To report identity theft in California, contact your local police department to file a report under Penal Code 530.6, file an Identity Theft Affidavit at IdentityTheft.gov, and notify every bank, credit card issuer, and lender tied to the fraud. Then place a fraud alert or credit freeze with the three major credit bureaus. Do all of this quickly. Your financial liability for unauthorized debit card charges depends directly on how fast you report them.
Lock Down Your Accounts Before You Report
Change passwords on every online account that shared a password with a compromised one. Start with email and banking, since those are the keys to everything else. Turn on multi-factor authentication where it’s offered, preferably through an authenticator app or hardware key rather than text messages. Call your bank and credit card companies to flag suspicious activity so they can freeze or monitor the affected accounts immediately.
While you’re doing this, start a file. Save screenshots of fraudulent transactions, copies of suspicious emails or letters, the dates you noticed the theft, and any account numbers involved. You’ll hand copies of this documentation to police, creditors, and the credit bureaus.
File the FTC Affidavit at IdentityTheft.gov
Go to IdentityTheft.gov and walk through the intake questions. The system generates an FTC Identity Theft Affidavit based on your answers, which creditors and credit bureaus recognize as proof of your claim.1Federal Trade Commission. IdentityTheft.gov Recovery Checklist The site also builds a personalized recovery plan with step-by-step instructions and pre-filled letters you can send to businesses. Print your affidavit and keep multiple copies. Combined with a police report, it becomes what’s called an Identity Theft Report, which unlocks stronger legal rights when dealing with creditors and credit bureaus.
File a Police Report in California
California law gives you a right that many other states don’t guarantee this clearly. When you contact the local law enforcement agency where you live or work and tell them you’re a victim of identity theft, they must take a police report, give you a copy, and begin an investigation.2California Legislative Information. California Penal Code 530.6 If an officer tries to send you away because the crime happened online or sounds like a civil matter, point them to Penal Code 530.6. The statute is explicit. If the actual crime occurred in a different jurisdiction, your local agency can refer the case there after taking the initial report.
Bring your FTC Identity Theft Affidavit, a government-issued ID, proof of your address, and the evidence you’ve collected. Ask for a written copy of the report, or at minimum a report number. You’ll need it for creditors, the credit bureaus, and potentially the California Identity Theft Registry.3State of California – Department of Justice – Office of the Attorney General. Identity Theft Victim Checklist
Notify Banks, Card Issuers, and Creditors
Contact every bank, credit card company, and lender where fraudulent accounts were opened or unauthorized transactions occurred. Ask for the fraud department, not general customer service. Request that they close or freeze compromised accounts, reverse fraudulent charges, and issue new account numbers. Send a written follow-up with a copy of your Identity Theft Report, and keep records of every conversation including the representative’s name, date, and what they agreed to do.
When you write to creditors where the thief opened accounts in your name, request copies of the applications and transaction records tied to those fraudulent accounts.3State of California – Department of Justice – Office of the Attorney General. Identity Theft Victim Checklist That documentation helps the police investigation and strengthens your disputes. The California Attorney General’s victim checklist includes a sample letter for these requests.
Why Speed Matters: Your Liability Limits
Federal law caps what you owe for unauthorized transactions, but the limits differ sharply between credit cards and debit cards.
For credit cards, your maximum liability for unauthorized charges is $50.4Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers waive even that amount as a matter of policy.
Debit cards are a different story. Your liability depends entirely on how quickly you report the loss:
- Within 2 business days: your liability caps at $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.
- After 2 business days but within 60 days of your statement: liability can reach $500.
- After 60 days from the statement date: you face unlimited liability for any unauthorized transfers that occur after that 60-day window.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Consumer negligence, such as writing your PIN on your debit card, does not give the bank grounds to impose greater liability than these tiers allow.6Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers
Place Fraud Alerts or a Credit Freeze
An initial fraud alert tells creditors to take extra steps to verify your identity before opening new accounts in your name. Contact any one of the three major credit bureaus (Equifax, Experian, or TransUnion) and that bureau is legally required to notify the other two. An initial alert lasts one year. Once you have an Identity Theft Report (your FTC affidavit plus police report), you can request an extended fraud alert that stays on your file for seven years.7Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts
A credit freeze goes further. It blocks access to your credit report entirely, so no one can open new accounts in your name. You must contact each bureau individually to place a freeze.8Consumer Financial Protection Bureau. What Do I Do If I’ve Been a Victim of Identity Theft Freezes are free under federal law, and you can lift them temporarily when you need to apply for credit yourself.9Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes Parents can also freeze credit for children under 16 at no cost.
Report to the Right Agency for Your Type of Fraud
Tax-Related Identity Theft
If someone filed a federal tax return using your Social Security number, or you received an IRS notice about income you didn’t earn, file Form 14039 (Identity Theft Affidavit) with the IRS. The preferred method is online at irs.gov/dmaf/form/f14039. You can also fax it toll-free to 855-807-5720 or mail it to the IRS in Fresno, CA 93725.10Internal Revenue Service. IRS Form 14039 – Identity Theft Affidavit If you’re attaching it to a paper return you couldn’t e-file because your SSN was already used, send both together to the address where you normally file.
To prevent future fraudulent filings, request an Identity Protection PIN through your IRS Online Account. Anyone with an SSN or ITIN who can verify their identity is eligible. If you can’t verify online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can apply by mail using Form 15227. Otherwise, visit a Taxpayer Assistance Center in person with identity documents.11Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
Social Security Number Misuse
If your Social Security number is being used for purposes beyond tax fraud, such as opening accounts or obtaining benefits, report it to the Social Security Administration’s Office of the Inspector General through their online fraud reporting portal.12Social Security Administration Office of the Inspector General. Report Fraud
Unemployment Insurance Fraud
If you receive a 1099-G tax form, an EDD debit card, or other correspondence about unemployment benefits you never applied for, report it to California’s Employment Development Department online at edd.ca.gov/ReportFraud, by phone at 1-800-229-6297, or by fax at 1-866-340-5484.13U.S. Department of Labor. Report Unemployment Identity Fraud Report to the state agency even if you also file a federal complaint. For fraud dating from March 2020 onward, the Department of Justice’s National Center for Disaster Fraud handles federal-level reporting and notifies the Department of Labor’s Office of Inspector General.
Medical Identity Theft
When someone uses your information to get medical care, fill prescriptions, or file health insurance claims, the fallout goes beyond financial loss. Incorrect entries can end up in your medical records and affect your own treatment. If you spot unfamiliar charges on insurance statements or receive bills for services you didn’t receive, contact your health care provider first to rule out a billing error. If it isn’t a mistake, report it to your health insurance company’s fraud department. For Medicare fraud, call 1-800-MEDICARE or the HHS Office of Inspector General fraud hotline at 1-800-HHS-TIPS (1-800-447-8477).14Office of Inspector General (HHS-OIG). Medical Identity Theft
Under HIPAA, you have the right to request corrections to your medical records when fraudulent information has been added. Submit correction requests in writing via certified mail with return receipt. Providers have 30 days to respond, with one possible 30-day extension. If a provider refuses to correct the record, they must note your disagreement in the file. If they refuse to release your records at all, file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights.
California-Specific Rights for Victims
Free Monthly Credit Reports
Beyond the free annual credit report available to all consumers, California law gives identity theft victims who provide a valid police report to a credit reporting agency the right to one free copy of their credit report each month for up to 12 consecutive months.15California Legislative Information. California Civil Code 1785.15 That’s a strong monitoring tool during the first year of recovery, when new fraudulent activity is most likely to surface.
Judicial Determination of Factual Innocence
If someone committed a crime using your identity and you now carry a criminal record that isn’t yours, Penal Code 530.6 lets you petition a court for a determination of factual innocence. The court can review police reports, affidavits, and other evidence. If it finds no reasonable cause to believe you committed the offense, it will issue an order certifying your innocence.2California Legislative Information. California Penal Code 530.6
The California Identity Theft Registry
The California Department of Justice maintains the Identity Theft Registry for victims of criminal identity theft, meaning someone used your identity during a criminal arrest or citation. Once your information is verified and entered into the statewide database, law enforcement can check the registry to confirm you’re the victim rather than the suspect.16State of California – Department of Justice – Office of the Attorney General. How to Use the California Identity Theft Registry The registry only applies when your identity has been tied to a criminal record. It doesn’t cover financial identity theft on its own.17California Department of Justice. Criminal Identity Theft
Restitution If the Thief Is Convicted
If California prosecutors charge and convict the person who stole your identity, the court is required to order restitution covering your actual economic losses. That includes the costs to monitor and repair your credit, and reasonable attorney’s fees if you hired help to recover.18California Legislative Information. California Penal Code 530.5 Restitution orders are enforceable as civil judgments, so you can pursue collection even after the criminal case closes.