If someone opened an account in your name, took over a login, or moved money without permission, start with whatever remains exposed. Secure email and other logins. Call the provider through an official channel. Then freeze your credit, report the theft, and challenge each fraudulent account with the business involved and every bureau that lists it.
One event can leave several different messes. A card charge, debit withdrawal, new loan, and tax problem may look alike from your side, but their deadlines and remedies differ.
Most rules below apply in the United States. Identity theft has no single deadline or penalty; the payment method, credit-report issue, tax problem, and state can change the answer. This is general consumer information, not legal advice.
If identity theft is happening now
Start with the part that can still spread. A stolen password, a new credit account, and an unauthorized debit call for different responses, even when one incident caused all three.
A practical first-day sequence
- Secure email and important logins first. Use a trusted device. Change passwords, sign out of other sessions, and turn on multi-factor authentication. Start with email because it can control password resets.
- Call the bank, card issuer, or payment app. Use the official app, website, or number on a statement. Ask whether the account should be locked, closed, or reissued, and where to send a written fraud report.
- Place a credit freeze with Equifax, Experian, and TransUnion. Contact each bureau separately unless the bureaus' current process tells you otherwise.
- Consider a fraud alert. An initial alert lasts one year. An extended alert generally lasts seven years for an eligible identity theft victim who has the required report.
- File a report at IdentityTheft.gov. The FTC service gives you an Identity Theft Report and a recovery plan.
- Ask local law enforcement about a police report. A creditor, lender, insurer, or government agency may request one. Keep the report number.
- Review your credit reports and statements. Look for unfamiliar accounts, inquiries, addresses, and transactions.
- Open an incident file. Record dates, names, confirmation numbers, disputed amounts, and every document you send.
You can start protective steps before a police report exists. Use contact details from the provider's official site, app, or statement. Don't trust a number in an unexpected text or email.
Credit freeze, fraud alert, or Identity Theft Report?
A credit freeze, fraud alert, and Identity Theft Report don't do the same job. Turns out, the choice depends on the problem you need to stop.
The FTC's guidance on credit freezes and fraud alerts explains how to place and manage these tools.
| Tool | What it does | What it does not do |
|---|---|---|
| Credit freeze | Generally restricts prospective creditors from accessing your credit file. It is free and remains until you ask the bureau to lift or remove it. | It doesn't close an existing account, reverse a charge, or stop every kind of account takeover. |
| Initial fraud alert | Asks businesses to verify your identity before opening new credit. It lasts one year, and the bureau you contact must notify the other two. | It doesn't block every new account or replace a dispute with the lender or bureau. |
| Extended fraud alert | Provides a longer alert, generally seven years, for an eligible identity theft victim with the required report. | It doesn't erase fraudulent information or guarantee reimbursement. |
| Identity Theft Report | Documents the reported theft and gives you a recovery plan. It can support certain disputes and requests. | It isn't a police investigation and doesn't automatically return lost money. |
A freeze is usually the stronger first move if someone may open new credit. An alert gives a creditor a chance to verify you before approving an application.
How to remove a fraudulent credit entry
An FTC report does not remove a credit-report entry by itself. Send a block request to each nationwide bureau showing the item, then contact the lender or collector separately.
Section 605B of the FCRA sets the document requirements. A complete request generally includes:
- proof of identity;
- an Identity Theft Report;
- identification of the fraudulent information; and
- a written statement that the transaction was not yours.
After receiving complete materials, the bureau generally must block the information within four business days.
Use the bureau's official dispute channel and keep proof of delivery. Give the lender or debt collector its own notice, because a credit-report dispute does not automatically close the account or stop the company's internal collection process.
Names can mislead: a store brand may appear under a different legal lender name, while a report may show a joint account or authorized-user relationship, so check the exact entry before disputing it. State plainly that the account is not yours and identify the specific item.
Keep the case number and delivery proof. Save the emails and screenshots in the same file, too.
What federal identity theft laws actually do
Federal law doesn't impose one identity-theft sentence. The charge, conduct, loss, documents used, prior record, and state all matter.
| Rule or route | What it covers | Practical meaning |
|---|---|---|
| FCRA Section 605B | Certain information placed on a consumer report because of identity theft | An eligible victim can request a block after providing the required documents. |
| 18 U.S.C. 1028 | Certain fraud involving identification documents, authentication features, and identifying information | A federal charge may apply, but the subsection and facts control the penalty. |
| 18 U.S.C. 1028A | Aggravated identity theft connected to certain qualifying felonies | It can add a mandatory consecutive prison term, generally two years. It doesn't apply to every stolen password or unauthorized charge. |
| State criminal law | Identity theft and related conduct prosecuted by a state | Charges, sentencing ranges, restitution, and possible civil claims vary by location and facts. |
The federal texts discussed here are 18 U.S.C. 1028 and 18 U.S.C. 1028A. Criminal enforcement is separate from recovering an account or money. You can freeze your credit and dispute a fraudulent account before anyone files criminal charges.
Online claims about average sentences or guaranteed fines deserve caution. To be honest, those claims often leave out the exact charge, plea, prior record, loss calculation, or state law.
Report the problem according to the payment method
The payment rail controls the first report. Credit-card billing rules don't automatically apply to debit, ACH, wire, remittance, or peer-to-peer transactions.
| What happened | First report | Save |
|---|---|---|
| Unauthorized credit card charge | The card issuer's fraud or billing-dispute channel | The statement, transaction date, merchant name, and dispute confirmation |
| Unauthorized debit, ACH transaction, or bank withdrawal | The bank or credit union immediately | The account statement, transaction details, and every notice sent to the bank |
| Wire, remittance, or peer-to-peer transfer | The sending institution or app immediately | The confirmation number, recipient details, messages, and time you reported it |
| New loan, credit card, or collection account | The lender or collector and each bureau reporting it | The application or collection notice, credit-report entry, and Identity Theft Report |
| Tax return or refund problem | The IRS identity theft process and the instructions connected to your notice | Tax notices, filing information, and documents showing the problem |
| Stolen physical identification | Local law enforcement and the agency that issued the document | The police report number, replacement request, and proof of identity |
Report unauthorized transactions promptly. Some payment systems have timing rules, and a credit-card billing dispute is not a substitute for a bank fraud report.
A breach notice is not the same as identity theft
A breach notice says personal data may have been exposed. It does not prove misuse, erase a debt, or promise a refund.
Read the notice. Change any exposed login and consider a credit freeze. If actual fraud appears, report that separate event to the bank, lender, credit bureau, and FTC as appropriate.
Prevention after the immediate problem
Once the immediate accounts are secure, make another takeover harder. Use unique passwords and multi-factor authentication for email, banking, payment apps, and social accounts.
Never give a one-time security code to someone who contacted you unexpectedly. Turn on transaction alerts. Read statements for activity you don't recognize.
Keep your Social Security number, identity documents, and account details out of unnecessary messages and photographs. Shred documents that contain account numbers or identifying information.
Keep a current recovery email and phone number on important accounts. Email deserves extra attention because it often controls access to everything else.
If a company or bureau does not fix the problem
A denial isn't the end of the paper trail. Ask for the decision in writing and ask which document or fact the company says is missing. Add that response to your incident file.
For credit-reporting and consumer-finance problems, the Consumer Financial Protection Bureau's identity theft guidance identifies the main parties to contact, including credit reporting companies, financial institutions, law enforcement, the DOJ, and the FTC. Use the company's formal appeal or complaint route when it offers one.
Thing is, an FTC report cannot replace a bank claim or a credit-bureau dispute. File each report that matches the harm.
Common questions
Do I need a police report before using IdentityTheft.gov?
Not necessarily. Start with the FTC report and protective account steps. A creditor, lender, insurer, or government agency may still request a police report. Keep its report number.
Will a credit freeze remove a fraudulent account?
No. A freeze generally helps prevent new-credit approvals. It does not erase an existing account, reverse a payment, or remove an item from your credit report.
Does an FTC report guarantee a refund?
No. It documents the identity theft and provides recovery steps. Whether money comes back depends on the account, payment method, provider's investigation, and applicable rules.
Do U.S. identity theft rules apply worldwide?
No. These rules are for U.S. consumers. Other countries use different criminal laws, credit systems, privacy rules, and reporting agencies.
Save your IdentityTheft.gov confirmation. Put every issuer and bureau response date on your calendar.