Identity theft recovery file: FTC report, credit reports and dispute records

Build one incident chronology before sending multiple disputes

Record when the problem was first discovered, how it was discovered, every affected account or transaction, and every later contact with an institution. Separate facts that can be proved from conclusions. A statement showing a transaction on a particular date is evidence; an assumption about who caused it is not. Use stable exhibit numbers so a later dispute can cite the same source without renaming it.

Preserve original statements, screenshots, emails, breach notices, account alerts, and credit-report pages before adding highlights or comments. Keep a read-only original and a separate working copy. If a web page or account screen may change, save a dated capture. The chronology should explain later discoveries rather than silently rewriting what was known at the start.

Use IdentityTheft.gov as the federal recovery starting point

The Federal Trade Commission’s IdentityTheft.gov service allows a victim to report identity theft and obtain an FTC Identity Theft Report and a personalized recovery plan. Save the report and plan immediately. IdentityTheft.gov states that a person who does not create an account should print or save the materials before leaving because they may not be available later.

Treat the FTC report as a central record, not as a substitute for account-specific evidence. A bank, credit bureau, government agency, or merchant may use its own process. Record the FTC report date and confirmation information, then link each institution-specific dispute to the relevant facts and exhibits from the master chronology.

Compare all three credit reports as separate records

IdentityTheft.gov directs victims to obtain and review reports from Equifax, Experian, and TransUnion. Create a comparison table rather than treating the three reports as one document. For each unfamiliar account or inaccurate identity field, note the bureau, partial account number, creditor or furnisher, date opened, balance, payment history, address, and the exact item disputed.

Save the date of each report. After a correction, obtain or preserve the later version and compare the exact field that changed. One bureau may correct an item while another leaves it. Link each requested correction to supporting evidence such as the FTC report, a creditor fraud acknowledgment, proof of address, account records, or a police report when one exists.

Create one worksheet for each affected account or transaction

A separate worksheet should identify the institution, partial account number, disputed amount, first known fraudulent activity, current account status, contact history, and recipient-specific remedy requested. Do not send a generic demand for every possible remedy to every institution. A card issuer, creditor, and credit bureau have different functions and may need different evidence.

Keep a communication log under the worksheet. Record date, channel, representative or case number, what was reported, what response was given, and any promised deadline. After a significant call, write a factual note while the conversation is fresh. A later escalation should be able to show exactly where the process stopped.

Preserve submission proof and exact attachment sets

A draft letter does not prove a dispute was submitted. Save the final PDF, portal text, or secure message, together with every attachment and proof of transmission. For a portal, keep the confirmation screen or email. For mail, preserve tracking or other delivery evidence. For a secure inbox, keep the sent-message record and case identifier.

Send only documents relevant to the issue. Identity-theft files contain highly sensitive material. Keep the unredacted original privately and a copy of the redacted version actually transmitted. Never add passwords, authentication codes, or unrelated full account credentials to an evidence package simply because they are available.

Track responses as decisions, not as vague correspondence

Classify each response precisely: corrected, blocked, verified, denied, pending, more information required, partially corrected, or unclear. If only one field is corrected, keep the remaining fields open. Store the response next to the submission that caused it and update the master chronology with the response date and case number.

Before sending a second dispute, identify what is new: additional evidence, a contradictory response, a later report showing the error remains, a missed promised action, or a newly discovered fraudulent item. Repeating the same letter without identifying the unresolved issue can make a large file harder to review.

Protect the recovery file from secondary fraud

Identity-theft victims can become targets for follow-up scams. Verify telephone numbers, portal addresses, and email domains independently before sending sensitive information. Do not disclose a one-time security code because a caller already knows details of the fraud. Use official channels and record suspicious contacts as separate events.

Maintain a sanitized working index with partial account numbers and case references, while keeping identity documents in more restricted storage. If another person assists, share only the material necessary for that task and document any authority needed to act. The recovery file should reduce risk rather than become another exposed repository.

Identity-theft recovery workbook

Use this workbook as a final traceability check. An item should not be marked complete merely because a draft exists; completion means the supporting record can be located.

1. First discovery date — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
2. Initial suspicious transaction — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
3. Additional fraudulent transactions — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
4. Affected credit card — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
5. Affected bank account — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
6. Fraudulent loan account — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
7. Fraudulent utility or service account — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
8. Unknown address on credit report — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
9. Unknown employer on credit report — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
10. Unknown telephone number — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
11. FTC Identity Theft Report — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
12. FTC recovery plan — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
13. Equifax report date — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
14. Experian report date — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
15. TransUnion report date — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
16. Equifax disputed item list — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
17. Experian disputed item list — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
18. TransUnion disputed item list — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
19. Creditor fraud case number — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
20. Bank fraud case number — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
21. Merchant dispute case — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
22. Police report if filed — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
23. Police report number — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
24. Proof of identity used — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
25. Proof of address used — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
26. Original breach notice — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
27. Credit monitoring enrollment — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
28. Freeze confirmations — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
29. Fraud alert confirmation — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
30. Postal submission tracking — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
31. Portal confirmation — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
32. Secure-message confirmation — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
33. Exact attachment set — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
34. Redacted transmitted copy — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
35. Unredacted original — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
36. Representative call note — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
37. Promised response date — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
38. Actual response date — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
39. Partial correction — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
40. Denied correction — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
41. Verification response — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
42. More-information request — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
43. Later credit report — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
44. Unresolved account list — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
45. Current status page — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
46. Second-dispute basis — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
47. Escalation evidence — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
48. Suspicious follow-up contact — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
49. Credential-security check — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.
50. Professional review trigger — Review this point against the underlying record. Record the source, date, reference number or other evidence that supports the entry, and state the next action if the point remains unresolved.

A complete workbook does not guarantee that an institution will agree with a dispute. It shows what was reported, what evidence supports it, and what remains unresolved.

Official sources

The official materials below are the primary sources used for this guide. Agency instructions can change, so verify the current official process when taking action.

• IdentityTheft.gov
• IdentityTheft.gov Recovery Steps
• FTC Credit Freezes and Fraud Alerts

Final control

Before sending a report, appeal, request, dispute, or supporting document, compare the final version with the source records. Check names, identifiers, dates, attachments, deadlines, and the exact action requested. Preserve the exact submitted version and proof of delivery. This guide is general information and record-organization support, not individual legal advice.