How to report identity theft: where to file and what each agency does

Over a million Americans filed identity theft reports last year.¹ If you just discovered fraudulent accounts, a drained bank balance, or a tax return you didn’t file, there’s a clear path forward. The first step is getting it on record. This guide explains where to report, what each agency actually does with your report, and the information to have ready, so you reach the right office the first time instead of bouncing between hotlines.

Start with the FTC at IdentityTheft.gov

The Federal Trade Commission (FTC) runs the federal government's central reporting hub for identity theft. Filing there produces two things: an FTC Identity Theft Report and a personalized recovery plan with pre-filled dispute letters you can send to businesses and credit bureaus.²

The report matters because of the rights it carries. It serves as an official statement that your identity was misused, and it gives you the right to have fraudulent accounts blocked from your credit file, typically within four business days of your request.² Filing takes roughly 15 to 20 minutes, and creating an account lets you track progress and update the plan as your case develops.

The FTC enters each report into Consumer Sentinel, a secure database that civil and criminal law enforcement agencies use to investigate patterns and pursue cases.³ You can file online at IdentityTheft.gov or by phone at 1-877-438-4338. Have your full legal name, address, Social Security number, date of birth, and details of the suspected fraud ready before you begin.

Report cyber-enabled crime to the FBI's IC3

When identity theft involves the internet, a second report belongs with the FBI. The Internet Crime Complaint Center accepts complaints about online fraud, account takeovers, phishing, and related schemes at IC3.gov, and it is the right channel when a thief reaches you through a digital attack.

The scale explains why this office exists. The FBI's Internet Crime Complaint Center logged 1,008,597 complaints in 2025, with reported losses of $20.9 billion, a 26% increase over the prior year and an average reported loss of $20,699 per incident.⁴ Personal data breaches ranked among the most reported categories in that data.

Understanding how identity theft happens helps you describe the method accurately, which makes any complaint more useful to investigators.

Notify the credit bureaus

Reporting to the three credit bureaus protects your file while your case proceeds. You have two tools, and they work together.

A fraud alert is free and tells creditors to verify your identity before opening new credit. You only need to contact one bureau, because that bureau must notify the other two.³ A credit freeze is stronger: it blocks access to your report so new accounts cannot be opened until you lift it, and you place it separately with Experian, Equifax, and TransUnion.

Pull your free reports from all three bureaus at AnnualCreditReport.com and flag every entry you do not recognize. With an FTC Identity Theft Report in hand, the bureaus must block fraudulent information that resulted from the theft. These flagged items become the basis for the disputes you file with each business.

Report tax identity theft to the IRS

Tax-related identity theft has its own reporting path, and the trigger is specific. If someone uses your Social Security number to file a fraudulent return, you typically learn of it when your own e-filed return is rejected as a duplicate or when the IRS sends a notice.

In most cases, if the IRS contacts you first with a verification letter such as a 5071C, you simply follow that letter's instructions and do not file an affidavit.⁵ When you discover the fraud yourself and the IRS has no record of it, file IRS Form 14039, the Identity Theft Affidavit, online or with a paper return. The IRS routes confirmed cases to its Identity Theft Victim Assistance organization and enrolls victims in the Identity Protection PIN program, which issues a six-digit code that blocks future fraudulent filings under your number.⁵

Contact the Social Security Administration

If your Social Security number is the target, the Social Security Administration is a separate point of contact. Report suspected misuse of your number, and review your Social Security earnings record for income you did not earn, which can signal employment-related identity theft.

The agency can help you address errors tied to your record and advise on whether a replacement card is warranted. Pair this with a review of your wage and benefit statements, since a mismatch between reported and actual earnings is often the first visible sign that someone is working under your number. Reviewing OmniWatch's overview of what identity theft is clarifies how a single stolen identifier can branch into tax, employment, and credit fraud at once.

File a police report when it helps

A police report is not required in every case, but it strengthens specific situations. File one if you know the identity of the thief, if a particular creditor or bank requests it, or if the theft involves a large or complex loss.

Bring your FTC Identity Theft Report, a government-issued ID, proof of your address, and any evidence of the fraud, such as collection notices or statements showing charges you did not make. Ask for a copy of the police report or its number and keep it with your records, since it can help clear fraudulent information from your accounts.³ For most people, the FTC report does the work a police report once did, and the two together form a strong paper trail.

Where free identity theft victim support fits in

Reporting can feel overwhelming when several agencies are involved at once. Free, confidential help is available from the Identity Theft Resource Center, a nonprofit that guides victims through the process at no cost. Its advisors can help you prioritize which reports to file first and in what order.

Identity protection services add a different kind of support. A service such as OmniWatch combines monitoring that surfaces exposure early with 24/7 restoration specialists who handle much of the reporting legwork, including placing fraud alerts and freezes, contacting creditors, and preparing documentation. Members who suspect active misuse can reach OmniWatch identity restoration specialists 24 hours a day at (877) 892-8249, rather than waiting for business hours. Comprehensive identity theft protection also typically pairs reporting help with insurance that offsets recovery costs.

Coverage has widened in step with the threat. OmniWatch now covers crime categories that represented 94% of the cybercrime complaints filed with the FBI in 2025, including scam and ransomware losses that many traditional policies exclude.⁶ No one is required to use a paid service to report identity theft, but expert help can shorten a process that spans multiple agencies.

Which agency to report to, at a glance

Use this quick reference to match the type of fraud to the right office, then follow the detailed sections above.

• Any identity theft: FTC at IdentityTheft.gov or 1-877-438-4338.

• Online or cyber-enabled fraud: FBI Internet Crime Complaint Center at IC3.gov.

• New accounts or credit fraud: the three credit bureaus, plus AnnualCreditReport.com.

• Tax fraud or a rejected return: the IRS, using Form 14039 when applicable.

• Misuse of your Social Security number: the Social Security Administration.

• A known suspect or a creditor requests your local police department.

---

This guide is published by OmniWatch. Follow OmniWatch on Facebook for ongoing guidance on identity protection, digital safety, and scam awareness.

Sources

1. Federal Trade Commission, Consumer Sentinel Network: The Big View — All Sentinel Reports, 2025.

2. Federal Trade Commission, IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan, 2026.

3. Federal Trade Commission, Identity Theft: A Recovery Plan, 2026.

4. Federal Bureau of Investigation, Internet Crime Complaint Center (IC3) 2025 Internet Crime Report, April 2026.

5. Internal Revenue Service, Identity Theft Central, 2026.

6. Associated Press, OmniWatch Now Covers 94% of FBI-Tracked Cybercrime, April 2026.