If you find an account, charge, tax return, or credit inquiry you didn't authorize, act on the exposed account first. For U.S. consumers, call the bank, card issuer, creditor, or other company involved, secure your online access, and then file an FTC report at IdentityTheft.gov.

The FTC report gives you an Identity Theft Report and a recovery plan. Save both. They can support disputes with creditors and credit bureaus, but they don't automatically reverse a charge, erase a debt, or correct every credit report.

Quick identity theft checklist

• [ ] Call the fraud department for the company where the fraud occurred.
• [ ] Change affected passwords and turn on multifactor authentication.
• [ ] File a report at IdentityTheft.gov.
• [ ] Save the FTC Identity Theft Report and personalized recovery plan.
• [ ] Place a credit freeze with Equifax, Experian, and TransUnion.
• [ ] Consider a free, one-year fraud alert.
• [ ] Review all three credit reports for unfamiliar accounts and inquiries.
• [ ] Send identity-theft blocking requests to the bureaus and disputes to the companies that supplied the information.
• [ ] Get a police report when a creditor, agency, or investigation requires one.
• [ ] Follow IRS instructions if someone used your information for tax fraud.
• [ ] Check specialty consumer reports when the fraud involves banking, utilities, employment, or a driver's license.
• [ ] Keep copies, delivery records, confirmation numbers, and a call log.

1. Stop active fraud

Don't wait for an FTC report if money is still leaving an account or someone can still sign in. Call the company's fraud department using the number on your statement, card, or the company's official website. Ask whether it can close, freeze, or secure the account, replace compromised cards, and explain its process for disputing unauthorized transactions. The FTC's identity theft recovery guidance also starts with contacting the companies where the fraud occurred.

Secure the accounts connected to the incident:

• Change affected passwords from a device you trust.
• Use a different password for each important account and enable multifactor authentication.
• Check whether the thief changed your email address, phone number, mailing address, or recovery settings.
• Save statements, emails, text messages, letters, screenshots, and transaction details before deleting anything.

The FTC report helps with the paperwork that follows. It can't stop an account takeover already in progress.

2. File an FTC Identity Theft Report

IdentityTheft.gov asks questions about the incident and uses your answers to create an Identity Theft Report and recovery plan. Include the accounts, companies, dates, type of misuse, and amounts you know about. You can update your own notes as more information turns up.

After you submit the report:

1. Download or print the Identity Theft Report.
2. Save the personalized recovery plan.
3. Record the report number and submission date shown.
4. Keep a secure backup.
5. Make copies for creditors, law enforcement, or agencies that request them.

The report is evidence of the identity theft and a way to organize the recovery steps. It isn't a criminal case number, a promise that a creditor will forgive a balance, or a substitute for contacting the affected company.

If you can't use the online form, check the FTC's current identity theft reporting page for its contact options. Be cautious about entering sensitive information through an unsolicited email or text link.

3. Get a police report when it serves a purpose

An FTC report and a police report are different documents. You don't automatically need both, but a police report may be useful when:

• A creditor, lender, debt collector, insurer, or government agency asks for one.
• You're applying for an extended fraud alert.
• Law enforcement needs to request records from a business.
• A driver's license, passport, or other government document was stolen.
• There is an identifiable suspect or a law-enforcement investigation.

Bring a government-issued photo ID, your FTC Identity Theft Report, account statements or collection letters, and a dated list of the fraudulent accounts or transactions. Take proof of address if the agency requests it.

Ask for the case number and a copy of the completed report. If an agency won't take the report, record the date and explanation, ask for a supervisor, and ask the creditor or bureau whether it will accept the FTC report instead. Police procedures vary.

4. Choose a fraud alert, a credit freeze, or both

The FTC's credit freeze and fraud alert guidance describes the main differences:

Both a fraud alert and a freeze are free. When you place an initial fraud alert with one bureau, that bureau must notify the other two. An extended alert generally requires an FTC Identity Theft Report or police report; follow the current document instructions from the bureau.

A freeze must be placed separately with all three bureaus. It stays in place until you ask the bureaus to lift or remove it. When you apply for credit, you can temporarily lift it according to the bureau's instructions.

A freeze doesn't close an existing account, reverse an unauthorized transaction, or stop a thief who already has access to an account. Keep working directly with the bank, card issuer, or creditor.

5. Review your reports and dispute the records

Get all three major credit reports. Don't stop with the bureau named in a fraud notice. Look for:

• Credit cards, loans, or collection accounts you didn't open.
• Hard inquiries you don't recognize.
• Addresses, employers, or phone numbers that aren't yours.
• Accounts that were reopened or reported under a slightly different version of your name.

Create one list for each fraudulent item. Include the bureau, company, account number, date, balance, and why the item is not yours.

Then ask each bureau to block or remove information that resulted from identity theft. The FCRA identity-theft blocking process is different from an ordinary dispute that says only "not mine." Follow the bureau's current instructions. The requested packet may include:

• Your FTC Identity Theft Report.
• A government-issued ID.
• Proof of your current address.
• A clear list of the fraudulent items.
• Account statements or other supporting correspondence.

Send copies rather than irreplaceable originals. Keep the complete packet, delivery confirmation, and any response. If a bureau says something is missing, ask exactly what it needs and send that material promptly.

Write separately to the creditor or other company that supplied the information. Ask it to:

• Mark the account as identity theft.
• Ask whether it will pause collection activity while it reviews the claim.
• Close or secure the account.
• Correct information sent to the credit bureaus.
• Confirm its decision in writing.

A dispute sent to one bureau doesn't automatically reach every creditor or specialty reporting agency.

6. Ask the business for fraud records

You may need the application, transaction history, delivery information, or other records tied to the fraud. The FTC's guidance on business records under FCRA Section 609(e) explains how to make that request.

Send a written request that identifies the account or transaction, relevant dates, and records sought. For example:

I am requesting records related to the identity theft involving [account or transaction] under Section 609(e) of the Fair Credit Reporting Act. I have enclosed proof of my identity and my Identity Theft Report. Please provide the application and transaction records, or tell me what additional information you need. If appropriate, I authorize you to send the records to [law-enforcement agency and contact information].

Use the documents and delivery method required by the business. Keep a copy of the request and ask whether the records can be sent directly to the investigating law-enforcement agency.

7. Handle tax identity theft through the IRS

An FTC report doesn't resolve a fraudulent tax return. Follow the instructions from the IRS for the particular notice or filing problem.

If you receive an IRS Letter 4883C, 5071C, 5747C, or 5447C, respond as soon as possible using the instructions and address in that letter. Don't substitute a phone number or mailing address from an old checklist.

If your electronic return is rejected because someone already filed a return using your Social Security number, follow the IRS instructions for that situation. You may be told to complete Form 14039, Identity Theft Affidavit, and submit a paper return or additional documents.

Use the Taxpayer Advocate Service's identity theft guidance to identify the correct step. In some circumstances, that guidance says you can submit a police report instead of Form 14039.

After the IRS verifies your identity, the Taxpayer Advocate Service says to allow two to three weeks before checking your refund status on IRS.gov or through the IRS2Go app. Keep the IRS notice, verification details, submission proof, and copies of everything you sent together.

8. Check specialty reports when the fraud points elsewhere

The three major credit bureaus don't cover every identity record. Contact the organization that handles the affected type of account:

• ChexSystems: Checking or deposit accounts opened or misused in your name.
• NCTUE: Telecommunications, television, internet, home security, or utility accounts.
• Your state motor vehicle agency: A stolen driver's license or misuse of your license information.
• An employer's human resources department: Someone used your identity to obtain a job.
• A loyalty-program provider: Someone used your points, miles, or rewards.
• The check-verification company named by a merchant: Your checks are rejected because of suspected fraud.

Experian's identity theft reporting guidance identifies several of these additional contacts. Each organization has its own report and dispute process, so ask for the records and instructions that match the fraud.

Follow up without assuming one deadline

The FTC report may be available online as soon as you finish filing, but banks, creditors, credit bureaus, and the IRS use different review processes. There isn't one 30-, 60-, or 90-day deadline that controls every part of an identity theft case.

A workable schedule is:

• Today: Secure active accounts, file the FTC report, and place freezes with all three bureaus.
• Over the next few days: Add a fraud alert, obtain a police report if a request requires it, review all three reports, and send disputes.
• After every submission: Note the date sent, delivery confirmation, case number, and expected response date.
• During recovery: Review account statements and credit reports, answer document requests, and renew a one-year fraud alert when necessary.
• Long term: Leave the freeze in place until you decide to lift or remove it. An approved extended alert lasts seven years.

A company's written response may not settle the matter. When fraudulent information returns or a creditor rejects a complete request, ask for the reason in writing, provide any missing evidence, and escalate to the company's fraud department or a supervisor. Repeated collection attempts, reinsertion of blocked information, or significant losses may justify consulting a qualified consumer-law professional.

Common mistakes to avoid

• Freezing only one report: A fraud alert can be shared between the bureaus, but a freeze must be placed with each one.
• Treating the FTC report as a deletion request: Send separate requests to the bureaus and disputes to the companies that furnished the information.
• Waiting while an account is exposed: Contact the bank, card issuer, or provider before completing the paperwork.
• Sending a vague dispute: Name the exact account, inquiry, or transaction and explain why it is fraudulent.
• Mailing original documents: Keep the originals and send copies.
• Assuming a police report is always required: The requirement depends on the creditor, agency, or specific request.
• Submitting Form 14039 without checking the IRS instructions: The correct response depends on the notice or filing problem.
• Paying for a federally free freeze or fraud alert: Use the official bureau channels.
• Securing only one password: Email, phone, and account-recovery access can let a thief regain control.

Frequently asked questions

Is an FTC Identity Theft Report the same as a police report?

No. IdentityTheft.gov creates the FTC report, while a law-enforcement agency creates a police report. A creditor or agency may ask for one, the other, or both.

Does filing with the FTC remove fraudulent debt?

No. The report supports your recovery paperwork, but it doesn't by itself remove a balance. Contact the creditor or debt collector and the credit bureaus separately.

Should I place a fraud alert or a credit freeze?

A freeze restricts access to your credit file and can help prevent new-credit accounts. A fraud alert asks businesses to verify your identity. You can use both, and both are free.

When should I file Form 14039?

Follow the IRS notice or filing instructions for your circumstances. If a return was filed using your information or your e-filed return was rejected for that reason, check the IRS identity theft guidance before submitting the form.

How long should I keep my records?

Keep the FTC report, police report, disputes, delivery receipts, account statements, and agency responses while the issue remains active. Retain them longer if a creditor continues reporting or collecting on the fraudulent account, and keep a calendar reminder for the next follow-up.