An identity theft email can preserve a written record, but it isn't the official reporting route for every U.S. organization. Start with the organization that can address the immediate risk:

• Use IdentityTheft.gov for an FTC identity theft report.
• Contact your bank, credit union, or card issuer through the number on your card or statement for unauthorized transactions.
• Use each credit bureau's official process for a freeze, fraud alert, or credit report dispute.
• Follow the instructions and deadline on an IRS notice for tax-related identity theft.
• Use your local police department's official nonemergency or online reporting channel if you need an incident record.

The templates below are for secure messages, portal fields, and follow-up emails. They use limited personal information and don't rely on invented agency email addresses. This article is for U.S. consumers; procedures elsewhere can differ.

Choose the right report or dispute route

A report documents suspected identity theft for an agency or law enforcement. A dispute asks a bank, creditor, debt collector, or credit bureau to investigate and correct a specific transaction or account. You may need both.

The payment method can change the procedure. Debit and electronic-fund-transfer disputes, credit card billing disputes, wires, checks, and peer-to-peer payments may have different notice methods and deadlines. Report suspicious activity promptly and ask the institution which process applies.

Prepare before sending a complaint email

Gather enough information to identify the incident without exposing more personal data than necessary.

• Create a short timeline with discovery dates, transaction or account-opening dates, and prior calls or messages.
• List each disputed account or transaction separately, including the company, date, amount, and account ending.
• Save statements, credit reports, letters, screenshots, shipping records, and relevant messages as PDFs.
• Record case numbers, representative names, submission dates, and promised response dates.
• Use only the last four digits of an account or Social Security number in ordinary email.
• Don't send passwords, one-time verification codes, full card or bank numbers, or an unredacted tax document by ordinary email.
• Use a bank's secure message center, an official upload portal, or the submission method printed on an official letter whenever possible.

A police report, FTC identity theft report, and affidavit may serve different purposes. Before attaching one, ask the recipient which document it requires and how to submit it securely.

Template 1: FTC identity theft report or incident summary

The FTC generally directs consumers to report identity theft through IdentityTheft.gov rather than by sending a personal case to an unverified email address. Paste the following into the site's incident description, or use it as a master timeline.

Identity theft incident summary

Date discovered:
How I discovered the activity:

What happened:
- Date:
- Company or agency:
- Account, application, or transaction type:
- Amount, if any:
- Account ending:
- Why I believe the activity was unauthorized:

Actions already taken:
- Company contacted:
- Date contacted:
- Company case number:
- Police agency and report number, if applicable:
- Credit bureau action taken:
- IRS action taken, if applicable:

Requested assistance:
I am reporting suspected identity theft and need the appropriate recovery steps. I can provide supporting documents through the official upload or reporting process.

Name:
Safe mailing address:
Safe phone number:
Safe email address:

Save the confirmation number and recovery instructions after submitting the report. An FTC report doesn't itself freeze a bank account, reverse a charge, or remove every fraudulent item from a credit report.

Template 2: Bank, credit union, or card issuer dispute

If an account is actively being used, call the institution first using the number on the back of the card or on a statement. Then send a written follow-up through its secure message center or verified fraud or dispute channel.

Subject: Unauthorized activity dispute - account ending [last four digits]

To: [Secure message center or verified fraud/dispute contact]

Dear Fraud or Disputes Department,

I am reporting and disputing activity that I did not authorize on my [account or card type]. Please treat this as notice of suspected identity theft.

Account ending: [last four digits]
Payment type: [debit card, ACH, credit card, check, wire, or payment app]
Date I discovered the activity: [date]

Disputed activity:
- [Date] - [merchant or recipient] - $[amount]
- [Date] - [merchant or recipient] - $[amount]

I did not authorize these transactions. [Briefly explain how the account or card may have been compromised, if known.]

Please:
1. Open a fraud investigation and provide a case number.
2. Tell me whether the account, card, or payment credentials should be blocked or replaced.
3. Explain which documents and written forms you require.
4. Confirm the applicable dispute deadline and how you will communicate the decision.
5. Review any related charges or account changes that may also be unauthorized.

I can provide redacted statements and an FTC or police report through your secure submission method.

Please confirm the date you received this notice.

Sincerely,

[Full name]
[Safe phone number]
[Safe email address]

For unauthorized electronic transfers, the time you notify the institution can affect available protections. Don't assume that an email alone satisfies the institution's written-notice procedure. Ask for its error-resolution instructions and keep proof of submission.

Template 3: Creditor, lender, or debt collector dispute

Use this draft when a company says you owe a debt or reports an account you didn't open. Send it to the verified address or secure portal listed on the company's statement or notice. If the sender is a debt collector, follow the validation instructions and response period in its notice rather than assuming that an email address accepts a formal dispute.

Subject: Identity theft dispute - account ending [last four digits]

To: [Verified creditor, lender, or collector contact]

Dear [Company or Department],

I dispute the accuracy and ownership of the following account because I did not open, authorize, or benefit from it.

Company:
Account ending:
Amount shown:
Date shown on statement or collection notice:
Date I discovered the account:

Please investigate the account as suspected identity theft and tell me:
- What documents you require from me
- Whether you will continue contacting me while the investigation is pending
- What information you have reported to credit bureaus
- How I can receive the investigation result and any correction

Please communicate with me in writing and provide a case number. I will submit an FTC identity theft report, police report, proof of identity, or other requested records through a secure method.

Sincerely,

[Full name]
[Safe mailing address]
[Safe phone number]
[Safe email address]

Request for transaction records

The FTC explains that Section 609(e) of the Fair Credit Reporting Act can require covered businesses to provide identity-theft-related transaction records to victims or law enforcement when the required conditions are met. A business may ask for proof of identity, an identity theft report, a police report, or other documentation. See the FTC guidance on identity theft transaction records.

Subject: Request for identity theft transaction records - [account ending]

Dear [Company or Records Department],

I am requesting records relating to the account or transactions listed below, which I believe resulted from identity theft.

Account or transaction:
Dates:
Amount:
Account ending:

Please tell me the documents and secure delivery method you require to process this request. If the records should be sent directly to a law enforcement agency, please explain that procedure.

I can provide proof of identity and the required identity theft or police report through a secure channel.

Sincerely,

[Full name]
[Safe contact information]

If a business won't provide records directly, the FTC says a victim can authorize law enforcement to obtain them or ask the business to send them to law enforcement.

Template 4: Credit bureau freeze, fraud alert, or credit report dispute

A credit freeze isn't normally requested by ordinary email. Start with the official website or phone process for Equifax, Experian, and TransUnion. The FTC says freezes are free and remain in place until you ask the bureaus to remove them. A separate request is generally needed with each bureau.

An initial fraud alert generally lasts one year. An extended alert may be available to an identity theft victim who supplies qualifying documentation. An alert asks businesses to take additional steps to verify identity; it doesn't block access to an existing account. A credit report dispute is a separate request to investigate inaccurate information.

Use this draft only as a follow-up after submitting a request through the bureau's official process:

Subject: Follow-up to identity theft request - reference [number]

Dear [Credit Bureau] Identity Theft Department,

I submitted the following request through your official process on [date]:

Request type: [credit freeze, fraud alert, or credit report dispute]
Reference number:
Name on file:
Report item or account ending:
Furnisher:
Date the item appeared, if known:

Please confirm that you received my request and tell me whether additional documentation is required. If this is a credit report dispute, please send the investigation result and explain any correction or remaining information.

I will provide any required identity documents through your secure process. This message contains only partial account information for security.

Sincerely,

[Full name]
[Safe mailing address]
[Safe phone number]
[Safe email address]

The FTC's guidance on credit freezes and fraud alerts explains how freezes, alerts, and credit reports work. A freeze helps with new-credit applications, but it won't close an existing bank account, stop an account takeover, or correct an inaccurate item by itself.

Template 5: IRS tax identity theft

The IRS doesn't use a generic email template as a substitute for its identity verification and tax identity theft procedures. If you received an IRS notice, use the response method and deadline printed in that notice. Don't send tax records or a full Social Security number to an address found in an unsolicited message.

The IRS Taxpayer Advocate's identity theft guidance explains that people who receive certain IRS letters should respond as soon as possible. It also notes that a police report may be submitted instead of Form 14039 in appropriate cases. Follow the IRS's current instructions rather than automatically submitting both documents.

Use this draft as a cover note for an official IRS upload, reply, or mailing process:

Subject: Tax-related identity theft - tax year [year] - notice [number]

To: [Reply method or secure upload listed in the IRS notice]

Dear IRS,

I am responding to [notice number] concerning suspected tax-related identity theft.

Tax year:
Date I received the notice:
Tax issue: [fraudulent return, refund issue, employment income, or other]
What I know:
- [Brief factual description]
- [Whether I filed a return for this year]
- [Whether I recognize the employer, income, or filing]

Documents included through the official IRS process:
- [Police report or identity theft report, if requested]
- [Form 14039, if instructed]
- [Other documents listed in the notice]

Please confirm whether additional action is required and explain how I should monitor the case.

Sincerely,

[Full name]
[Mailing address]
[Phone number]
[Notice or case reference]

Letters such as 4883C, 5071C, and 5747C can contain specific identity verification instructions. Respond through the channel in the letter instead of using a general-purpose email address.

Template 6: Local police report request

Many police departments use an online form or require a call to the nonemergency line rather than accepting an identity theft complaint by email. Check the department's official website first. Use this summary in a form or email only if the department says email is accepted.

Subject: Suspected identity theft report - request for incident number

Dear [Police Department or Records Unit],

I am requesting an incident report for suspected identity theft.

My name:
Date identity theft was discovered:
Location connected to the incident:
Companies or agencies affected:
Accounts or applications involved:
Dates and amounts:
How I discovered the activity:
Known suspect information, if any:
Financial or other impact:

I have notified:
- [Bank, creditor, or other company] on [date], case number [number]
- [IdentityTheft.gov], report number [number], if applicable
- [Credit bureau], reference number [number], if applicable

I can provide statements, screenshots, correspondence, and other evidence through your approved process. Please tell me how to submit the documents and how to obtain the incident report number or a copy of the report.

Sincerely,

[Full name]
[Safe phone number]
[Safe email address]

Don't include a full Social Security number, password, or complete payment credentials in the first message. If there is immediate physical danger or an active crime, use emergency services rather than email.

Safer subject lines for identity theft complaints

Keep the subject specific without putting sensitive information in it.

• Identity theft dispute - account ending [last four digits]
• Unauthorized transaction notice - request for investigation
• Follow-up to fraud report - case [number]
• Credit report dispute - [furnisher] account ending [last four digits]
• Request for identity theft transaction records
• Tax-related identity theft - IRS notice [number]
• Suspected identity theft incident report - [date range]
• Follow-up to credit freeze or fraud alert request

Avoid subjects such as "Account Compromised!" or "Send my SSN now." They can look like phishing messages and don't help the recipient identify the case.

Send and follow up safely

1. Verify the recipient. Use the phone number on a card, statement, official letter, or company website. Don't reply to a suspicious message that claims to be from your bank or the IRS.
2. Use the fastest secure channel first. Call about active unauthorized activity, then submit the written dispute through the institution's secure system.
3. Attach only what is needed. Redact unrelated transactions, full account numbers, and unnecessary tax details.
4. Ask for a case number. Confirm the date received, required documents, expected response, and applicable deadline.
5. Keep a communication log. Save the sent message, upload receipt, screenshots, attachments, and every response.
6. Follow up using the same reference number. If the organization gives no timetable, ask for a status update and the next escalation step.
7. Escalate carefully. Ask for a fraud supervisor or formal complaint channel. For credit reporting problems, keep the bureau dispute record and consider disputing the information with the company that furnished it as well.

Certified mail can help prove delivery when an organization requires written notice, but don't assume ordinary email or a read receipt has the same effect.

What each report can and cannot do

• FTC report: Documents identity theft and can organize recovery steps. It doesn't reverse a bank transaction.
• Police report: Records an alleged crime. It doesn't automatically remove a fraudulent credit account.
• Bank dispute: Addresses the bank's or issuer's review of specific transactions. It doesn't correct every credit report entry.
• Credit freeze: Helps block new-credit access. It doesn't stop activity on an existing account.
• Fraud alert: Encourages additional identity verification. It doesn't guarantee that every fraudulent application will be stopped.
• IRS process: Addresses tax-related identity theft. It doesn't resolve unrelated bank or credit account fraud.

Common questions

Can I email the FTC about identity theft?

Use IdentityTheft.gov as the primary reporting route. A template can organize the facts for the online report or a later follow-up, but don't rely on an unverified FTC email address.

Should I request a credit freeze or a fraud alert?

A freeze is stronger for blocking new-credit applications and stays until you remove it. An alert tells potential creditors to verify identity and may be easier to place initially. The FTC explains both options and how to contact the bureaus.

What should I attach to a complaint email?

Start with a redacted statement, relevant credit report page, case number, or identity theft or police report if requested. Ask for the recipient's secure upload method before sending identity documents.

What if the IRS sent me an identity verification letter?

Follow that letter exactly. Use its online, phone, upload, or mailing instructions, and don't substitute a general email template for the required verification process.

What if a company refuses to give me records about the fraudulent account?

Ask the company to state its documentation requirements in writing. You may also ask law enforcement to request the records. The FTC's Section 609(e) guidance describes that option for qualifying requests.

For active transactions, contact the bank or issuer first. For new-credit exposure, use the bureaus' official process; for an IRS notice, follow the letter. Save each confirmation and case number before moving to the next step.