How to Fill Out the FTC Identity Theft Affidavit (w/Examples) + FAQs

You fill out the FTC Identity Theft Affidavit by reporting the fraud at IdentityTheft.gov, answering the guided questions about your stolen identity, listing every fraudulent account, and signing the report under penalty of perjury. The completed document is called your Identity Theft Report, and it is the single most powerful tool you have to force banks, credit bureaus, and debt collectors to remove fraudulent charges from your name.

Identity theft drained more than $12.5 billion from American consumers in 2024, according to the FTC Consumer Sentinel Network Data Book. Filing the affidavit correctly is the difference between a clean recovery and years of credit damage.

🛡️ How to create a legally binding FTC Identity Theft Report on IdentityTheft.gov
📝 Line-by-line walkthrough of the affidavit with real-world fill-in examples
⚖️ Your rights under the Fair Credit Reporting Act and FACTA Section 605B
🚨 The 7 most damaging mistakes victims make and how to avoid them
💼 When to escalate with IRS Form 14039, a police report, or an identity theft attorney

What the FTC Identity Theft Affidavit Actually Is

The FTC Identity Theft Affidavit is a sworn statement that tells creditors, credit bureaus, and law enforcement that someone used your personal information without permission. The modern version lives at IdentityTheft.gov, a free federal site run by the Federal Trade Commission. When you finish the online questionnaire, the system generates a personalized PDF called your Identity Theft Report.

The report carries the weight of a federal affidavit because you sign it under 18 U.S.C. § 1001, which makes lying on a federal form a felony punishable by up to five years in prison. That penalty exists to give creditors confidence the report is truthful, so they accept it as proof of fraud. The consequence of skipping the affidavit is that banks treat the disputed charges as ordinary billing complaints, which they can reject without explanation.

A common misconception is that the old paper FTC Identity Theft Affidavit Form is the same thing as the new online report. The paper form still exists for people without internet access, but it does not carry the same automatic FCRA protections unless paired with a police report. Always prefer the online version when possible.

Why the Affidavit Has Legal Power

The affidavit gains its power from Section 605B of the Fair Credit Reporting Act, added by the Fair and Accurate Credit Transactions Act of 2003. This section forces credit bureaus to block fraudulent information within four business days of receiving a valid Identity Theft Report. The consequence of a creditor ignoring a valid report is statutory damages of up to $1,000 per violation under 15 U.S.C. § 1681n.

For example, when Maria Lopez of Phoenix discovered a $9,400 fraudulent auto loan in her name, she filed her affidavit through IdentityTheft.gov and sent it to the lender. The lender removed the loan in 11 days because Section 605B left no legal room to refuse. A common misconception is that creditors get to weigh the evidence; under FCRA, a valid report shifts the burden of proof to the business.

Who Should File One

Any U.S. consumer who suspects misuse of their Social Security number, credit card, bank account, medical insurance, or tax identity should file. Parents file on behalf of minors under the Child Identity Theft rules from the CFPB. Executors file for deceased relatives whose identities are stolen, a fast-growing crime called “ghosting.”

The consequence of not filing is that you lose access to the free FCRA tools, including the seven-year fraud alert, the credit bureau block, and the right to demand fraudulent application records from creditors under 15 U.S.C. § 1681g(e). A common misconception is that calling your bank is enough; banks only correct their own accounts, not the credit bureaus or other lenders.

Step-by-Step: Filling Out the Affidavit at IdentityTheft.gov

The online system at IdentityTheft.gov walks you through a branching questionnaire. The whole process takes about 20 to 40 minutes if you have your documents ready. You move faster if you gather your driver’s license, Social Security card, recent credit reports from AnnualCreditReport.com, and any fraudulent bills before you begin.

Each screen asks short questions and uses your answers to build the right affidavit for your situation. The site never asks for your Social Security number until you confirm you want a full personalized recovery plan. Skipping any required field means the system will refuse to generate your Identity Theft Report, so answer every question even if the answer is “I don’t know.”

Step 1: Choose Your Identity Theft Type

The first screen asks what kind of theft happened. The seven main categories are tax, medical, credit card, loan or lease, government benefits, utilities, and “something else.” You can select more than one, and you should, because each category triggers different recovery letters.

The consequence of picking the wrong category is that the system generates the wrong follow-up letters, which delays your case by weeks. For example, James Whitaker of Atlanta initially picked only “credit card” when his stolen SSN had also been used to open a phone account; the utility letter was missing, and Verizon refused to remove the $1,200 bill until he refiled. A common misconception is that you must know who the thief is; the affidavit works even when the perpetrator is unknown.

Step 2: Confirm Your Personal Information

The site asks for your full legal name, date of birth, current address, previous addresses for the past two years, phone number, and email. This data appears verbatim on the final affidavit, so a typo here means creditors may reject your report for not matching their files. Use the spelling that appears on your Social Security card, not nicknames.

If your address changed because of the theft, list both. The consequence of listing only the new address is that creditors searching their records may not find your account. A common misconception is that minor differences, such as “Street” versus “St.,” do not matter; under FCRA matching rules, even small mismatches can trigger an “unable to verify” denial under 12 CFR § 1022.82.

Step 3: List Every Fraudulent Account

You enter every account, charge, or application you did not authorize. For each one, you provide the business name, the account number (or last four digits), the approximate date opened, the dollar amount, and whether the account is open or closed. Add a short narrative of how you learned about it.

The consequence of leaving an account off the affidavit is that you cannot use the report to dispute that specific debt later; you would have to file a supplemental affidavit. For example, Aisha Patel of Newark forgot to list a $340 medical bill from a clinic she never visited; six months later it appeared on her credit report and she had to start the medical identity theft process from scratch with the HHS Office for Civil Rights. A common misconception is that you only need to list large debts; even small charges damage your credit score and trigger collection activity.

Step 4: Describe How the Theft Happened

The narrative section is a free-text box where you describe, in your own words, when you discovered the theft and any evidence you have. Keep it factual, chronological, and under 500 words. Do not guess or speculate about the thief’s identity unless you have proof.

The consequence of an inaccurate narrative is perjury exposure under 18 U.S.C. § 1001. For example, Robert Chen of San Francisco wrote that his ex-roommate “definitely” stole his identity, but he could not prove it; the roommate sued for defamation and the case settled for $14,000. A common misconception is that the narrative must be dramatic; calm, factual writing is more credible to fraud investigators.

Step 5: Sign and Submit

You electronically sign by typing your name and clicking submit. The site generates a PDF Identity Theft Report with a unique reference number you should save in three places: cloud storage, a printed copy, and a USB drive. You also receive a personalized recovery plan with pre-written letters to creditors and the three credit bureaus.

The consequence of losing your reference number is that you must re-create the affidavit, which can flag your account for duplicate fraud reports. A common misconception is that submitting the affidavit ends the process; it actually starts a 90- to 180-day recovery sequence that includes calling each creditor, freezing your credit, and following up on disputes.

Three Common Scenarios With Examples

Identity theft rarely fits one neat category. The three scenarios below show how the affidavit applies to the most common fact patterns the FTC reports in its Consumer Sentinel data.

Scenario 1: Credit Card Fraud Discovered on a Statement

Victim Action	Legal Consequence
Calls issuer within 60 days under Fair Credit Billing Act	Liability capped at $50, often waived
Files FTC affidavit and lists the account	Issuer must investigate within 30 days
Sends affidavit to all three credit bureaus	Bureaus block reporting within four business days under FCRA 605B
Places seven-year extended fraud alert	New creditors must verify identity by phone
Reviews credit report 90 days later	Confirms removal or escalates to CFPB complaint

Scenario 2: Tax Refund Stolen by Imposter Filer

Victim Action	Legal Consequence
Files IRS Form 14039 along with FTC affidavit	IRS opens Identity Protection Specialized Unit case
Requests IP PIN from the IRS	Future returns rejected without the six-digit PIN
Files paper return with affidavit attached	Refund delayed 120 to 180 days but eventually paid
Reports state tax theft to state revenue department	Triggers parallel state investigation
Monitors SSA earnings statement	Confirms no fraudulent W-2s posted to the record

Scenario 3: New Auto Loan Opened in Victim’s Name

Victim Action	Legal Consequence
Files FTC affidavit listing lender and VIN	Lender must provide application documents under 15 U.S.C. § 1681g(e)
Sends affidavit plus police report to lender	Lender must cease collection during investigation
Disputes loan with all three credit bureaus	Loan blocked from credit file within four business days
Files DMV fraud report if vehicle was registered	Title transferred back or voided
Sues lender for FCRA violations if it refuses to remove	Statutory damages up to $1,000 plus attorney fees

Real-World Examples From Named Victims

The affidavit works the same way whether the loss is $50 or $50,000. The three named examples below illustrate the most common recovery paths.

Linda Garcia, a 67-year-old retiree in Tampa, learned her identity was stolen when Medicare denied a routine checkup because her benefits had been billed at a clinic in Miami she had never visited. She filed her affidavit at IdentityTheft.gov, checked the “medical” category, listed the clinic, and sent copies to her insurer and the HHS OIG hotline. Within 60 days her record was corrected.

Marcus Johnson, a 22-year-old college junior in Columbus, found three credit cards he never opened on his Experian credit report. He filed the affidavit, placed a free credit freeze with all three bureaus through Equifax, Experian, and TransUnion, and the fraudulent accounts were removed in 21 days.

David Nguyen, a 41-year-old small-business owner in Houston, discovered a synthetic identity using his SSN paired with a stranger’s name had taken out $38,000 in business loans. He filed the FTC affidavit, a local police report, and a complaint with the Small Business Administration OIG. The loans were charged back to the lender and his credit score rebounded within six months.

Mistakes to Avoid When Filing

Mistakes on the affidavit cost victims time, money, and credit damage. The seven most damaging errors below come straight from FTC complaint data and consumer attorney case files.

Filing only with the bank, skipping the FTC, which leaves you without FCRA Section 605B protection and forces you to rely on the bank’s discretion.
Listing only some fraudulent accounts, which means future disputes on missed accounts require a brand-new affidavit and reset the clock.
Using nicknames or wrong spellings, which triggers “unable to verify” denials from creditors who must match exact records.
Speculating about who the thief is, which exposes you to defamation lawsuits and undermines your credibility with investigators.
Forgetting to print or save the reference number, which forces a duplicate filing that fraud-detection systems may flag as suspicious.
Failing to file a police report when required, which costs you the “Identity Theft Report” status under 16 CFR § 603.3 for debts over $25,000 or when creditors demand one.
Missing the 60-day Fair Credit Billing Act window, which can leave you stuck with charges your card issuer would otherwise have erased.

Federal Laws That Back the Affidavit

The affidavit’s power comes from a stack of federal statutes that work together. Knowing them helps you push back when a creditor delays or denies your dispute. Each law below carries direct consequences for businesses that violate it.

The Fair Credit Reporting Act governs how credit bureaus must handle disputes and blocks. A violation exposes the bureau to actual damages, statutory damages up to $1,000, and attorney fees. A common misconception is that the FCRA only covers credit reports; it also covers tenant screening, employment background checks, and insurance underwriting reports.

The Identity Theft Enforcement and Restitution Act of 2008 lets federal prosecutors charge thieves and order restitution to victims, including for lost time spent on recovery. The Identity Theft and Assumption Deterrence Act of 1998 was the first federal law to make identity theft a stand-alone federal crime under 18 U.S.C. § 1028. A common misconception is that you must wait for criminal charges before filing your civil affidavit; the two tracks run in parallel.

State Law Nuances

Every state has its own identity theft statute, and many give victims stronger rights than federal law. California Penal Code § 530.5 makes identity theft a “wobbler,” chargeable as misdemeanor or felony, and gives victims the right to a court-issued factual innocence order. The consequence for thieves in California is up to three years in prison and full restitution.

New York General Business Law § 380-s requires credit bureaus to provide free fraud alerts and security freezes within strict deadlines. Texas Business and Commerce Code Chapter 521 gives the Texas Attorney General authority to sue businesses that mishandle victim data, with civil penalties up to $50,000 per violation. A common misconception is that you must file in your home state; you can file in any state where the fraud occurred.

Key Court Rulings Every Victim Should Know

Two Supreme Court rulings shape modern identity theft litigation. The first, Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), held that FCRA plaintiffs must show a “concrete” injury, not just a technical violation. The consequence is that simple data errors without real harm may not be enough to sue.

The second, TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), narrowed standing further by requiring proof that the inaccurate information was actually disclosed to a third party. A common misconception is that these rulings gutted the FCRA; in practice, victims who file a proper affidavit and document specific harms, such as a denied loan or higher interest rate, still recover statutory damages. Galaria v. Nationwide Mutual Insurance, 663 F. App’x 384 (6th Cir. 2016), confirmed that the risk of future identity theft from a data breach can support standing when paired with a filed FTC affidavit.

The Affidavit Process in 10 Steps

The full recovery sequence stretches well beyond filing the affidavit. The 10 steps below come from the FTC’s official recovery plan and apply to almost every case.

Place a free initial fraud alert with one bureau using Equifax’s fraud alert page.
Pull free credit reports at AnnualCreditReport.com.
File the FTC affidavit at IdentityTheft.gov.
File a police report if losses exceed $25,000 or any creditor requests one, citing your jurisdiction’s local department.
Send the affidavit and police report to every fraudulent creditor by certified mail.
Dispute fraudulent items with all three credit bureaus, citing FCRA Section 605B in the letter.
Request fraudulent application records from creditors within 30 days under 15 U.S.C. § 1681g(e).
Place a free credit freeze at all three bureaus.
File IRS Form 14039 if tax fraud is involved and request an IP PIN.
Follow up at 30, 60, and 90 days; escalate unresolved items to the CFPB complaint portal or a NACA-member consumer attorney.

Do’s and Don’ts for Filing the Affidavit

Smart filing habits protect your case and shorten the recovery timeline. The lists below distill best practices from federal regulators and consumer attorneys.

Do file at IdentityTheft.gov rather than the legacy paper form, because the online version produces FCRA-compliant evidence automatically.
Do print and save three copies of the Identity Theft Report, because creditors lose paperwork and you may need it for years.
Do send certified mail with return receipt to every creditor, because mailing proof is decisive evidence in court.
Do request the underlying fraudulent application from each creditor, because the documents often reveal the thief’s contact information.
Do add a seven-year extended fraud alert, because it forces creditors to verify identity before opening any new account.

The “don’ts” below carry serious downsides if ignored.

Don’t lie on the affidavit, because doing so is a federal felony under 18 U.S.C. § 1001 with up to five years in prison.
Don’t pay any portion of a fraudulent debt, because partial payment can be treated as acknowledgment of the debt.
Don’t miss the 60-day Fair Credit Billing Act window, because liability protections shrink afterward.
Don’t ignore mail from collectors, because the Fair Debt Collection Practices Act gives you 30 days to demand validation.
Don’t post the affidavit publicly online, because it contains personal information that can fuel further fraud.

Pros and Cons of Filing the FTC Affidavit

Filing is almost always the right move, but the trade-offs below help you decide whether to add a police report and attorney to your strategy.

Pro: The affidavit is free at IdentityTheft.gov, saving the $400 to $1,500 a lawyer might charge for the same paperwork.
Pro: It triggers automatic FCRA Section 605B blocks, removing fraudulent items from your credit report within four business days.
Pro: It unlocks the right to free seven-year fraud alerts and free credit freezes at all three bureaus.
Pro: It creates a federal paper trail that supports later civil lawsuits and criminal restitution under 18 U.S.C. § 3663.
Pro: It gives you access to pre-written recovery letters tailored to each creditor and bureau.

The downsides below are manageable but worth knowing.

Con: Signing under penalty of perjury creates real legal risk if any information is wrong, even by accident.
Con: The affidavit alone does not stop collection calls until each collector receives a copy and validates the debt.
Con: Some creditors still demand a police report even when federal law does not require one, slowing the process.
Con: The IdentityTheft.gov system stores your data on federal servers, which some privacy-focused victims dislike.
Con: The affidavit cannot undo criminal charges filed against you in the thief’s crimes; that requires a separate factual innocence petition.

When to Hire an Identity Theft Attorney

Most victims handle the affidavit alone, but certain red flags justify hiring counsel. If a creditor refuses to remove fraudulent debt after receiving your affidavit, an FCRA lawsuit becomes the leverage you need. The National Association of Consumer Advocates maintains a free directory of FCRA attorneys who work on contingency.

The consequence of waiting too long is the two-year FCRA statute of limitations under 15 U.S.C. § 1681p, which starts when you discovered the violation. For example, Tanya Reed of Detroit waited 26 months after her bank ignored her affidavit; her claim was dismissed as time-barred. A common misconception is that attorneys are expensive; under FCRA’s fee-shifting rule, the defendant pays the lawyer’s fees if you win.

Synthetic Identity Theft Cases

Synthetic identity theft pairs a real SSN, often a child’s, with a fake name and birthdate. The Federal Reserve estimates synthetic fraud losses at $20 billion per year, making it the fastest-growing form of identity crime. The affidavit still works, but you must list every variation of your data the thief used.

The consequence of missing a variation is that the credit bureaus may merge the synthetic file with yours permanently. A common misconception is that synthetic fraud only hurts businesses; in reality, children’s credit can be ruined before they turn 18, which is why the CFPB recommends freezing minors’ credit at birth.

FAQs

Is the FTC Identity Theft Affidavit free?

Yes. Filing at IdentityTheft.gov costs nothing, and the FTC never charges for the affidavit, the recovery plan, or follow-up letters generated by the system.

Do I need a police report to file the affidavit?

No. A police report is not required to file, but it becomes mandatory if a creditor specifically requests one or if your losses exceed $25,000 under federal evidence standards.

Can I file the affidavit if I am not a U.S. citizen?

Yes. Any person whose identity was misused in the United States can file, including lawful permanent residents, visa holders, and undocumented workers whose SSNs or ITINs were stolen.

Does the affidavit stop debt collectors from calling me?

Yes. Once a collector receives your affidavit, the Fair Debt Collection Practices Act requires them to cease collection until they validate the debt is legitimately yours.

Can I file on behalf of my child?

Yes. Parents and legal guardians file using the child’s information, and the CFPB recommends pairing the affidavit with a free minor credit freeze at all three bureaus.

Is the affidavit the same as IRS Form 14039?

No. They are separate documents; you file the FTC affidavit for general identity theft and IRS Form 14039 specifically when someone uses your SSN to file a fraudulent tax return.

Can I edit the affidavit after submitting it?

Yes. You log back into IdentityTheft.gov with your account credentials and add newly discovered fraudulent accounts, which generates a supplemental affidavit linked to the original.

Does filing hurt my credit score?

No. Filing the affidavit and placing a fraud alert do not lower your credit score; only the underlying fraudulent accounts hurt your score, and the affidavit is the tool that removes them.

Can I sue if a creditor ignores my affidavit?

Yes. Under 15 U.S.C. § 1681n you can recover actual damages, statutory damages up to $1,000, punitive damages, and attorney fees from any creditor that willfully ignores a valid Identity Theft Report.

How long does the recovery process take?

No single answer fits every case, but most victims resolve fraudulent accounts within 90 to 180 days, while synthetic and tax-related identity theft can take 12 months or longer to fully clear.

Related reading