an unauthorized charge on a credit card or another covered open-end credit account, send a written billing-error notice within 60 days after the statement containing the charge was mailed. The 60-day period runs from the statement date, not necessarily from the transaction date.

Use the billing-dispute address printed on the statement. It may be different from the address used for payments. Include:

• Your name and account number.
• The transaction date and amount.
• A statement that the charge was unauthorized.
• Supporting information, such as a fraud report or notice that the card was stolen.

Call the issuer right away to block additional charges, but don't rely on a phone call alone to preserve the FCBA written-notice process. The issuer generally must acknowledge the written dispute within 30 days unless it resolves the matter sooner. It normally must finish the investigation within two billing cycles and no later than 90 days.

Pay amounts that aren't disputed on time and follow the issuer's instructions for the disputed portion. Federal liability protection can depend on whether someone used the physical card or only the account information. A card issuer or card-network zero-liability policy may provide more protection than the federal minimum. The Experian explanation of the FCBA timeline provides additional background.

The 60-day FCBA rule applies to covered credit-card billing errors. It isn't the rule for debit-card or checking-account transactions.

Debit cards, ACH, and other electronic transfers

Unauthorized withdrawals from a checking account, debit-card transactions, ATM withdrawals, and many ACH transactions generally fall under the Electronic Fund Transfer Act and Regulation E instead.

Two time limits are especially important:

• Lost or stolen card or access device: Notify the financial institution within 2 business days after learning of the loss. This rule concerns the missing device; it isn't a general two-day deadline for every unauthorized debit transaction.
• Unauthorized transfer shown on a statement: Report it no later than 60 days after the statement was sent. Waiting longer can expose you to transfers made after that period.

Under the standard rules, timely notice after a lost or stolen access device can limit liability to $50. Notice after 2 business days but within 60 days can increase potential liability to $500. Failing to report an unauthorized transfer within 60 days can create additional exposure for later transfers. Exceptions and account-specific facts can change the result.

A bank or credit union generally has 10 business days to investigate an alleged electronic-transfer error. It may take longer if it provides provisional credit and follows the applicable extension rules. The NCUA's Regulation E overview and FDIC electronic-fund-transfer materials describe these procedures.

Report the transaction by phone immediately and follow up in writing through the bank's error-reporting channel. A payment you personally authorized after being deceived may be treated differently from a transfer made without your authorization. Bank wires follow different rules and recall procedures, so contact the bank's fraud department as soon as possible.

IRS identity theft and IP PINs

Tax identity theft has its own process. If someone filed a federal return using your Social Security number or ITIN, follow the instructions on the IRS notice and use Form 14039 when that form applies. If an e-filed return is rejected because a return was already filed under your number, follow the IRS instructions for filing and identity verification rather than repeatedly submitting the same electronic return.

There is no single IRS identity-theft resolution deadline equivalent to the FCBA's 60-day rule. The date on an IRS notice controls that particular response. Don't set the notice aside while waiting for a general processing estimate.

An Identity Protection PIN, or IP PIN, is a separate prevention measure. It's a six-digit number used on federal tax returns and generally changes each year. Requesting one helps protect future filings; it doesn't remove a fraudulent return or resolve an existing identity-theft case. Use an IRS Online Account or follow the current instructions for Form 15227 if you can't complete online identity verification.

Keep copies of every form, notice, return, and delivery confirmation. If a state tax return or refund is involved, contact the state tax agency separately because its procedures and deadlines may differ.

FTC reports, police reports, and state rules

There isn't a general deadline for filing an FTC identity-theft report, but filing promptly creates a record of what happened. The report can help with credit-bureau blocks, creditor investigations, and an extended fraud alert. It doesn't automatically remove an account or guarantee a refund. The FTC's identity theft guidance covers reporting and recovery steps.

A police report may help when the theft involved a known person, an ongoing crime, or a disputed account. A creditor or bureau may also require one for a particular request. Follow the documentation requirements of the company receiving your dispute.

State laws may add protections involving debt collection, security freezes, data breaches, state tax returns, and identity-theft remedies. They vary widely. A state statute of limitations for filing a lawsuit isn't the same as the deadline to dispute a credit report, card charge, bank transfer, or tax return. Check your state attorney general, financial regulator, or tax agency rather than applying a deadline from another state.

What to do first

As soon as you discover the fraud

1. Call the bank, card issuer, or payment provider using the number on your card or statement.
2. Lock or replace compromised cards and ask whether the account should be closed.
3. Change passwords for email, banking, and payment accounts. Turn on multifactor authentication.
4. Place a credit freeze with each bureau if someone may open new accounts in your name.
5. File an FTC identity-theft report and a police report when appropriate.

Before the shortest deadline expires

• Send the written credit-card billing dispute before 60 days have passed from the mailing of the statement.
• Notify the bank within 2 business days if a debit card or access device is missing.
• Report unauthorized electronic transfers within 60 days of the statement.
• Submit a complete identity-theft block request to every bureau reporting fraudulent information.
• Respond by the date shown on any IRS notice and file the required form when applicable.

If you missed a deadline, report the fraud anyway. Late notice can affect liability or the procedure available, but it doesn't make the claim pointless.

Evidence and escalation

Make a timeline showing when you discovered the fraud, the transaction and statement dates, when you reported each problem, claim numbers, and promised response dates. Keep copies of:

• Credit reports with fraudulent items marked.
• FTC and police reports.
• Statements showing unauthorized charges or transfers.
• Letters, emails, and text messages from creditors, banks, collectors, and the IRS.
• Proof of identity and delivery confirmations.
• The name of every representative you speak with.

Send copies rather than originals. Use a secure upload portal or certified mail when available, and save the receipt.

If a bureau refuses an identity-theft block, ask in writing which required element was missing. You can resubmit the evidence or use the ordinary dispute process. If a creditor or bank misses its acknowledgment or investigation deadline, request the result in writing and keep the case number. A complaint to the Consumer Financial Protection Bureau, the institution's regulator, or your state attorney general may be an option.

Begin with the notice or transaction carrying the shortest clock, send the required notice through the correct channel, and keep proof that it was received.