How to Report Identity Theft: FTC, Credit Bureaus, and Police

Last updated October 7, 2026 · 1,234 words · Identity Theft

Reporting identity theft generally means filing a report with the Federal Trade Commission at IdentityTheft.gov, then contacting the three nationwide credit reporting agencies — Equifax, Experian, and TransUnion — and often local police, so the fraudulent activity is documented in an official identity theft report.

This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.

Key takeaways

An identity theft report is a defined term under FCRA section 605B (15 U.S.C. section 1681c-2) and is used when a consumer asks a credit reporting agency to block information caused by identity theft.
A report filed at IdentityTheft.gov through the Federal Trade Commission creates an FTC Identity Theft Report, and many creditors also ask for a police report.
An initial fraud alert lasts 1 year and an extended fraud alert lasts 7 years; a security freeze is free to place, temporarily lift, or remove under federal law.
Under the FCRA, a credit reporting agency generally must investigate a dispute within 30 days, and that period can extend to 45 days if the consumer supplies additional information during the first 30 days.
Most negative information stays on a credit report for 7 years, and hard inquiries typically remain for 2 years, which is why unauthorized accounts are usually disputed rather than simply waited out.

Reporting identity theft usually means filing an identity theft report with the Federal Trade Commission through IdentityTheft.gov, then notifying the three nationwide credit reporting agencies — Equifax, Experian, and TransUnion — and often local police as well. Those filings create the documented record that federal law recognizes when a consumer asks a credit reporting agency to block information that resulted from fraud.

The sections below explain what each filing does, how the Fair Credit Reporting Act (FCRA) treats an identity theft report, and where fraud alerts, security freezes, and disputes fit into the process. The identity theft section covers related subjects such as stolen account numbers and tax-related fraud.

What an identity theft report is under federal law

"Identity theft report" is a defined term in federal law rather than a general description. Under FCRA section 605B, 15 U.S.C. section 1681c-2, a consumer may ask a credit reporting agency to block information that appears in a credit file because of identity theft, and that request must be accompanied by an identity theft report and proof of the consumer's identity. The full statutory text is published by the Legal Information Institute at Cornell Law School.

In practice, the report is assembled from more than one document. A complaint filed with the FTC through IdentityTheft.gov produces an FTC Identity Theft Report along with a personal recovery plan, and creditors or credit reporting agencies frequently ask for a police report as well. The agency's overview at FTC — Identity theft describes the main categories of identity theft and the reporting channels connected to each.

Where to report identity theft

Reporting is usually spread across several organizations, because each one controls a different part of the record. The list below reflects the channels most commonly used.

Federal Trade Commission. A report at IdentityTheft.gov creates the FTC Identity Theft Report and a recovery plan that lists the documents needed for each affected account.
The three nationwide credit reporting agencies. Equifax, Experian, and TransUnion each maintain a fraud or identity theft department that accepts identity theft reports and fraud alert requests.
Local police. A police report gives law enforcement a formal record and is often requested by creditors and by credit reporting agencies as part of the documentation for an identity theft report.
The Internal Revenue Service. When the fraud involves a tax return, the IRS accepts Form 14039, the Identity Theft Affidavit.
The company where the account was opened or misused. Banks, card issuers, and utilities run their own fraud units and have their own documentation requirements.

Keeping copies of every filing, along with dates and confirmation numbers, matters because the same documents are often requested more than once.

How to report identity theft to credit bureaus

Each of the three nationwide agencies accepts an identity theft report through its own website, by mail, or by phone. Because a report filed with one agency does not automatically create a matching record at the others, consumers typically contact all three. The credit reports section explains what appears in each file and how the three files can differ from one another.

Two protections are usually requested alongside the report. The first is a fraud alert, covered by FCRA section 605A, 15 U.S.C. section 1681c-1. An initial fraud alert lasts 1 year, and the agency that receives it is required to pass it to the other two nationwide agencies. An extended fraud alert lasts 7 years and is available to consumers who provide an identity theft report.

The second is a security freeze, which restricts access to a credit file until the consumer lifts or removes it. Under federal law a security freeze is free to place, temporarily lift, or remove. The credit freeze page describes how a freeze is administered, and credit lock explains how a lock differs from a freeze, since a lock is a company product rather than a statutory right.

Protection	How long it lasts	What it does
Initial fraud alert	1 year	Indicates to businesses that they are expected to take reasonable steps to verify identity before granting credit
Extended fraud alert	7 years	Same effect over a longer period; available to consumers who submit an identity theft report
Security freeze	Remains in place until the consumer lifts or removes it	Restricts access to the credit file; free to place, temporarily lift, or remove under federal law

Disputing fraudulent accounts under the FCRA

Filing a report does not by itself remove an account from a credit file. The next step is a dispute. Under the FCRA, a credit reporting agency generally must investigate a dispute within 30 days, and that period can extend to 45 days if the consumer provides additional information during the initial 30-day window. When information is blocked under section 605B, the agency must also notify the company that furnished it, so the same item is not reported again.

Retention timelines explain why the timing of a dispute matters. Most negative information, including late payments, stays on a credit report for 7 years; a Chapter 7 bankruptcy stays for 10 years and a Chapter 13 bankruptcy for 7 years; hard inquiries typically remain for 2 years. An account opened by someone else can sit in a file for the full reporting period if it is never disputed.

How fraudulent accounts interact with credit scores

Most credit scores, including FICO and VantageScore, use a range of 300 to 850. FICO publishes approximate factor weights: payment history 35%, amounts owed 30%, length of credit history 15%, new credit 10%, and credit mix 10%. VantageScore uses its own weighting and does not publish fixed percentages. A fraudulent account can appear in the payment history or amounts owed categories, and an unauthorized new account can show up as new credit. How credit scores are calculated and FICO vs. VantageScore explain the factor categories, while payment history and credit utilization cover the two largest ones. Score ranges are described in credit score ranges explained.

Watching reports and files after a report is filed

Under the FCRA, consumers are entitled to a free credit report from each nationwide agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com. Reviewing all three files is the practical way to notice accounts, balances, or inquiries that were never authorized. Credit check explains what a file review covers, and credit profile describes the underlying record those files are built from.

Credit monitoring is a commercial service rather than a legal protection. A monitoring product watches one or more files and sends alerts when something changes, which can shorten the gap between a fraudulent account appearing and the consumer noticing it. The credit monitoring section covers how those services are sold and what they do and do not include.

Government agencies also publish broader consumer credit information. The Consumer Financial Protection Bureau, created by the Dodd-Frank Act in 2010 and operating since 2011, collects consumer complaints and publishes research on credit reporting, and the Federal Reserve's G.19 release reports total outstanding consumer credit in the United States.

None of these filings, alerts, or tools produces a particular result. Each one creates a record, a notification, or a restriction, and what follows depends on the facts of the individual case.

This page is published for education only and is not financial advice; it describes how identity theft reporting works under federal law and does not evaluate any individual situation.

Compare three-bureau credit scores and reports from a single place. Educational links, disclosed below.

Three Bureau Credit Scores and Reports

CreditMonitored.com may earn a commission from partner links at no additional cost to you.

Frequently asked questions

Where do you report identity theft?

A report is usually filed with the Federal Trade Commission at IdentityTheft.gov, with each of the three nationwide credit reporting agencies (Equifax, Experian, and TransUnion), and with local police. If the fraud involves a tax return, the IRS accepts Form 14039. The company where an account was opened or misused is also contacted directly.

What is an identity theft report?

It is a defined term under FCRA section 605B, 15 U.S.C. section 1681c-2. It refers to a report filed by a consumer alleging identity theft, together with proof of the consumer's identity, and it is the documentation a credit reporting agency requires before blocking information that resulted from identity theft.

How long does a credit reporting agency have to investigate a dispute?

Under the FCRA, a credit reporting agency generally must investigate a dispute within 30 days. That period can extend to 45 days if the consumer provides additional information during the initial 30-day period.

How long does a fraud alert last?

An initial fraud alert lasts 1 year. An extended fraud alert lasts 7 years and is available to consumers who provide an identity theft report. A security freeze has no set end date; it stays in place until the consumer lifts or removes it, and it is free to place, temporarily lift, or remove under federal law.

Can you report identity theft to credit bureaus online?

Yes. Each of the three nationwide credit reporting agencies accepts an identity theft report through its own website, by mail, or by phone. Because a report to one agency does not create a matching record at the others, consumers typically contact all three.

Does filing an identity theft report remove fraudulent accounts automatically?

No. Filing a report creates the documented record, and a separate dispute or block request is what triggers review of the specific account. Under FCRA section 605B an agency that blocks information must also notify the company that furnished it so the item is not reported again.