How to Report Identity Theft: FTC Report and Next Steps

If someone has used your Social Security number, opened an account in your name, or filed a tax return as you, the report you file first shapes almost everything that follows. An FTC Identity Theft Report from IdentityTheft.gov unlocks specific federal rights that a plain dispute letter does not, and knowing which situations still call for an actual police report on top of it can save you weeks of back-and-forth with a credit bureau.

This page covers how to file an FTC Identity Theft Report, what that report legally does once you have it, the federal law that lets you get fraudulent information blocked from your credit report, and when a police report still matters. For the parent overview of identity theft law generally, see our identity theft laws hub. For the specific difference between a credit freeze and a fraud alert, see credit freeze vs. fraud alert.

Start With an FTC Identity Theft Report

An FTC Identity Theft Report is the foundation almost every other identity theft remedy builds on. IdentityTheft.gov describes its own process in three steps: "Tell us what happened. We'll ask some questions about your situation... Get a recovery plan. We'll use that info to create a personal recovery plan... Put your plan into action. If you create an account, we'll walk you through each recovery step, update your plan as needed, track your progress, and pre-fill forms and letters for you." The site is free, run directly by the FTC, and asks specific questions about what actually happened so the recovery plan it generates matches your situation rather than giving generic advice.

Report only what actually happened. IdentityTheft.gov's own homepage warns that "it is illegal to knowingly file a false identity theft report with the Federal Trade Commission," and that doing so "may result in a fine, imprisonment, or both."

What an FTC Report Lets You Do That a Plain Dispute Cannot

IdentityTheft.gov's Sample Letters page draws a direct line between having an FTC report and not having one. If you have an FTC Identity Theft Report, credit bureaus "must honor your request to remove fraudulent information from your credit report," a process called blocking, and once information is blocked, companies "can't report the debt or try to collect it from you." The site provides a specific "Identity Theft Letter to a Credit Bureau" for this purpose, along with dispute letters aimed at the businesses where the fraud occurred.

If you do not have an FTC report, you can still dispute incorrect information in your credit file directly, but IdentityTheft.gov is candid that "it can take longer, and there's no guarantee that the credit bureaus will remove the information." In that situation the site provides a plain "Dispute Letter to a Credit Bureau" instead of the stronger blocking letter. In practical terms, filing the FTC report first is what turns a routine, often-contested dispute into a legal right the bureau has to honor within a set timeframe, covered next.

Blocking Fraudulent Information From Your Credit Report: FCRA § 605B

The legal mechanism behind an FTC report's power over your credit file is 15 U.S.C. § 1681c-2, part of the Fair Credit Reporting Act and commonly cited as FCRA § 605B. To get fraudulent information blocked, you need to give the credit reporting agency four things: appropriate proof of your identity, a copy of your identity theft report, identification of the specific information that is fraudulent, and a statement that the information does not relate to any transaction you made. Once the agency has all four, the statute requires it to act "not later than 4 business days after the date of receipt" of that documentation.

Blocking is not the same as a dispute investigation, and it is not the same as a credit freeze. A block removes specific fraudulent tradelines or accounts from your report and requires the agency to notify the company that reported them, telling that company someone stole your identity, that a report was filed, and the effective dates of the block. A credit freeze, covered in depth on our credit freeze vs. fraud alert page, instead prevents any new account from being opened at all. They solve different problems and you may need both.

A credit reporting agency can decline or later rescind a block if it reasonably determines that you actually did obtain the goods, services, or money in question, or if your block request involved a material misrepresentation of fact. IdentityTheft.gov's Know Your Rights page describes the same mechanic in consumer terms: "Get credit bureaus to remove fraudulent information from your credit report. This is called blocking. You must send them a copy of your FTC Identity Theft Report, proof of your identity, and a letter stating which information is fraudulent. Then the credit bureau must tell the relevant creditor that someone stole your identity. Creditors cannot turn fraudulent debts over to debt collectors."

Stopping Debt Collectors and Creditors From Reporting Fraudulent Accounts

Once you have a valid FTC Identity Theft Report, you have specific leverage against both creditors and debt collectors. Per IdentityTheft.gov, after you give creditors and debt collectors a copy of a valid FTC report, "they may not report fraudulent accounts to the credit reporting companies." Separately, and this applies even before you have a full report resolved, "in most cases, debt collectors must stop contacting you after you send them a letter telling them to stop." Combining both, a written notice to the collector plus your FTC report, addresses most of the harassment identity theft victims describe as the most stressful part of the process.

Keep a copy of every letter you send and every response you get, including the date it was sent and, where possible, proof of delivery. If a creditor or collector continues reporting or contacting you after receiving proper notice, that is worth raising directly with the Consumer Financial Protection Bureau or the FTC, since it is no longer a simple dispute at that point.

Do You Also Need a Police Report?

The honest answer is that it depends, and no single national rule covers every situation. An FTC Identity Theft Report can substitute for a police report for most credit bureau and creditor dispute purposes described above; it does not require an underlying police report to be effective. That said, some specific businesses or legal processes may still ask for an actual police report, and filing one is generally worth doing if you have information that could identify a specific suspect, since only law enforcement can act on that.

A number of states also have their own statutes addressing a victim's right to file a police report for identity theft specifically, separate from the state's criminal identity theft statute itself. Because the exact scope and wording of these state-specific provisions were not independently confirmed for this page, treat this as a lead rather than a settled answer: check with your local police department about their specific policy for taking an identity theft report, and ask whether your state has its own statute on the subject before assuming either that a report is required or that it will be refused.

A Quick Note on Fraud Alerts

Separately from blocking, federal law also lets you place a fraud alert with any one credit bureau, which that bureau must then pass along to the other two. An initial fraud alert lasts at least one year; once you have an FTC Identity Theft Report, you can request an extended fraud alert that lasts seven years and comes with stronger protections. Because this overlaps closely with the freeze-versus-alert decision most identity theft victims and breach victims face, the full comparison, including when a freeze is the better tool and when an alert is enough, lives on our dedicated credit freeze vs. fraud alert page rather than being repeated here.

Keep Records As You Go

Every step above works better with paper behind it. Save a copy of your FTC Identity Theft Report and recovery plan, every letter you send to a credit bureau, creditor, or debt collector, every response you receive, and any police report number if you file one. If a dispute ever escalates, whether to a lawsuit, a Consumer Financial Protection Bureau complaint, or simply a second round with a bureau that failed to block information within the required window, that record is what makes the difference between a quick resolution and a drawn-out fight.

Information last verified on 2026-08-13, drawn directly from IdentityTheft.gov's homepage, Sample Letters page, and Know Your Rights page, and from 15 U.S.C. § 1681c-2. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• Credit Freeze vs. Fraud Alert
• Tax Identity Theft: Form 14039 and the IP PIN Program
• What To Do After a Data Breach: A Step-by-Step Guide

---

Last updated: 2026-08-13.

Frequently Asked Questions

What is an FTC Identity Theft Report?

It is a report you generate for free at IdentityTheft.gov after describing what happened to you. It is the document that unlocks specific legal rights, including the right to get fraudulent information blocked from your credit report under FCRA § 605B, that a plain credit-bureau dispute does not carry on its own.

Do I need a police report to file an FTC Identity Theft Report?

No. You can file an FTC Identity Theft Report directly at IdentityTheft.gov without first filing a police report. Some specific businesses or situations may still ask for one, and filing a police report is worth doing if you have information identifying a suspect.

How long does a credit bureau have to block fraudulent information once I send my FTC report?

Under 15 U.S.C. § 1681c-2, once a credit reporting agency has your proof of identity, a copy of your identity theft report, identification of the fraudulent information, and your statement that it is not your transaction, it must act not later than 4 business days after receiving that documentation.

Can a credit bureau refuse to block information even with an FTC report?

Yes, in limited circumstances. A credit reporting agency can decline or later rescind a block if it reasonably determines you actually obtained the goods, services, or money involved, or if your block request involved a material misrepresentation of fact.

Can debt collectors keep contacting me after I report identity theft?

In most cases, no. Debt collectors generally must stop contacting you after you send them a letter telling them to stop, and after you send a valid FTC Identity Theft Report, creditors and debt collectors generally may not report the fraudulent account to credit reporting companies.

Is filing a false identity theft report a crime?

Yes. IdentityTheft.gov states directly that it is illegal to knowingly file a false report with the FTC, and doing so may result in a fine, imprisonment, or both. Only report identity theft that actually happened to you.

What is the difference between blocking information and a credit freeze?

Blocking, under FCRA § 605B, removes specific fraudulent accounts or entries from your credit report after identity theft. A credit freeze instead prevents any new account, fraudulent or not, from being opened at all. They address different problems, and many victims need both. See our credit freeze vs. fraud alert guide for the full comparison.