How to File an Identity Theft Report: Alerts, Freezes, and Police

To file an identity theft report, go to IdentityTheft.gov, answer the guided questions about what happened, and download the official FTC Identity Theft Report the site generates for you. That single document carries the same legal weight as a police report for most recovery steps, and it comes with a personalized recovery plan and pre-filled dispute letters you can send to creditors, debt collectors, and credit bureaus.¹ Everything else in your recovery, from freezing your credit to blocking fraudulent accounts, flows from getting that report in hand first.

What to Gather Before You Start

The report asks specific questions, and your answers become part of a sworn statement. Have these ready before you sit down at the site:

Your full Social Security number, date of birth, and current home address.
Account numbers for every credit card, bank account, loan, or service that was opened or misused without your permission.
A chronological list of every fraudulent charge or account, with the date you noticed it, the amount, and which institution reported it.
Bank or credit card statements, collection letters, credit report printouts, and any other paperwork showing the unauthorized activity.

Precision matters because your federal rights are tied to what you can document. A credit bureau must block fraudulent information from your file within four business days, but only after receiving proof of your identity, a copy of your identity theft report, and your identification of the specific fraudulent items.² Gaps in your paperwork translate directly into delays.

Filing the Report at IdentityTheft.gov

Create an account at IdentityTheft.gov. The site walks you through questions about which accounts were affected, what type of fraud occurred, and when you discovered it. Fill in each field using the records you gathered. The document you’re creating is treated as a sworn statement, and submitting false information carries legal consequences, so take your time and be accurate.

When you finish, the site produces two things: your official FTC Identity Theft Report and a personalized recovery plan with step-by-step checklists tailored to your situation.¹ Download and save the report immediately. The system also drafts pre-filled letters you can send to creditors and debt collectors, which spares you from writing legal notices yourself.

Your FTC Identity Theft Report qualifies as an “identity theft report” under federal law, meaning it carries the same weight as a police report when you ask credit bureaus to block fraudulent information or ask businesses to turn over transaction records tied to the fraud.³

Filing a Police Report

Certain creditors and institutions may specifically ask for a police report, so this step is worth doing even though the FTC report stands on its own. Bring a printed copy of your FTC Identity Theft Report, a government-issued photo ID, your log of fraudulent transactions, and any supporting statements or collection letters to your local police station. Some departments accept reports online. Ask the officer for a copy of the report, or at minimum the case number.

If Police Refuse to Take Your Report

Some departments are unfamiliar with identity theft or hesitant to file when the crime didn’t happen in their jurisdiction. Explain that you need the report to exercise your federal rights under the Fair Credit Reporting Act, and show them your FTC Identity Theft Report, which was designed partly for this purpose. If the department still won’t file, your FTC report alone qualifies as a valid identity theft report under federal law and can be used with credit bureaus and creditors on its own.³

Placing Fraud Alerts and Credit Freezes

Fraud alerts and credit freezes are separate protections. Use both.

Fraud Alerts

A fraud alert tells businesses to verify your identity before opening any new credit account in your name. For an initial fraud alert, contact one of the three major credit bureaus (Equifax, Experian, or TransUnion). The bureau you contact is required by law to notify the other two.⁴ An initial alert lasts one year and only requires a good-faith statement that you believe you’re a victim or may become one.

If you have an identity theft report, you can request an extended fraud alert, which lasts seven years. You must submit a copy of the report to qualify.⁵

Credit Freezes

A credit freeze completely blocks anyone, including you, from opening a new credit account until you lift it. You must contact all three bureaus separately to place a freeze. Placing, temporarily lifting, and permanently removing a credit freeze are all free under federal law.⁵ Each bureau gives you a PIN or password to manage the freeze. When you need to apply for credit yourself, you can temporarily lift the freeze online or by phone, typically within one business day for electronic requests.

Notifying Banks and Card Issuers

Contact every bank, credit card issuer, and lender where accounts were compromised or opened without your permission. Have your FTC Identity Theft Report and police report (if you have one) ready. Most institutions have dedicated fraud departments that will freeze the affected accounts, open an internal investigation, and issue new account numbers. Ask for written confirmation that the fraud has been acknowledged and that you’re not being held responsible for the charges.

Debit Card and Bank Account Fraud: The Clock That Matters Most

How fast you report a compromised debit card or bank account directly affects how much you could lose. Federal law sets these liability limits for unauthorized electronic transactions:

Report within two business days of learning about the theft: maximum liability is $50.
Report after two business days but within 60 days of your statement: maximum liability rises to $500.
Report after 60 days from your statement: you could be responsible for the full amount of unauthorized transfers that occurred after the 60-day window.⁶

The two-business-day clock starts when you learn of the loss or theft, not when the unauthorized charge posts. If you discover debit card fraud, report it before anything else.

Fraudulent Bank Accounts and ChexSystems

If someone opened a bank account in your name, it may appear in ChexSystems, a database banks use to screen new account applicants. A negative ChexSystems record can prevent you from opening your own account. File a dispute directly with ChexSystems, include your identity theft report, identify each fraudulent account, and explain that you didn’t authorize it. Also dispute directly with the bank that reported the account.⁷

Blocking Fraudulent Items From Your Credit Report

With your FTC Identity Theft Report in hand, you can require each credit bureau to block fraudulent accounts and charges from appearing on your credit report. The bureau must complete the block within four business days of receiving your identity theft report, proof of your identity, your identification of the specific fraudulent items, and your statement that you didn’t authorize them.² This is not the same as a general dispute; a block specifically applies to identity theft and requires your report.

The bureau must also notify the company that originally reported the fraudulent information, letting them know the data may result from identity theft and that a block has been placed. A bureau can reverse a block only if it determines the block was requested in error, was based on a false claim, or if you actually received the goods or services from the blocked transaction.²

Stopping Debt Collectors on a Fraudulent Debt

If a debt collector contacts you about a debt that isn’t yours, you have the right to dispute it in writing within 30 days of their first contact. Once you send that written dispute, the collector must stop all collection activity until they verify the debt and mail the verification to you.⁸ Send your dispute letter with a copy of your FTC Identity Theft Report. The pre-filled letters IdentityTheft.gov generates are built for this.

To stop contact altogether, send a separate written notice telling the collector to cease communication. After that, the collector can only reach out to confirm they’re stopping, tell you they may pursue a specific legal remedy, or notify you that they intend to take a specific action.

Tax-Related Identity Theft

If someone used your Social Security number to file a fraudulent tax return, you’ll usually discover it when your own e-filed return is rejected because one was already submitted under your number. File IRS Form 14039 (Identity Theft Affidavit). You can submit it online at irs.gov (the preferred method), by fax to 855-807-5720, or by mail to the IRS in Fresno, California.⁹ If you can’t e-file, attach Form 14039 to the back of a paper return and mail both to the IRS address where you normally file. The form asks for your name, taxpayer identification number, the affected tax years, and how you discovered the fraud. You sign under penalty of perjury.

After resolving the immediate problem, request an Identity Protection PIN (IP PIN) to prevent future tax fraud. An IP PIN is a six-digit number you include on your return each year, and without it nobody can file a return using your Social Security number. The fastest path is through your IRS online account.¹⁰ If you can’t verify your identity online and your adjusted gross income on your last return was below $84,000 ($168,000 for married filing jointly), you can submit Form 15227 and the IRS will call to verify by phone.¹¹ If neither option works, schedule an in-person appointment at a Taxpayer Assistance Center with two forms of identification.

Medical Identity Theft

If someone used your information to get health care, prescriptions, or insurance benefits, the fraud creates a separate danger: another person’s medical history in your file can lead to bad treatment decisions. Request copies of your medical and billing records from every provider you’ve used (doctors, hospitals, pharmacies, labs, and your health plan) and review them for anything you don’t recognize. Under HIPAA, you have the right to request corrections. Write to each provider or plan, identify the specific inaccurate items, explain why they’re wrong, and ask that each error be corrected or removed. Send copies of supporting documents and keep the originals.¹²

You can also request an accounting of disclosures from each provider and health plan: a log showing who received your medical information, when, and why. You’re entitled to one free accounting from each provider every 12 months.¹² If a provider’s investigation doesn’t resolve your dispute, you can insist that an explanation of the disagreement be added to your records.

If a Child’s Identity Was Stolen

Children are frequent targets because their Social Security numbers have no credit history attached, and the fraud can go undetected for years. Start by checking whether a credit file exists in your child’s name; no minor should have one unless someone has used their information. TransUnion and Experian offer online portals for child identity theft inquiries. Equifax requires a written request by mail.¹³ If a file exists, you can request that it be removed (if it was created entirely through fraud) or that a security freeze be placed. Filing an FTC Identity Theft Report on behalf of your child creates the same legal protections as filing one for yourself.

Replacing Stolen Identification Documents

If your Social Security card was stolen, apply for a replacement through the Social Security Administration using Form SS-5. You’ll need one document proving your identity: a current, unexpired U.S. driver’s license, state-issued ID, or U.S. passport. The SSA accepts only originals or certified copies from the issuing agency, not photocopies or notarized copies.¹⁴ If you don’t have a primary ID document, the SSA may accept alternatives such as a military ID, employee ID, health insurance card, or certified medical record.

If your driver’s license was stolen, contact your state’s motor vehicle agency to report the theft and request a replacement. You’ll generally need an alternative form of identification and may need to appear in person. For a stolen passport, file a report with the State Department using Form DS-64 and apply for a replacement. Replacing these documents quickly reduces the risk that an imposter can use them to pass identity verification checks elsewhere.

1
Federal Trade Commission. IdentityTheft.gov – Identity Theft Report and Recovery Plan
2
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
3
Legal Information Institute (LII) / Cornell Law School. 15 USC 1681a(q)(4) – Identity Theft Report Definition
4
Federal Trade Commission. Credit Freezes and Fraud Alerts
5
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
6
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
7
Consumer Financial Protection Bureau. Checking Account Consumer Report Dispute Sample Letter
8
Federal Trade Commission. Fair Debt Collection Practices Act Text
9
Internal Revenue Service. Form 14039 Identity Theft Affidavit
10
Internal Revenue Service. Get an Identity Protection PIN
11
Internal Revenue Service. FAQs About the Identity Protection Personal Identification Number (IP PIN)
12
Federal Trade Commission. Medical Identity Theft – FAQs for Health Care Providers and Health Plans
13
Consumer Financial Protection Bureau. How Do I Check To See if a Child Has a Credit Report?
14
Social Security Administration. Application for Social Security Card