How to Report Identity Theft: Step-by-Step Recovery Guide

Identity theft affects millions of people annually and can take months or years to fully resolve. When someone uses your personal information to open accounts, file taxes, or commit crimes in your name, reporting it correctly within the first 48 hours dramatically improves recovery outcomes and limits further damage. The process combines federal complaints, credit bureau coordination, police reports, financial institution coordination, and ongoing monitoring. This guide walks through each step in the order that produces the best outcome, with specific reference to US processes and notes for other countries.

Recognize the Signs of Identity Theft

Identity theft often appears gradually, which is why early detection is critical. Unrecognized accounts appearing on your credit report are one of the clearest signals, particularly when accompanied by credit inquiries you never authorized. Bills arriving for services you never ordered suggest someone has opened accounts using your information. Missing mail can indicate that someone has redirected your correspondence to intercept financial statements or new account cards. A tax return rejected because someone already filed under your Social Security number is a common and particularly disruptive form of identity theft. Notifications of data breaches involving your information should prompt immediate monitoring even before fraud appears. Unexplained charges on existing accounts, calls from collection agencies about debts you don't recognize, medical bills for services you never received, and background check problems that don't match your history are all signals worth investigating immediately. The earlier you detect identity theft, the easier the recovery.

How to Report Identity Theft: Start at IdentityTheft.gov (US)

IdentityTheft.gov is the official US government resource for identity theft victims.

• Visit the site and start a personalized recovery plan
• The system generates an FTC Identity Theft Report, your official documentation
• Recovery steps are tailored to your specific situation
• Pre-filled letters to creditors and credit bureaus
• The site tracks your progress through the recovery process

This single resource handles federal reporting, generates the documentation other steps require, and gives you a clear action plan.

Place a Fraud Alert and Credit Freeze

The first protective step after detecting identity theft is stopping additional fraudulent accounts from being opened in your name. A fraud alert is free and easier to lift later; contact one of the three credit bureaus and they notify the other two automatically. It lasts one year and can be renewed, and it requires creditors to verify your identity before opening new accounts in your name. A credit freeze is stronger and equally free under federal law. Unlike a fraud alert, you must contact each of the three bureaus separately: Equifax, Experian, and TransUnion. A credit freeze prevents creditors from accessing your credit file entirely, which means no new accounts can be opened until you temporarily lift it. A freeze lasts until you remove it and is the strongest available protection during active identity theft recovery. Most people in active recovery situations should pursue both: the fraud alert for immediate notification and the freeze for comprehensive blocking.

Review Your Credit Reports

Once protective measures are in place, review your credit reports from all three bureaus to identify the full scope of the fraud. AnnualCreditReport.com provides one free report per year from each bureau under normal circumstances, but during identity theft recovery you can request free reports more frequently. Go through each report carefully and identify every account you did not open and every credit inquiry you did not authorize. Note the dates, creditor names, and account numbers for each fraudulent entry. This list becomes your master document for the creditor contact process in the next step and forms part of your overall evidence package.

Contact Each Affected Creditor

For every fraudulent account identified, contact the creditor directly using IdentityTheft.gov's pre-filled letters, which are tailored to your specific situation and include your FTC Identity Theft Report number. Send correspondence by certified mail with return receipt so you have proof of delivery. Include a copy of your police report with each communication. Request that each fraudulent account be closed and removed from your credit history, and ask for written confirmation of the resolution. Save all correspondence, including envelopes with postmarks. Most creditors have dedicated identity theft departments that process these requests within 30 to 90 days, and following up after 30 days if you have not received confirmation is standard practice.

File a Police Report

A police report adds local legal weight to your federal complaint.

• Visit your local police department with your FTC Identity Theft Report and other evidence
• Provide all known information about the perpetrator (if any)
• Request a copy of the report, you'll need it for creditors
• Get a reference number
• File even if police seem skeptical; the documentation is what matters

Local police may not investigate further, but the report itself is essential documentation.

Address Specific Types of Identity Theft

Different forms of identity theft require steps beyond the standard process. Tax identity theft requires filing IRS Form 14039, the Identity Theft Affidavit, and continuing to file your taxes on paper if electronic filing is rejected; you should also apply for an Identity Protection PIN to prevent future fraudulent filings. Medical identity theft requires contacting your health insurance company's fraud department and requesting copies of medical records to identify fraudulent entries, followed by a complaint to the HHS Office of Civil Rights. Social Security number theft requires contacting the Social Security Administration directly and filing reports with both the IRS and Department of Labor, while watching for unemployment fraud filed in your name. Child identity theft is particularly damaging because it often goes undetected for years; check whether your child has a credit file, place a freeze on their identity if one exists, and file reports with all three bureaus. Remove online defamation outlines legal options when identity theft has resulted in false information published about you online.

Notify Other Financial Institutions

Beyond credit bureaus and affected creditors, notify all financial institutions that hold accounts in your name. Contact your bank to flag existing accounts for monitoring and alert them to the identity theft so they can watch for suspicious activity. Reach out to credit card issuers for investigation of any unauthorized charges and to verify account security. Contact investment firms to verify account access and security settings. Notify utility companies if accounts were opened in your name for electricity, gas, or other services. Contact your phone carrier specifically, as SIM swap attacks are a common identity theft vector that can compromise two-factor authentication on your other accounts and require rapid carrier intervention to resolve.

Set Up Long-Term Monitoring

Identity theft consequences can resurface for years after the initial incident, which makes ongoing monitoring essential rather than optional. Continue checking credit reports quarterly at minimum to catch any new fraudulent activity before it compounds. Credit monitoring services provide automated alerts for new accounts, inquiries, and address changes. Use Have I Been Pwned to monitor whether your email addresses appear in new data breaches, which can signal renewed risk. Maintain Google Alerts for your name and key identifiers to catch new online content associated with your identity. Reputation monitoring services extend this to broader online surveillance including social media and news sources. If fraudulent accounts or information have already appeared online, removing personal information from the internet is a complementary process worth pursuing in parallel with credit recovery.

International Identity Theft

For victims outside the United States, the reporting structure differs by country but the underlying process is similar. UK victims should file with Action Fraud and register with CIFAS Protective Registration, which flags your identity as at risk to member organizations. EU victims should report to local police and their country's national fraud agency; many EU countries also have dedicated cybercrime units that handle identity theft cases. Canadian victims should file with the Canadian Anti-Fraud Centre and place freezes with Equifax and TransUnion Canada, which operate separately from their US counterparts. Australian victims should contact ID Care, the national identity and cyber support service, and file through ReportCyber for the cybercrime component. Most countries have local equivalents; searching for your country name alongside identity theft report will surface the relevant agency quickly.

Take Action and Recover

Reporting identity theft systematically is the foundation of recovery. IdentityTheft.gov plus credit freezes plus creditor letters plus police report plus ongoing monitoring; each step builds on the previous one and the combination produces results that no single step achieves alone. The process requires persistence but the trajectory is clear: early action limits damage, thorough documentation accelerates creditor responses, and ongoing monitoring prevents recurrence. Specialist support exists for complex cases where fraudulent accounts have already caused significant damage or where the perpetrator is known. Identity theft is not your fault, and the resources to recover are available. Acting in the first week dramatically improves outcomes and prevents further exploitation of your compromised information.