To prove identity theft in court, you need a documented chain showing that someone used your personal information without permission, that you reported it promptly, and that the accounts or transactions in question were not yours. That chain is built from an FTC Identity Theft Affidavit, a police report, business records from wherever the thief used your information, your own financial and credit records, and testimony that ties everything together into a consistent timeline.
How much of that chain you need, and how tightly it has to hold, depends on which kind of case you’re in.
Civil Case or Criminal Prosecution
The evidence you gather is largely the same in both settings, but your role and the standard of proof are not.
In a criminal prosecution, the government charges the person who stole your identity under federal law making it a crime to use someone else’s identifying information to commit fraud.1Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents You are a witness, not a party. Prosecutors have to prove the defendant’s guilt beyond a reasonable doubt, and your documents and testimony are what let them try.
In a civil case, you are the one filing suit. Most civil identity theft cases run on the Fair Credit Reporting Act (FCRA), which lets you sue credit bureaus or creditors that fail to investigate or correct fraudulent information after you report it.2Federal Trade Commission. Fair Credit Reporting Act You win by showing that your version of events is more likely true than not, which lawyers call preponderance of the evidence. You do not have to identify the thief or explain how they got your information. You have to show that the accounts were not yours and that the company you’re suing did not follow the law when you reported the problem.
The Two Documents That Start Every Case
Two foundational filings, taken together, form your Identity Theft Report and unlock specific legal protections you will rely on later.3Federal Trade Commission. Report Identity Theft
The FTC Identity Theft Affidavit
You create this at IdentityTheft.gov by describing how you discovered the theft and listing the affected accounts. The site generates a sworn affidavit and a personalized recovery plan with pre-filled dispute letters.4Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover From Identity Theft The affidavit is what tells businesses, in a form they are obligated to take seriously, that someone stole your identity.
The Police Report
File with your local police department. Bring the FTC affidavit, a government-issued ID, and any evidence you already have — fraudulent bills, statements, denial letters. Many creditors and financial institutions will not investigate a fraud claim or release you from fraudulent debts until you produce both the affidavit and a police report.5Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft The report also fixes the date you officially reported the crime, which can matter for filing deadlines later.
Once both pieces exist, credit bureaus must block fraudulent information from your file within four business days of receiving your report, proof of identity, and a statement identifying the fraudulent accounts.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft Their compliance, or lack of it, becomes evidence in its own right.
Business Records: The Most Powerful Evidence
The single most underused tool in an identity theft case is your federal right to demand transaction records from any business where the thief used your information. Under the FCRA, a company that extended credit, sold products, or accepted payment from someone using your identity must hand over copies of the application and transaction records within 30 days of your written request, at no cost.7Office of the Law Revision Counsel. 15 U.S. Code 1681g – Disclosures to Consumers
These records often carry more weight than anything else you can produce. They may include the thief’s handwriting on a credit application, a shipping address that isn’t yours, or IP addresses and device information from online transactions. To request them, send a written letter to the business’s fraud department with your identity theft report, a government-issued ID, and a description of the specific transactions you believe are fraudulent. If you authorize it, the business must also provide the same records directly to law enforcement.8Federal Trade Commission. FCRA 609(e) – Information Available to Victims
A refusal is itself useful. When you later sue under the FCRA, the business bears the burden of proving it conducted a reasonably diligent search and that the records do not exist.8Federal Trade Commission. FCRA 609(e) – Information Available to Victims
Your Own Evidence File
Alongside official reports and business records, you have to assemble the day-to-day documentation that turns a claim into a case.
Financial Records
Pull bank statements, credit card bills, and loan documents covering the period before, during, and after the theft. Placing legitimate transactions next to fraudulent ones produces a timeline that shows, without narration, where your activity stops and the thief’s begins. Two consecutive statements — one showing no credit card debt in April, one showing $8,000 owed in May — can carry the point on their own.
Credit Reports
Pull your reports from all three major bureaus: Equifax, Experian, and TransUnion. Each may show different fraudulent accounts, so checking one gives you an incomplete picture. You are entitled to one free report per bureau per year, and all three have made free weekly reports permanently available at AnnualCreditReport.com.9Federal Trade Commission. Free Credit Reports Save each version you pull. A report from the height of the fraud showing five accounts you never opened is strong evidence; a later report showing those accounts blocked helps demonstrate the timeline of your dispute.
A Communications Log
Save every letter, email, and text connected to the fraud — collection notices, denial letters, dispute correspondence. Keep a running log of every phone call: date, time, representative’s name, what they said. This paper trail proves you actively disputed the fraudulent activity, which shuts down any argument that you accepted the debts by staying silent. It also preserves a written record of anything a company told you on the phone that later contradicts what it says in court.
Testimony That Supports the Documents
Documents are the backbone of the case, but testimony fills gaps paper can’t cover.
Your Own Testimony
You will walk the court through what happened: when you discovered the theft, what you found, and what you did. Consistency is what matters. If your account matches the dates in your police report, your FTC affidavit, and your communications log, the court sees a credible victim. Unexplained discrepancies get exploited. Review your documentation before testifying so your timeline is locked in.
Your testimony should also cover the impact: hours spent disputing accounts, collection calls, a denied mortgage or car loan. In a civil case, that’s what supports a damages claim.
Corroborating Witnesses
If a fraudulent transaction happened at a physical location, someone who can place you elsewhere provides an alibi. A coworker in a meeting with you, a family member you were visiting out of state, timestamped photos from a social event — each helps. Courts scrutinize alibi testimony from close friends and family more heavily than testimony from neutral parties, so independent corroboration carries more weight.
Professionals who touched the case make strong witnesses too. A bank employee who flagged a suspicious withdrawal, a notary who can confirm the signature on a fraudulent document doesn’t match yours, or the officer who took your report can each verify a specific piece of your story.
Expert Witnesses
Some cases benefit from experts. A forensic document examiner can compare your handwriting against signatures on fraudulent applications. A digital forensics expert can trace the origin of online transactions and explain IP addresses and device logs to a judge or jury. Experts are especially useful when the other side argues you authorized the transactions yourself. Examinations and court appearances often run several thousand dollars per witness, so they make the most sense when the amount at stake justifies the cost.
How Much Evidence Is Enough
The burden of proof determines how tightly your evidence has to fit together.
In a civil FCRA suit, preponderance of the evidence means tipping the scales just past 50 percent. A well-organized set of documents showing the fraudulent accounts, your timely disputes, and the company’s failure to investigate is often enough. You do not need to identify the thief.
In a criminal prosecution, the government must prove guilt beyond a reasonable doubt — a substantially higher bar. That burden falls on prosecutors, not you, but the strength of your evidence directly affects whether prosecutors pursue charges and whether a jury convicts. The more detailed your package, the easier their job.
Getting Evidence Into the Record
Organization in the courtroom is the difference between a judge who follows your story and one who loses the thread. Arrange your documents chronologically in a binder with numbered exhibit tabs. Prepare at least three copies: one for the judge, one for the opposing party, one for you.
Each document has to be formally admitted before the court can consider it. You refer to the document by its exhibit number, show it to opposing counsel, and ask the court to admit it. Business records like bank statements and credit card bills may qualify as self-authenticating when accompanied by a certification from the custodian of records confirming they were kept in the normal course of business.10Legal Information Institute. Federal Rules of Evidence Rule 902 – Evidence That Is Self-Authenticating Records you obtained under the FCRA’s business records provision come with built-in credibility, since the company was legally obligated to produce them.
When you testify, tie your narrative to the exhibits. Rather than describing the fraud in the abstract, point the court to the document: “Exhibit D is my June credit card statement showing a $2,300 charge from a store in a city I have never visited.” Every claim gets anchored to a piece of physical proof.
A one-page timeline listing the key dates, fraudulent accounts, and financial losses works well as its own exhibit. Judges appreciate a chronological guide when sorting through a stack of financial records.
Filing Deadlines
None of the evidence matters if you file too late. FCRA lawsuits must be brought within two years of discovering the violation or five years from the date the violation occurred, whichever comes first.11Office of the Law Revision Counsel. 15 U.S. Code 1681p – Jurisdiction of Courts; Limitation of Actions The discovery date is when you knew or should have known about the violation, not necessarily when the fraud first occurred. If a credit bureau refused to block fraudulent information in January 2024 and you found out that same month, the two-year clock started then.
State-level identity theft and fraud claims carry their own deadlines, which vary widely — some states allow as few as two years, others six or more. The clock often, but not always, starts running from the date you discovered the fraud. If you are considering a state-law claim alongside a federal FCRA suit, check the applicable deadline early. Missing a filing deadline is the one mistake no amount of evidence can fix.