If money is still leaving an account, deal with that before the paperwork. Call the bank, card issuer, payment app, or other company that controls the account. Secure the email and phone accounts connected to it, then preserve evidence and dispute each fraudulent account or transaction separately.

A credit-report dispute won't reverse a debit, and an FTC report won't automatically close an account, remove a credit-report entry, or recover money. This guidance is for U.S. consumers. State procedures and account agreements can differ.

The first day: stop active loss

• Secure your email first. Use a trusted device to change the password, turn on multifactor authentication, check recovery details, remove unfamiliar forwarding rules, and sign out unknown devices or sessions.
• Call affected banks and card issuers. Use the number on a statement or the institution's official website, not a number in a suspicious message. Ask the fraud department to lock access, replace cards, stop unauthorized recurring debits, and explain its written-dispute process.
• Contact your mobile carrier if your phone, number, or SIM may be involved. Add an account PIN and ask whether a recent SIM change or number transfer occurred.
• Save evidence before deleting anything. Keep statements, emails, text messages, alerts, screenshots, shipping details, and suspicious login information. Record dates, amounts, account names, and confirmation numbers.
• Keep paying legitimate obligations. Tell the creditor how you'll handle the undisputed part while the fraudulent amount is reviewed. Ignoring the entire bill can create a separate credit problem.

You don't need to wait for a police report before securing accounts, placing a credit freeze, or notifying a bank.

Keep one identity-theft file

Use one paper folder or digital folder for the whole case. Include:

• Your FTC report number, affidavit, and recovery plan
• A police report number and copy, if you file one
• Identification and proof of address, when requested
• Statements showing unauthorized charges or withdrawals
• Credit reports with unfamiliar accounts, inquiries, addresses, or collections marked
• Notices from creditors, debt collectors, the IRS, the DMV, employers, or medical providers
• A contact log with the date, department, representative, confirmation number, and promised next step for every call
• Copies of every letter and attachment you send

Send copies, not originals. Redact unrelated account numbers and other information the recipient doesn't need. Use a secure upload system or the mailing address listed for disputes, and save the upload receipt or delivery record.

Create the official record

Report the theft to the FTC

File at IdentityTheft.gov and identify every type of misuse involved, such as new credit, bank fraud, tax fraud, employment fraud, medical identity theft, or account takeover. The FTC's identity theft reporting guidance describes the report and recovery plan.

Download the completed report, affidavit, and recovery plan and save the report number. The FTC report can help demonstrate to businesses what happened, but each affected organization still needs its own dispute.

Decide whether a police report is useful

A police report may help if a creditor, credit bureau, DMV, employer, or insurer asks for more proof. Bring:

• Government-issued identification
• Your FTC report or affidavit
• Statements, account notices, and other evidence
• A short timeline
• The names of affected businesses and the relevant account numbers, showing only what is necessary

Ask for the report number and a copy. A police report isn't required for every credit freeze, initial fraud alert, or account dispute. If a business insists on one, ask what exact document it needs and whether the FTC identity theft report will work instead.

If the agency won't take a report, record the agency, date, and reason. Ask the creditor or bureau what alternative documentation it accepts. Don't invent details or accuse a person without evidence.

Dispute the transaction with the company that handled it

Contact the organization that processed the transaction as soon as you notice it. A dispute with a credit bureau doesn't replace a bank, card, or payment-app dispute.

Credit card charges

Call the issuer's fraud department, then send a written billing-error notice to the address for billing disputes on your statement. That address may be different from the payment address. Federal credit-card billing-error rules generally require the written notice to reach the issuer within 60 days after the statement showing the error was mailed.

Include:

• The account number, or only the last four digits where appropriate
• The transaction date, merchant, and amount
• A clear statement that you didn't authorize the charge
• Your FTC report or other supporting documents, if requested
• A request for written confirmation and a corrected statement

Pay the undisputed portion while the issuer investigates. A phone call is useful for stopping further loss, but it shouldn't be your only record of the dispute.

Debit cards, ACH, and electronic transfers

Notify the bank immediately and follow its written error-reporting process. For a personal bank account, the timing of notice can affect liability under federal electronic-transfer rules. If a debit card or other access device was lost or stolen, a two-business-day deadline may matter. If an unauthorized electronic transfer appears on a statement, 60 days from the statement date is another important limit.

The result can depend on the type of transfer, when you learned about it, and whether the account is personal or business. Keep proof of when you notified the bank. Ask whether it will provide provisional credit, issue a new account number, and block future unauthorized debits.

Wire transfers and person-to-person payments

Call the sending institution, payment app, and receiving bank immediately. Request a recall, freeze, or fraud review and provide the transaction confirmation.

A transfer you approved after a scam can be treated differently from one made without your authorization. Don't assume that a credit-card or debit-card rule applies to a wire or a payment-app transaction.

Account takeover

If someone entered an existing online account, handle the access problem separately from the transaction dispute:

• End unfamiliar sessions and remove unknown authorized users.
• Change the password and any other password you reused.
• Replace security questions and recovery methods.
• Review email forwarding, payment instructions, and linked bank accounts.
• Ask the company to preserve login and transaction records.
• Check whether the attacker changed your mailing address or phone number.

A sample dispute letter

Subject: Identity theft dispute for [account or transaction]

[Your name]
[Your mailing address]
[Date]

[Company name]
[Fraud or billing-dispute address]

I am reporting an identity theft dispute involving [account or transaction].
I did not open, use, or authorize [describe the account, charge, withdrawal, or transfer].

Please investigate this matter, restrict or close the fraudulent account as appropriate,
correct the balance, and confirm the outcome in writing. Please also tell me whether
you have reported this information to any consumer reporting company and how you will
correct that reporting.

Attached are copies of my FTC report, [police report if available], identification,
and records identifying the disputed activity.

Please send written confirmation to the address above.

Sincerely,

[Your name]

If you submit the dispute online, save the confirmation page and upload receipt. Don't rely on a phone call alone.

Protect your credit files

Use a security freeze or fraud alert

A security freeze restricts access to your credit file for most new-credit applications. It's free and available to everyone, but you must place it separately with Equifax, Experian, and TransUnion. A freeze won't stop misuse of existing accounts, tax fraud, medical identity theft, or every specialty consumer report.

Save each freeze confirmation, PIN, or recovery method. You can temporarily lift a freeze when a legitimate lender needs access and restore it afterward. Experian describes the process for temporarily lifting a freeze.

A fraud alert tells businesses to take additional steps to verify your identity before opening or extending credit. An initial alert lasts one year. A documented identity-theft victim can request an extended alert lasting seven years with the required identity-theft documentation. You only need to contact one nationwide bureau to request an alert; it should notify the other two. The Experian fraud-alert guidance describes the available options.

You can use both. The freeze is the stronger barrier against new credit; the alert adds a verification step when a business checks your file.

Review all three credit reports

Get your reports through AnnualCreditReport.com, the authorized source for nationwide credit reports. Look beyond newly opened accounts. Check for:

• Hard inquiries you don't recognize
• New addresses, phone numbers, or employers
• Collection accounts
• Authorized-user accounts that aren't yours
• Incorrect balances or payment histories
• Closed accounts that remain associated with you
• Name variations that may indicate a mixed-file problem

Make a list of the bureau, creditor, account number, date, and exact error. Dispute an item with every bureau that reports it. An account appearing on one report doesn't require identical disputes with the other two.

Ask for an identity-theft block

For information caused by identity theft, ask each bureau reporting the item to place a block under Section 605B of the Fair Credit Reporting Act, 15 U.S.C. § 1681c-2. Send:

1. A written request for the block
2. A copy of your identity theft report
3. Proof of identity
4. Proof of address if the bureau requires it
5. The exact account, inquiry, or collection you want blocked

A qualifying request generally requires the bureau to block the information within four business days after receiving the required materials. That's different from the standard credit-report dispute process, which often takes up to 30 days and can take 45 days in certain circumstances.

A bureau may reject or remove a block in limited situations, including an incomplete request or a finding that the information wasn't caused by identity theft. If that happens, ask for the reason in writing and correct any missing documentation.

For a strong paper trail, use the current mailing address in the bureau's dispute instructions and a trackable delivery service. Online disputes can be faster, but keep a copy of everything you submit.

Dispute with the furnisher, too

Send a separate dispute to the bank, creditor, debt collector, or other company that supplied the information. State that you didn't open or authorize the account and identify the exact tradeline. Ask the company to investigate, close or restrict the fraudulent account, correct its records, and notify every bureau to which it furnished the information.

A bureau may verify information with the furnisher. Disputing with both parties helps ensure that one incomplete record doesn't control the outcome.

Handle problems outside the credit bureaus

Tax identity theft and IRS IP PINs

If you receive an IRS notice about a return you didn't file, follow the instructions in the notice. If a federal return is rejected because someone already filed using your Social Security number, use the IRS identity-theft process and submit Form 14039 when the IRS directs you to do so. Keep the return, notice, and mailing or submission confirmation.

An IRS Identity Protection PIN is a prevention tool for future federal returns. Taxpayers who haven't been identity-theft victims can also opt in through an IRS Online Account after identity verification. If online verification isn't available, IRS instructions may direct you to Form 15227, which involves a phone verification process and a mailed PIN. The six-digit PIN changes each year.

An IP PIN doesn't repair a fraudulent return, remove a credit-report entry, or resolve a bank dispute. The Taxpayer Advocate's explanation of IP PIN processing reported that the IRS aimed to process Form 15227 requests within 120 days, while 60 percent took longer in fiscal year 2023. Treat the PIN as future protection, not a quick fix for an active tax case.

Driver's license or DMV fraud

DMV procedures are state-specific. Contact the official DMV in the state that issued the credential and ask for its identity-theft, driver-record, or license-fraud unit. Request:

• A flag or correction on the affected record
• Replacement credentials if a license or ID was issued
• A written explanation of the correction
• Copies of tickets, applications, or other records connected to the fraud

The DMV may request an FTC report, police report, proof of address, or notarized forms. There isn't one national DMV form or deadline, so follow that state's instructions.

Employment, benefits, medical, and utility fraud

Contact the organization that created the record. Ask the employer or state workforce agency about fraudulent wages or unemployment claims. Ask the medical provider or insurer to correct incorrect records. For utility or telecommunications fraud, contact the company that opened the account in your name.

A three-bureau credit freeze may not cover specialty databases used for checking accounts, utilities, or other services. Ask the company which report or database supplied the information and request the correction process for that source.

Debt collectors

Don't ignore a collection notice for a debt that isn't yours. Use the dispute address in the collector's validation notice, state that the account resulted from identity theft, and attach only the documents needed to identify the account. If the notice gives a deadline for disputing the debt, respond before it expires and keep proof of delivery.

Don't acknowledge the debt as yours or agree to a payment plan while the identity question is unresolved. Before making any payment, ask how it would affect the dispute. A dispute with a debt collector doesn't automatically remove the collection from your credit reports, so dispute the credit-report entry separately.

Put the deadlines on a calendar

• Today: Secure email and other accounts, call the companies losing money, and save the evidence.
• Over the next few days: File the FTC report, place freezes or alerts, and obtain all three credit reports.
• After each written dispute: Record the delivery date, confirmation number, and expected response date.
• About four business days later: Check whether a qualifying identity-theft block was placed.
• Around 30 days: Check for standard bureau responses and creditor updates.
• Before any 60-day deadline: Review the statement dates for credit-card billing errors and unauthorized electronic transfers. Don't wait for a bureau investigation before sending a bank or card notice.
• Monthly at first: Review bank activity, email, phone, mail, tax notices, and credit reports until the records remain clean.

Ask for a written outcome. It should say what was corrected, removed, closed, credited, or left unchanged. If a fraudulent account remains, compare the response with the exact item on your report and send a focused follow-up addressing the missing evidence or incorrect detail.

If a dispute is denied

Begin with the written reason. Then:

1. Ask the creditor or furnisher to review the evidence again.
2. Send the bureau a reinvestigation or identity-theft block request that identifies the exact error.
3. File a complaint with the Consumer Financial Protection Bureau for many credit-reporting, debt-collection, bank, and card issues.
4. Contact your state attorney general or the relevant state agency for licensing, DMV, employment, or utility matters.
5. Consider legal aid or a qualified consumer-law professional if the account remains harmful, a collector keeps reporting it, or the financial loss is substantial.

A complaint creates another record, but it doesn't replace a direct dispute or extend a payment or billing deadline. The FTC report documents the theft; it doesn't decide the company's liability.

Errors that delay recovery

• Waiting for a police report before freezing credit
• Sending the same vague dispute to every company
• Disputing only by phone
• Mailing original documents or unnecessary full account details
• Treating a freeze as protection against an existing-account takeover
• Assuming an IP PIN fixes a prior fraudulent return
• Ignoring unfamiliar addresses, inquiries, or collection notices
• Missing a statement-based deadline while waiting for a bureau response
• Paying a fraudulent balance without asking how the payment affects the dispute
• Losing confirmation numbers and delivery records

Start with the account that is actively losing money or exposing your information. Write down the call time and confirmation number, then open the case file and send the written dispute before its deadline.