The single most important document in this recovery process is not a credit card statement or a verbal complaint. It is the FTC Identity Theft Report, generated at IdentityTheft.gov. Almost nothing below works until your identity is stolen and that report actually exists. The FTC’s own recovery guide spells out what the report unlocks: blocking fraudulent items from credit reports, a seven-year extended fraud alert, a stop on debt collectors pursuing the fraudulent account, and copies of that account’s own business records. Every other step in this article assumes the victim already filed that report.
The First Document to File Once Your Identity Is Stolen
The legal definition of that report lives in Regulation V. 12 CFR § 1022.3(i)(1) defines an identity theft report as one that alleges identity theft “with as much specificity as the consumer can provide.” It must also be “a copy of an official, valid report filed… with a Federal, State, or local law enforcement agency.” Filing at IdentityTheft.gov satisfies that standard on its own in most cases. The site generates an FTC report that functions as this official record. It also walks a victim through a personalized recovery plan afterward. Skipping this step means none of the deadlines below ever start running.
Blocking Fraudulent Items From a Credit Report
The moment your identity is stolen, several federal deadlines start running at once. Blocking is the fastest of them. 15 USC § 1681c-2 requires a credit reporting agency to block fraudulent information “not later than 4 business days after the date of receipt” of four items:
- proof of identity
- a copy of the identity theft report
- identification of the fraudulent entries
- a signed statement that the items are not the consumer’s own transactions
Four business days is fast by consumer-protection standards. But the clock does not start on a phone call. It starts only when the complete packet arrives at the bureau. Sending all four items together, rather than trickling them in, controls how quickly the block actually happens.
Fraud Alerts vs. Security Freezes
A fraud alert and a security freeze sound interchangeable. They are not — one is a flag, the other is a lock. An initial fraud alert, under 15 USC § 1681c-1, now lasts “not less than 1 year.” That is up from the 90 days it ran before a 2018 federal law extended it. It simply tells a lender to verify identity before opening new credit.
An extended fraud alert works differently. It requires an identity theft report on file. But it lasts “the 7-year period beginning on the date of such request,” far longer than the initial version. A security freeze goes further still. Under 15 USC § 1681c-1(i), it prevents any new credit account from opening at all. It is also free nationwide.
The statute sets hard deadlines on both ends. A freeze must go into effect within one business day of a phone or electronic request, or three business days by mail. It must come off within one hour of a phone or electronic request, or three business days by mail. That contrast is deliberate. The law treats locking the door as urgent. It treats unlocking it as something a consumer should manage on demand.
The Paperwork You’re Entitled To Once Your Identity Is Stolen
Recovering also means finding out exactly what the thief opened. The law gives a victim a way to force that disclosure. 15 USC § 1681g(e) requires a business, on written request with proof of identity, to hand over copies of the fraudulent account’s application and transaction records. That disclosure must happen within 30 days, and it is free. It can go to the victim, or to a law enforcement agency the victim names. If the business wants a police report or affidavit first, it can ask. The disclosure itself still carries no fee.
This is the provision that turns a suspicion into an actual paper trail. Account numbers, the address the thief used, whatever purchases went through — all of it becomes visible. That trail is often exactly what a police report or an insurance claim needs to move forward. Separately, all three nationwide bureaus, Equifax, Experian and TransUnion, now permanently offer free weekly credit reports through AnnualCreditReport.com. The FTC confirmed that change as permanent in October 2023. A victim monitoring for new fraudulent accounts no longer has to ration how often they check.
The Criminal Exposure on the Other Side
The person who did this faces exposure well beyond a civil dispute over a credit card bill. 18 USC § 1028(a)(7) makes it a federal crime to knowingly use another person’s “means of identification… without lawful authority” in connection with an underlying federal or state felony. 18 USC § 1028A(a)(1) goes further. It adds a mandatory two-year term that stacks on top of the underlying sentence, rather than merging with it.
That second statute is narrower than its plain text suggests. In Dubin v. United States, decided in 2023, the Supreme Court held that aggravated identity theft applies only where the identity misuse is “at the crux of what makes the conduct criminal.” It does not apply where a defendant merely uses a real name incidentally. Overbilling for a service the defendant actually provided is one such case. The distinction matters for how prosecutors charge a case. It has no bearing on the civil recovery steps above. Those run on their own timeline, regardless of whether prosecutors ever bring charges.
The bottom line
The mechanics here are more generous than most victims assume: a four-business-day block, a lock that goes on within a day and comes off within an hour, seven years of extended monitoring, free business records, free weekly reports from all three bureaus. But every one of them depends on a single document a victim has to file first. Nobody generates that document automatically. The FTC Identity Theft Report is not paperwork for its own sake. It is the key that turns on every other deadline in this article. The honest gap: recovery is fast and well-defined once that report exists, and close to inert until it does. That puts the entire burden of starting the clock on someone who, by definition, did not see this coming.
Frequently asked questions
File an FTC Identity Theft Report at IdentityTheft.gov. Nearly every other recovery right described here depends on that report already existing.
It entitles a victim to block fraudulent items from credit reports, get a seven-year extended fraud alert, stop a debt collector from pursuing the fraudulent account, and obtain the account’s business records.
Within four business days of receiving proof of identity, a copy of the identity theft report, identification of the fraudulent items, and a statement that they are not the consumer’s own transactions.
A fraud alert simply tells lenders to verify identity before opening credit, while a security freeze prevents new credit from opening at all. One is a flag, the other is a lock.
At least one year, up from the 90 days it ran before a 2018 federal law extended the minimum term.
Seven years from the date requested, but it requires an identity theft report on file to qualify.
A freeze must go into effect within one business day of a phone or electronic request, three by mail, and it must come off within one hour of a phone or electronic request, three by mail.
Yes. On written request with proof of identity, a business must provide copies of the fraudulent account’s application and transaction records within 30 days at no charge.
No. The Supreme Court held in Dubin v. United States that the enhanced penalty applies only when the identity misuse is central to what makes the conduct criminal, not when a real name is used merely incidentally.
No. Equifax, Experian and TransUnion now permanently offer free weekly reports through AnnualCreditReport.com, a policy the FTC made permanent in October 2023.
Keep reading: What to do if a debt collector calls about a debt that isn’t yours · How to sue someone in small claims court
Ready to meet your legal match?
Right case, right lawyer, zero awkward first dates. Tell us what happened and we’ll introduce you to attorneys who actually fit.
Get MatchedThis article is general information about identity theft and consumer credit rights and is not legal advice. Laws differ by state and change over time, and the facts of your situation matter. For guidance on your own circumstances, consult a licensed attorney in your state.