How to Report Identity Theft and Get a Recovery Plan

A statement arrives for a card nobody applied for, or an e-filed return bounces back as a duplicate. The instinct is to start disputing things as they surface, but the FTC's recovery guidance runs in a fixed sequence, and one document generated partway through is what the later steps depend on.

Call the companies where the fraud happened

The FTC's consumer alert How to recover from identity theft puts this first: call the fraud department at each company where an account was opened or charged, say that someone stole your identity, and ask for the account to be closed or frozen.

Place a free fraud alert or a credit freeze

The FTC's Credit Freezes and Fraud Alerts page sets out the difference. It says an initial fraud alert tells businesses to check with you before opening a new credit account in your name, is free, lasts one year, and need go to only one of the three credit bureaus, because that bureau must tell the other two. A credit freeze, the same page says, means nobody can open a new credit account in your name, including you; it costs nothing, and it goes to all three bureaus separately (as of September 2026).

Report the theft at IdentityTheft.gov

IdentityTheft.gov is the FTC's reporting site and the step the rest of the recovery hangs on. The FTC's What To Know About Identity Theft page says reporting there produces a personal recovery plan that walks you through each step and prints pre-filled letters and forms to send to credit bureaus, businesses, and debt collectors, across more than 30 types of identity theft. The FTC's What To Know About Tax Identity Theft page lists what the report creates: an FTC Identity Theft Report, an IRS Identity Theft Affidavit, and a personal recovery plan.

File a police report with the FTC report in hand

The FTC alert Getting your records can help says to bring your ID, the FTC Identity Theft Report, and any information you have about the incident when filing the police report. That page also says a written request carrying both the police report and a completed FTC Identity Theft Report is how records of a thief's accounts get released, and that the company has 30 days to provide them free of charge (as of September 2026).

Send the IRS an affidavit for a fraudulent return

The FTC tax page says that when a return is rejected as a duplicate filing, report it at IdentityTheft.gov, which can submit the IRS affidavit online. The IRS page on Form 14039 says only victims of tax-related identity theft should submit it, and only if they have not received certain IRS letters; where letter 5071C, 4883C, or 5747C has arrived, that page says to follow the letter instead. The IRS identity theft guide covers getting an Identity Protection PIN afterward.

If the credit reports still need reviewing. The FTC's Free Credit Reports page says the three nationwide bureaus permanently extended a program letting you check your report from each once a week for free (as of September 2026).

Sources. Recovering from identity theft, Credit freezes and fraud alerts, Identity theft basics, Tax identity theft, Getting your records, Free credit reports, IdentityTheft.gov, Form 14039 affidavit, IRS identity theft guide.