Identity Theft Incident and Recovery Log Template

Start the log as soon as identity theft is suspected.

Use the FTC’s official IdentityTheft.gov process to create a personalized recovery plan and Identity Theft Report.

FTC’s initial response sequence is:

1. Contact companies where fraud occurred.
2. Close or freeze affected accounts.
3. Place a fraud alert.
4. Obtain credit reports.
5. Report the identity theft.
6. Follow the individualized recovery plan.

Secure the log

Store the complete record in:

• Encrypted document vault
• Password-manager secure note
• Encrypted external drive
• Locked physical file

Do not place full:

• Social Security number
• Account number
• Password
• Recovery code
• Credit-freeze PIN

in an ordinary shared spreadsheet.

Use final four digits and record where protected credentials are stored.

Incident summary

Incident ID:
Date discovered:
First suspicious event:
Information exposed:
Known financial loss:
Accounts affected:
Police report needed:
FTC report created:
IdentityTheft.gov plan location:
Primary recovery email:
Log last updated:

Describe facts.

Example:

August 4: Credit-card issuer reported an application using my name and prior address. I did not submit it.

Avoid unsupported accusations about a specific person.

Fraudulent-account register

| Creditor or company | Account type | Last four | Opened | Balance | Status | Contact | |---|---|---|---|---:|---|---| | | | | | | | |

Record:

• Application date
• Address used
• Telephone used
• Email used
• Transaction list
• Reference number
• Whether the account was closed
• Whether collection activity began

Do not pay a fraudulent debt merely because a caller creates urgency.

Verify the company independently.

Existing-account fraud

| Account | Transaction date | Merchant | Amount | Reported | Temporary credit | Final result | |---|---|---|---:|---|---|---| | | | | | | | |

Contact the fraud department using the telephone number on the legitimate statement, card, or official website.

Ask:

• Is the account frozen?
• Will a new number be issued?
• Are recurring charges affected?
• Is an affidavit required?
• When will provisional credit appear?
• What is the written dispute deadline?

FTC Identity Theft Report

Record:

FTC report number:
Created:
Recovery plan downloaded:
Affidavit saved:
Sample letters saved:
Updated:

IdentityTheft.gov can generate a tailored recovery plan, track steps, and pre-fill letters and forms.

Preserve the report securely.

It may be needed to support disputes.

Credit freezes

Place a free credit freeze separately with:

• Equifax
• Experian
• TransUnion

FTC says a freeze restricts access to the credit file, making it harder to open new credit accounts, and is free to place and lift.

| Bureau | Freeze date | Confirmation | Protected PIN location | Lift needed | Reinstated | |---|---|---|---|---|---| | Equifax | | | | | | | Experian | | | | | | | TransUnion | | | | | |

A freeze at one bureau does not automatically freeze the other two.

Fraud alert

A one-year fraud alert can be placed by contacting one of the three national credit bureaus; that bureau must notify the other two.

A fraud alert tells a business to take additional identity-verification steps before issuing new credit.

Record:

Bureau contacted:
Date:
Expiration:
Renewal date:
Extended alert considered:

A fraud alert and credit freeze are different controls and can be used together.

Credit reports

Obtain reports through the authorized federal route.

For each disputed item, record:

| Bureau | Furnisher | Account | Dispute sent | Evidence | Result | Updated report | |---|---|---|---|---|---|---| | | | | | | | |

Save the report version that showed the fraudulent item.

Do not rely only on a credit score or monitoring alert.

Police report

A police report may be useful or required in cases involving:

• Stolen identification
• Known suspect
• Local theft
• Financial institution request
• Government-benefit fraud
• Repeated impersonation
• Physical break-in

Record:

Agency:
Report number:
Officer:
Date:
Documents supplied:
Follow-up:

Do not give original identity documents unless legally required.

Provide copies and keep an index.

Contact log

| Date and time | Organization | Person | Channel | Case number | Promise | Deadline | |---|---|---|---|---|---|---| | | | | | | | |

After significant calls, send a written confirmation:

This message confirms my understanding of our call today...

Ask the recipient to correct inaccuracies.

Account-security response

Track:

• Primary email password changed
• Other passwords changed
• Sessions revoked
• MFA reset
• Recovery email reviewed
• Recovery phone reviewed
• Unknown devices removed
• New recovery codes generated
• Mobile carrier PIN set
• Tax account reviewed
• Government benefit account reviewed

Use a known-clean device.

Do not change every password from the computer suspected of running credential-stealing malware.

Mail and address fraud

Record:

• Address changes
• Forwarding orders
• Missing statements
• Unknown utility accounts
• New telephone service
• Package rerouting
• DMV changes

Contact the relevant postal, utility, financial, or government agency through an independently verified route.

Document index

| Document | Date | Source | File name | Sent to | Delivery proof | |---|---|---|---|---|---| | FTC report | | | | | | | Police report | | | | | | | Credit report | | | | | | | Dispute letter | | | | | | | Account statement | | | | | |

Send copies, not irreplaceable originals.

Use tracked delivery when proof of receipt matters.

Resolution record

For every affected account, obtain written confirmation that:

• Account is closed or corrected
• Fraudulent balance is removed
• Collection activity ended
• Credit reporting is corrected
• Fees and interest are removed
• Liability decision is final

Keep the correspondence.

Do not close the incident log because one telephone representative said everything “looks fixed now.”

Bottom line

Use IdentityTheft.gov, freeze all three credit files, contact affected companies, preserve reports and evidence, and log every promise and deadline.

Identity theft recovery is partly a security problem and partly an administrative endurance event. The log prevents the administrative part from winning through sheer paperwork density.

Sources reviewed

• ^[1]
• ^[2]

Limits and cautions

• Testing not applicable

Sources reviewed

Source notes

1. https://www.identitytheft.gov/identitytheft.gov
2. https://consumer.ftc.gov/credit-freeze-or-fraud-alert-right-youconsumer.ftc.gov

See something wrong or out of date? Report a correction.