How to Report Identity Theft: Step-by-Step Guide

Discovering that your identity has been stolen triggers a familiar mix of emotions: panic, disbelief, anger, and confusion about what to do first. This guide eliminates the confusion. The steps below are the right ones, in the right order, based on the FTC’s established recovery framework and the practical realities of how creditors, credit bureaus, government agencies, and law enforcement handle identity theft cases.

Work through these steps methodically. Keep records of everything. The paper trail you create now will be essential in every dispute and claim that follows.

—

Step 1 — Report to the FTC at IdentityTheft.gov (Do This First)

The Federal Trade Commission’s IdentityTheft.gov is the official U.S. government resource for identity theft victims, and your first call should be here — before calling your bank, before calling the police.

Here’s why: when you report to the FTC, you receive two things that are invaluable for everything that follows:

An official FTC Identity Theft Report. This is a legal document that functions as a substitute for a police report in many contexts. Creditors are required under federal law to honor it when you dispute fraudulent accounts. Credit bureaus must accept it as proof of identity theft. Government agencies use it as verification. It is the cornerstone of your entire recovery.

A personalized recovery plan. The FTC’s website generates a step-by-step plan specific to the type of identity theft you experienced. If someone opened credit cards in your name, your plan will look different from a tax fraud case or a medical identity theft case.

Go to IdentityTheft.gov. Complete the report fully and honestly. Print or save your Identity Theft Report and your recovery plan. You will reference these documents many times.

—

Step 2 — File a Police Report

A police report creates an official law enforcement record of the crime, which serves several purposes:

Many creditors and institutions will only accept a police report (not just an FTC report) for certain types of disputes. Having both gives you maximum documentation.

Some state attorneys general and identity theft programs require a police report to access their assistance programs.

If law enforcement is ever able to identify and prosecute the perpetrator, your police report establishes you as a victim.

How to file: Go to your local police station in person. Bring:

– Your government-issued photo ID

– Your FTC Identity Theft Report (generated in Step 1)

– Any bills, statements, or correspondence related to the fraudulent accounts

– Your Social Security number (to be recorded in the report)

Be as specific as possible. Ask for a copy of the police report with the report number when you leave. Some jurisdictions allow online reporting for fraud crimes — check your local police department’s website.

Note: Some police departments are reluctant to take identity theft reports, particularly if the crime occurred elsewhere. If you encounter resistance, ask to speak to a supervisor, and mention that you need the report for creditor disputes. If you still can’t get a report, your FTC Identity Theft Report alone is sufficient for most purposes.

—

Step 3 — Contact the Three Major Credit Bureaus

You need to take two actions at each of the three major credit bureaus: place a fraud alert (or upgrade to a credit freeze if you haven’t already), and review your credit report for fraudulent accounts.

Fraud alert (if you haven’t already frozen your credit):

Contact any one of the three bureaus — they are legally required to notify the other two:

– Equifax: equifax.com | 1-800-685-1111

– Experian: experian.com | 1-888-397-3742

– TransUnion: transunion.com | 1-888-909-8872

An initial fraud alert lasts one year and requires lenders to take additional verification steps before extending credit. If you’ve been a confirmed victim of identity theft (i.e., you have an FTC Identity Theft Report), you can request an extended fraud alert, which lasts seven years.

Review your full credit report at each bureau:

Go to AnnualCreditReport.com and pull all three reports. Review each one carefully for:

– Accounts you don’t recognize

– Hard inquiries you didn’t authorize

– Addresses you’ve never used

– Inaccurate personal information

Make a list of every fraudulent entry. You’ll address each one in Step 6.

—

Step 4 — Place a Credit Freeze at All Three Bureaus

If you haven’t already frozen your credit, do it now. A credit freeze is distinct from a fraud alert — it completely locks your credit file, preventing any new credit from being extended in your name. It is free and does not affect your credit score.

Freeze at each bureau individually:

– Equifax: equifax.com/personal/credit-report-services/credit-freeze/

– Experian: experian.com/freeze/center.html

– TransUnion: transunion.com/credit-help/freeze-credit

Keep the PIN or account information you receive from each bureau — you’ll need it to temporarily unfreeze your credit when you legitimately apply for new accounts in the future.

—

Step 5 — Complete IRS Form 14039 if Tax Fraud Is Involved

If your Social Security number was used to file a fraudulent tax return, or if you have reason to believe it may be used for tax fraud in the future, file IRS Form 14039 — the Identity Theft Affidavit.

Download Form 14039 at irs.gov/pub/irs-pdf/f14039.pdf.

Submit it by mail along with a copy of a government-issued ID. If you’re also filing a tax return for the current year, attach Form 14039 to your paper return.

The IRS will assign you an Identity Protection PIN (IP PIN) — a six-digit number that must be included on all future tax returns filed under your SSN. This effectively prevents anyone from filing a return in your name without the PIN.

You can also proactively request an IP PIN without being a confirmed victim at irs.gov/identity-theft-fraud-scams. This is strongly recommended for anyone whose SSN has been exposed in a data breach.

—

Step 6 — Contact Each Affected Financial Institution and Creditor

For every fraudulent account, hard inquiry, or charge you identified in Step 3, you need to contact the institution directly — not just dispute through the credit bureau.

When you contact each institution:

– Ask to speak with their fraud department (not general customer service)

– Explain that you are a victim of identity theft

– Provide your FTC Identity Theft Report and police report number

– Request that the account be closed immediately and flagged as fraudulent

– Ask them to send written confirmation that the account is not your responsibility

– Request that they submit corrections to the credit bureaus

Follow every phone call with a written letter — certified mail, return receipt requested. Keep copies of everything.

The creditor is legally required, under the Fair Credit Reporting Act and the Fair Debt Collection Practices Act, to investigate your dispute. Once an account is confirmed as fraudulent, they must remove it from your credit report and stop collection activities.

—

Step 7 — Dispute Fraudulent Items with the Credit Bureaus

In addition to contacting each creditor directly, file a formal dispute with each credit bureau for every fraudulent account and inquiry on your reports.

Disputes can be filed online at each bureau’s website, or by mail. Filing by mail (certified, return receipt requested) creates a stronger paper trail.

Each bureau has 30 days to investigate your dispute. If the item cannot be verified, it must be removed. If it is verified as legitimate, you can request that the bureau include a statement of dispute in your file.

Bureaus are also required, under Section 605B of the Fair Credit Reporting Act, to block information that is the result of identity theft when you provide your FTC Identity Theft Report — this is a stronger remedy than a standard dispute.

—

Step 8 — Document Everything

This step runs concurrently with every other step and continues throughout the recovery process.

Keep a written log that records:

– Every call: date, time, name of representative, company, phone number, what was discussed, and any reference or case numbers provided

– Every letter sent: date, method (certified mail? fax?), recipient, and what it contained

– Every letter received: date received, sender, what it said, and any action required

Organize all documents — account statements, FTC report, police report, bureau correspondence, creditor correspondence, dispute responses — in a dedicated folder or binder. You will reference these documents many times over the coming months.

—

Step 9 — Set Up Ongoing Monitoring

Once your immediate reporting and dispute process is underway, set up systems to catch any further activity quickly:

– Enable alerts for all remaining legitimate financial accounts

– Set calendar reminders to re-pull credit reports monthly

– Review your SSA earnings record at SSA.gov

– If applicable, monitor your IRS account and your Medicare account

– Consider an identity theft protection service if you haven’t already

—

Do You Need an Identity Theft Lawyer?

In most cases — a few fraudulent credit card accounts, a tax return filed in your name — the FTC’s recovery framework, your own disputes, and direct creditor contact is sufficient. You don’t need an attorney.

However, an identity theft attorney can be genuinely valuable in these situations:

– Criminal identity theft has created a false record you need to clear through the court system

– A creditor repeatedly refuses to remove a fraudulent account despite your FTC report and disputes

– You’ve been sued over a debt from a fraudulent account

– The financial or reputational damage is severe enough to warrant legal action against the perpetrator

– You need help navigating a complex multi-agency recovery involving tax, medical, and financial fraud simultaneously

Many identity theft attorneys work on contingency or offer free initial consultations. The Identity Theft Resource Center (idtheftcenter.org) can connect you with resources in your state.

—

Frequently Asked Questions

Q: How long does the reporting and recovery process take?

A: Simple cases (one or two fraudulent accounts) can often be resolved in 4–8 weeks. Complex cases involving multiple account types, government agencies, or criminal records can take 12–24 months. Tax identity theft cases are typically resolved in 6–12 months by the IRS.

Q: Can I report identity theft anonymously?

A: The FTC’s reporting at IdentityTheft.gov is not anonymous — your information is required to generate a valid Identity Theft Report. However, the report is used to assist you, not shared publicly. Police reports are also not anonymous, as law enforcement requires your information to document the crime.

Q: What if the fraud occurred in another state or country?

A: Your FTC report and credit bureau disputes remain the same regardless of where the fraud occurred. For police reports, you can typically file in your own jurisdiction even if the crime originated elsewhere. For international fraud, the FBI’s Internet Crime Complaint Center (IC3.gov) handles reports with an international component.

—

Internal Links:

→ Pillar: https://www.scammed.org/identity-theft/

→ Recovery: https://www.scammed.org/identity-theft/recovery/

→ Tax identity theft: https://www.scammed.org/identity-theft/types/tax/

→ Site-wide: https://www.scammed.org/how-to-report-a-scam/