If someone opened accounts, ran charges, or filed a tax return in your name, you should start with a phone call today. A call won't replace a written record. It also won't treat debit fraud, a new credit account, and a fake tax return as one problem. It can still kill a live card and get a claim number on the same day.
What should you actually say when the agent picks up?
The outline below is a script, not a password. Banks, credit bureaus, and agencies follow different rules.
Debit and ATM fraud sit under Regulation E. Credit card billing errors follow the Fair Credit Billing Act. Fake accounts on a credit report are an identity-theft block under the Fair Credit Reporting Act. Mixing those rails on one call is how people get transferred into nowhere.
Thing is, you should still call today. New charges keep posting while you draft a letter.
Get your papers in order before you dial
Unprepared calls die on identity verification. Have this next to the phone:
- Your full legal name, current address, date of birth, and the last four digits of your Social Security number. Give the full SSN only if the agent requires it and you placed the call.
- Account numbers, the last four digits of the card, and the date, amount, and merchant for each bad charge.
- An FTC Identity Theft Report from IdentityTheft.gov, and a police report if you already have one.
- A notebook for the date, time, agent name or ID, and any reference number.
- A phone you trust. Don't return a number from a suspicious text.
If recording is legal where you live, you can tell the agent you're recording for your records. Many states need only one party's consent. Some need both. Check that before you tap record.
File the FTC Identity Theft Report at IdentityTheft.gov when you can. Under 15 U.S.C. 1681c-2, a bureau can wait to block fake information until you provide an identity theft report, identify the items, and state that those items are not your transactions. A phone complaint without that packet is just a note in a log.
A universal script you can adapt
Keep your voice flat. Don't apologize for charges you didn't make.
Hello, my name is [full name]. I'm calling to report identity theft on account [last four] / my credit file. I didn't authorize these transactions or accounts. I have an FTC Identity Theft Report, number [report number].
On [date], a charge of $[amount] posted from [merchant]. I also see [new account / inquiry / medical claim] that isn't mine.
Please close or freeze the compromised account, start a fraud claim and give me the claim number, reverse or provisionally credit unauthorized charges if your rules allow that, add a fraud flag, and send written confirmation to [email or address].
I need the fraud team if you can't do those steps.
Stop talking after the ask. Let the agent pull up the account. Answer only the ID questions they pose. If they want a written affidavit later, take the portal or email address.
Turns out you can leave with a claim number even when they can't wipe a credit line on the spot. Get that number.
Banks and credit cards: debit vs. credit
Call the number on the back of the card or inside the official app. Skip any number that arrived by text or email.
Tell them whether the plastic was stolen, the number was used online, or a brand-new account showed up. Those paths split fast.
For a debit card or other electronic fund transfer, Regulation E limits your loss if you notify the bank quickly after you learn an access device was lost or stolen. Call as soon as you see it. Notice within two business days can cap liability at $50. Waiting past those two days can raise the cap to $500. Waiting more than 60 days after the statement that first showed the error can gut the claim.
Ask how long the investigation will take and whether they'll post a provisional credit while it runs.
Credit cards don't use Regulation E. Unauthorized charges there are billing errors under the Fair Credit Billing Act, and the usual consumer window is 60 days from the statement that first listed the charge. Don't sit on that statement.
Card networks may add a zero-liability policy on top. That extra policy isn't the statute. Ask for a fraud claim number, a replacement card, and written confirmation.
If a scammer talked you into sending the money yourself, say that. That authorized push is generally not an "unauthorized transfer," so the Regulation E clock may never start. The bank might still help as a courtesy. Don't relabel it as a stolen card.
Chase, Capital One, Wells Fargo, and American Express want the same core facts: who you are, which account, which charges, and that you didn't authorize them. Ask them to freeze the card and start the claim while you're on the line.
Credit bureaus: freeze first, then dispute
A freeze and a dispute are different jobs. Freeze the file so nobody opens another line of credit tonight. Attack each fake account, collection, or inquiry after the freeze is on.
You can request a freeze or a fraud alert by phone. Experian publishes contact paths for the bureaus for freezes, alerts, and report questions. Confirm the number on that bureau's own site. Printed lists go stale.
| Goal | What to say | What the call can actually do |
|---|---|---|
| Security freeze | Place a security freeze on my file. | Often finished during the call after they verify you. |
| Fraud alert | Add an initial fraud alert. | Weaker than a freeze, and lenders still have to check it. |
| Fake account | This account is identity theft. I have an FTC report. | Can start a dispute. A statutory block still needs the report, the item list, and your statement that the trades aren't yours. |
| Proof | Email or mail written confirmation. | Always ask. Phone notes vanish. |
Sample ask:
I'm [name], date of birth [date], SSN ending [XXXX]. I'm an identity theft victim. Please place a security freeze on my credit file and add a fraud alert. Fraudulent account [creditor / account last four] isn't mine. My FTC Identity Theft Report number is [number]. Send confirmation in writing.
Call Experian, Equifax, and TransUnion separately. One freeze doesn't cover the other two. Innovis matters if a niche lender is on the report.
To be honest, people burn a week fighting one agent for an instant deletion they will not get on that first call, then they hang up without the freeze they could have had in ten minutes. Get the freeze. Send the FTC report through the bureau dispute channel so a real block request is on file.
IRS, Social Security, and other companies still holding your data
Tax identity theft is a separate queue. If a return posted in your name, or a notice showed up that you don't recognize, call the IRS identity-theft line at 1-800-908-4490 and ask about an IP PIN. Keep the notice next to the phone.
Social Security is 1-800-772-1213. Ask them to flag suspected SSN misuse. They won't scrub Experian for you.
IdentityTheft.gov is the hub other companies keep requesting. The FTC line 1-877-438-4338 walks through the recovery checklist. It doesn't delete a fraudulent auto loan by itself.
PayPal, Venmo, Amazon, a wireless carrier, or a crypto exchange should be reached through the official app fraud flow, then a number inside that app or on a card you actually own. Tell them it's an unauthorized account or transfer, give the FTC report number, and ask them to close or freeze the login and send confirmation. Don't email extra ID photos outside their secure center.
If the queue is in Spanish, a simple opener works: "Hola, soy victima de robo de identidad y necesito reportar fraude en mi cuenta." Switch to whichever language you both speak. You don't need a second full script.
Collectors on a fake account should hear that the debt is identity theft, that you dispute it, and that they should send validation in writing. Don't hand them a new debit card. Medical identity theft starts with the insurer and the provider billing office, then the bureaus if a collection hit the report. Child and senior cases need the same FTC report, plus proof you can act for that person.
If they stall
Stay on the original call so the claim number doesn't vanish in a transfer. Ask for the fraud unit, a supervisor, and written confirmation tied to the rule that actually fits the product you're calling about.
Phone, app, or a letter
Use the phone to shut a card off and to freeze credit. Some bank apps now open the same fraud ticket. Use a letter or a secure upload when you need a paper trail, especially for a bureau block or an IRS file. A chat log isn't a claim number, so ask them to email confirmation the same day.
Copy the script, grab your FTC report number, and call the number on the back of the compromised card. Freeze Experian, Equifax, and TransUnion before you go to sleep.