Guides › Security Wealth
How to Report Identity Theft: Credit Bureaus, IRS, SSA and IC3
If someone is using your identity, report it in this order: call the companies where the fraud happened, file with the FTC at IdentityTheft.gov, then freeze your credit at Equifax, Experian and TransUnion. Add the IRS if it touches your taxes, Social Security if someone is working or claiming benefits under your number, and the FBI’s IC3 if it started online. Every step is free.
Most lists hand you all of this at once. Below it is a route instead: one stop at a time, with what each agency needs from you and what you get back. Tick steps off as you go, and the tracker remembers where you left off.
Your recovery tracker
Six stops, in order
Start with stop 1. Each step you tick is saved in this browser.
Saved only on this device. Nothing you tick or type here is sent to us.
Stop 1 Everyone
Lock down the accounts that were hit
- Today before anything else
- Free
- About an hour for most people
Stop the bleeding first. A report does not close a fraudulent card; the company that issued it does. Write down who you spoke to and when: those notes become your evidence.
-
Ask them to close or freeze the accounts so nothing new can be charged, and ask for a letter confirming the fraudulent account was closed and that you are not liable. Use the number on your card or statement, not one from an email or text.
-
Email is the reset key for everything else. Give each account a new, unique password (a password manager makes this easy) and turn on two-factor login or passkeys. The Digital Security Checkup shows what else to close.
Stop 2 Everyone
Report it to the FTC at IdentityTheft.gov
- Report when: any identity theft
- Free, online or by phone
- About 20 minutes
The Federal Trade Commission’s report is the anchor for everything that follows. It is official proof that someone stole your identity, and it gives you rights under federal law, such as the seven-year fraud alert in the next stop and getting fraudulent debts blocked from your credit report.
-
Go to IdentityTheft.gov or call 1-877-438-4338. Answer the questions with as much detail as you have; the site turns them into your Identity Theft Report and a step-by-step recovery plan.
-
With a free account, IdentityTheft.gov updates your plan, tracks your progress and pre-fills the letters you send to companies. Without one, download or print the report and plan before you leave the page.
-
Most people never need this. If a creditor or agency asks, take your FTC report, a photo ID and proof of address to your local police, and ask for a copy of their report. If no one asks, mark this one as not applying.
Stop 3 Everyone
Freeze your credit at Equifax, Experian and TransUnion
- Report when: any identity theft, or a breach
- Free by federal law
- About 10 minutes per bureau
A credit freeze stops lenders from pulling your credit report, which blocks most new accounts in your name. Unlike a fraud alert, a freeze does not travel between bureaus: you have to place it at each of the three. Requested online or by phone, it must be in place within one business day, and lifting it for a loan application takes effect within an hour.
-
Not frozen yet
-
Not frozen yet
-
Not frozen yet
Each bureau gives you a PIN or an online account to lift the freeze later. Keep it with your recovery notes.
-
One request covers all three: the bureau you contact must tell the other two. With your FTC Identity Theft Report, you qualify for an extended alert that lasts seven years and makes lenders verify it is really you. It works alongside a freeze.
-
Get free reports from all three at AnnualCreditReport.com, the official site. Dispute every account and inquiry you don’t recognize with the bureau that shows it, attaching your FTC report; IdentityTheft.gov can pre-fill the letters.
Credit freeze
- Blocks
- Most new credit, until you lift it
- Where
- Each bureau, separately
- Lasts
- Until you remove it
- Cost
- Free
Fraud alert
- Blocks
- Nothing; lenders must verify you first
- Where
- One bureau tells the other two
- Lasts
- 1 year, or 7 years for victims
- Cost
- Free
Stop 4 If it applies
Tell the IRS if it touches your taxes
- Report when: a return was filed in your name, an IRS letter about one, or someone worked under your SSN
- Free
Thieves file a fake return early to collect a refund. You usually find out when your own e-filed return is rejected, or when the IRS mails you a letter asking you to confirm your identity. The IRS starts contact by mail, not by email, text or social media.
-
If the IRS flagged a suspicious return, it holds that return until it hears from you. A notice about wages you never earned can mean someone worked under your number. Follow the letter’s instructions, using the phone number or website printed in it.
-
It fits when your e-filed return was rejected because a return with your SSN is already on file (check first that your own return has no typo in the number), when someone used your SSN or ITIN to work, or when the IRS asks you to file it. If your return was rejected, attach the form to a paper return and mail it as the instructions say; otherwise follow the form’s own filing instructions.
-
A free six-digit PIN that only you and the IRS know, required on any federal return filed with your SSN or ITIN. Anyone who can verify their identity can get one at IRS.gov/IPPIN, and a new PIN comes each year. Worth doing even if your taxes were never touched.
Stop 5 If it applies
Check your Social Security record
- Report when: someone works or claims benefits on your SSN
- Free
Social Security can’t repair your credit, and the FTC report covers general identity theft. What Social Security guards is your earnings record, which sets your future benefits, and the benefits themselves.
-
Create or sign in to your account at ssa.gov/myaccount. Claiming it yourself also stops a thief from opening one in your name. Earnings you never earned mean someone may be working under your number; call Social Security at 1-800-772-1213 to correct them, and see the IRS stop, since that income can also show up on your tax record.
-
If someone is working under your number or claiming benefits with it, report it at oig.ssa.gov/report or the fraud hotline, 1-800-269-0271. The Inspector General never calls you from that number, so treat any such call as a scam.
-
If your Social Security information is compromised, you can ask Social Security (1-800-772-1213) to block online and automated phone access to your record. It blocks you too, until you ask to lift it, so most people only need this when a thief keeps trying.
Stop 6 If it applies
File with the FBI’s IC3 if it started online
- Report when: phishing, a fake site, a hacked account, or money sent to a scammer
- Free
- About 30 minutes
The Internet Crime Complaint Center (IC3) is the FBI’s front door for crimes that happen over the internet. Your complaint goes into a database that agents and police use to connect cases, which is how scam rings get caught.
-
Speed matters most here: ask the fraud team to stop or recall the transfer. Then file with IC3.
-
The emails, texts, websites, profile names and phone numbers used; the date, amount and method of every payment; account numbers and the receiving bank or crypto wallet address. Keep the originals.
-
Use ic3.gov and nowhere else. The form asks you not to enter your Social Security number or date of birth. Save the confirmation for your records.
Watch for recovery scams. After a loss, fake “FBI agents” and “fund recovery” firms call promising to get your money back for a fee. IC3 does not recover money for you, and no real agency charges to.
After the reports: keep a recovery file
Recovery takes weeks, sometimes months, and the person who wins a dispute is usually the one with the paper trail. Keep one folder, on paper or on your computer, with:
- Your FTC Identity Theft Report and recovery plan
- A call log: date, company, who you spoke to, what they promised
- Copies of every letter you send and receive, and how you sent it
- Freeze PINs or logins for each bureau
- Reference numbers from the IRS, Social Security and IC3
Someone used your health insurance? Medical identity theft has its own clean-up: ask each doctor, hospital and insurer involved for your records, and correct errors in writing so another person’s care doesn’t follow you. The FTC explains how in What to Know About Medical Identity Theft.
Then check your credit reports again in a few months, and keep the freezes in place. A frozen account still leaves bills to pay while disputes run, which is where an emergency fund earns its keep. For the habits that keep this from happening again, read How to Protect Yourself From Identity Theft.
Common questions
Who do I report identity theft to first?
After you have called the companies where the fraud happened, report it to the Federal Trade Commission at IdentityTheft.gov or 1-877-438-4338. The FTC gives you an Identity Theft Report and a recovery plan, and that report is what the credit bureaus and many businesses ask for next.
Do I need a police report for identity theft?
Usually not. The FTC Identity Theft Report is enough for most steps. If a creditor or agency asks for a police report, take a copy of your FTC report, a photo ID and proof of address to your local police and ask for a copy of their report.
Do I need to report identity theft to the IRS?
Only if it touches your taxes. File Form 14039 if your e-filed return is rejected because a return with your Social Security number is already on file, if someone used your SSN to work, or if the IRS tells you to. If you get an IRS letter, follow its instructions. Anyone with an SSN or ITIN can get a free Identity Protection PIN.
Should I tell the Social Security Administration?
Social Security cannot fix your credit, but check your earnings record in a my Social Security account. Earnings you did not earn mean someone may be working under your number. Report misuse involving Social Security benefits or work to the SSA Inspector General at oig.ssa.gov or 1-800-269-0271.
What happens after I file with IC3?
The FBI's Internet Crime Complaint Center reviews complaints and shares them with law enforcement. You may not hear back, and IC3 does not recover money for you. Nobody from IC3 or the FBI will ask you for a fee to get your money back.
Does a credit freeze stop all identity theft?
No. A freeze blocks most new credit accounts in your name, but not misuse of accounts you already have, tax refund fraud or medical identity theft. That is why the IRS, Social Security and your own account logins are separate steps.
Related guides
Sources
- IdentityTheft.gov - Recovery Steps, Federal Trade Commission
- Credit Bureau Contacts, Federal Trade Commission
- Credit Freezes and Fraud Alerts, Federal Trade Commission
- When to file an Identity Theft Affidavit, Internal Revenue Service
- Get an identity protection PIN, Internal Revenue Service
- Identity Theft and Your Social Security Number, Social Security Administration
- Report Fraud, Social Security Office of the Inspector General
- Frequently Asked Questions, FBI Internet Crime Complaint Center
This guide is for informational and educational purposes only. It is not financial, medical, legal, or tax advice. Consult a qualified professional for guidance specific to your situation.
See how protected you are in the Security assessment →
Find the gaps in your accounts with the Digital Security Checkup →