How to Report Identity Theft to the FTC at IdentityTheft.gov

Last updated October 7, 2026 · 1,292 words · Identity Theft

Identity theft is reported to the Federal Trade Commission at IdentityTheft.gov. Filing there creates an FTC Identity Theft Report, an official record of the fraud, and generates a recovery plan listing the organizations to notify. The report is separate from a police report and from a dispute filed with a credit reporting agency.

This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.

Key takeaways

• IdentityTheft.gov is the Federal Trade Commission's dedicated site for reporting identity theft and generating an FTC Identity Theft Report.
• The FTC report creates documentation of the fraud; it does not by itself remove accounts from a credit file.
• FCRA section 605A governs fraud alerts (15 U.S.C. section 1681c-1) and section 605B governs identity theft report blocking (15 U.S.C. section 1681c-2).
• An initial fraud alert lasts 1 year and an extended fraud alert lasts 7 years, while a security freeze is free to place, temporarily lift, or remove under federal law.
• Tax-related identity theft is reported separately to the Internal Revenue Service using Form 14039.
• Credit scores, including FICO and VantageScore, use a range of 300 to 850 and are calculated from credit report contents, not from the FTC filing itself.

Identity theft is reported to the Federal Trade Commission (FTC) at IdentityTheft.gov, the agency's dedicated reporting site. A completed report produces an FTC Identity Theft Report — an official record of the fraud — plus a recovery plan generated from the details entered. The FTC also publishes background material at FTC — Identity theft.

What the FTC actually does with a report

The FTC is a consumer protection and law enforcement agency. It is not a credit bureau, bank, or lender, and it does not delete accounts from credit files or contact creditors on a consumer's behalf. Filing at IdentityTheft.gov does three practical things: it creates a formal record of what happened, it generates the Identity Theft Report that other organizations recognize, and it assembles a recovery plan covering the institutions that typically need to be told.

The Identity Theft Report matters because several rights under the Fair Credit Reporting Act (FCRA, 15 U.S.C. section 1681) are tied to having one. The FCRA was enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003, which added many of the identity theft provisions in use today. FCRA section 605A covers fraud alerts (15 U.S.C. section 1681c-1) and section 605B covers identity theft report blocking (15 U.S.C. section 1681c-2).

Information the report draws on

The report is built from answers to questions about the fraud, so documents kept nearby shorten the process. Commonly referenced items include:

• A government-issued photo ID and proof of current address, which the FTC and credit reporting agencies use to verify identity.
• Credit reports from Equifax, Experian, and TransUnion showing accounts, inquiries, or addresses the consumer does not recognize. The FCRA gives consumers the right to a free report from each nationwide agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com.
• Account statements, collection notices, or letters about debts that were not opened by the consumer.
• Dates, dollar amounts, and company names recorded as they are found rather than recalled later.
• For tax-related fraud, IRS records and any notices about a return that was not filed by the consumer.

How the FTC reporting process is structured

1. Open IdentityTheft.gov and answer the opening questions about what type of information was misused.
2. Work through the category-specific questions — for example, a misused Social Security number, a new account opened in the consumer's name, or a fraudulent tax return.
3. Review the recovery plan the site generates, which lists the organizations to notify and the order in which notifications usually happen.
4. Download or print the FTC Identity Theft Report and store a copy in a secure file.
5. Return to the account and update the report if additional fraudulent activity surfaces later.

Completing the FTC report does not require a police report, although some creditors and insurers ask for one separately and a police report is a recognized supporting document. Filing with the FTC does not replace notifying law enforcement, the credit reporting agencies, or individual creditors.

What happens after a report is filed

An FTC Identity Theft Report functions the way an affidavit functions: it documents the claim that specific activity was not authorized. Credit reporting agencies and businesses that receive it can compare it against their own records. Disputes filed with a credit reporting agency under the FCRA generally must be investigated within 30 days, and that period can extend to 45 days if the consumer provides additional information during the initial 30-day window.

One distinction is worth stating plainly: not every disputed item is removed. Most negative information, including late payments, stays on a credit report for 7 years; a Chapter 7 bankruptcy stays for 10 years and a Chapter 13 bankruptcy stays for 7 years. Fraudulent accounts are handled differently from accurate-but-unfavorable accounts, and section 605B blocking is the provision that addresses information resulting from identity theft.

Fraud alerts, freezes, and how they relate to the report

Fraud alerts and security freezes are separate tools from the FTC report, and both are governed by the FCRA. An extended fraud alert lasts 7 years and is tied to having an identity theft report on file, as described by the FTC. The table below summarizes what each protection does and how long it lasts.

A freeze is placed separately with each of the three nationwide credit reporting agencies — Equifax, Experian, and TransUnion — and a lock is a commercial product offered by a credit reporting agency that operates similarly to a freeze. More detail on those mechanics is in the pages on security freezes and credit locks.

Reporting to the IRS and other organizations

Tax-related identity theft runs on a separate track. When a Social Security number is misused on a tax return, the filing made with the Internal Revenue Service using Form 14039 is distinct from the FTC report. Other organizations that commonly receive notification include banks and card issuers for the specific accounts involved, state attorneys general, and the postal inspection service when mail was diverted. If your identity is stolen, you can report it at IdentityTheft.gov and to the IRS using Form 14039.

How identity theft interacts with credit scores

Most credit scores, including FICO and VantageScore, use a range of 300 to 850, and they are calculated from the contents of credit reports rather than from any filing made with the FTC. FICO's published factor weights are payment history at 35%, amounts owed at 30%, length of credit history at 15%, new credit at 10%, and credit mix at 10%. VantageScore uses its own factor weighting and does not publish fixed percentages.

Because fraudulent accounts are reported into credit files as if they belonged to the consumer, they can be counted in the same factors as legitimate accounts. An unpaid fraudulent balance can appear within amounts owed, and inquiries from applications the consumer never submitted can appear within new credit. Hard inquiries typically remain on a credit report for 2 years. That is why the record created at IdentityTheft.gov and the dispute process that follows are connected: the report establishes that the activity was fraudulent, while a change to the credit file changes what the scoring factors are reading. Background on those factors is in the guides on how credit scores are calculated, credit utilization, and payment history.

Documentation that supports a report over time

Identity theft cases often unfold over months, and records assembled early tend to answer later questions. Documentation that is commonly retained includes:

• A copy of the FTC Identity Theft Report and the date it was filed.
• Confirmation numbers and dates for every fraud alert, freeze, and dispute submitted.
• Correspondence from creditors and credit reporting agencies, including any response stating that a disputed item was verified.
• A written log of phone contact: date, organization, representative name if given, and outcome.

Ongoing review of credit files also plays a role after an initial report, since new accounts can surface well after the first filing. The pages on credit monitoring, credit reports, and the identity theft hub explain how files are tracked and how dispute records are organized. Complaints about how a credit reporting agency handled a dispute can also be submitted to the Consumer Financial Protection Bureau, which was created by the Dodd-Frank Act in 2010 and began operating in 2011.

This page is for education only and is not financial advice.

Frequently asked questions

Related guides

• How Credit Scores Are Calculated
• Credit Utilization Explained
• Payment History And Credit Scores
• Credit Score Ranges Explained

Related terms

• Identity Theft
• Fraud Alert
• Security Freeze
• Credit Report Dispute
• Ftc Identity Theft Report

Sources

• IdentityTheft.gov (FTC)
• FTC