To report identity theft in Massachusetts, file a report with the Federal Trade Commission at IdentityTheft.gov, file a police report with your local department, call every bank and card issuer the thief touched, and place a security freeze and fraud alert with Equifax, Experian, and TransUnion. Do these the same day if you can. Federal law ties how much money you lose to how quickly you report, and Massachusetts law guarantees you a copy of your police report within 24 hours and a free credit freeze from every bureau.
File an FTC Identity Theft Report
Start at IdentityTheft.gov. The site asks what happened, then produces two documents: an FTC Identity Theft Report and a personalized recovery plan with pre-filled letters you can send to credit bureaus, businesses, and debt collectors.1Federal Trade Commission. Report Identity Theft
The FTC report is the key that unlocks the rest of your rights. With it, you can require credit bureaus to block fraudulent accounts from your report, force businesses to stop collecting debts the thief ran up, and get copies of the records the thief used to open accounts in your name.2Federal Trade Commission. Identity Theft – A Recovery Plan Save it somewhere you can find quickly, because almost every later step references it.
File a Police Report
Massachusetts law requires any law enforcement officer to take your identity theft report and give you a copy within 24 hours if you ask.3General Court of Massachusetts. Massachusetts General Laws Chapter 266 Section 37E They do not have discretion to refuse.
You can file in any county where you live, where the business that held your information is located, or where the breach happened. Bring your FTC Identity Theft Report, your ID, and whatever evidence you have of the fraud: unauthorized account statements, collection notices, letters from the IRS. The police report gives you a case number you will reuse constantly when you call creditors, bureaus, and government agencies.
Combining the FTC report with a police report also qualifies you for an extended fraud alert under the Fair Credit Reporting Act. That alert lasts seven years rather than the one-year standard initial alert.4Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts
Call Your Banks and Card Issuers Today
How much you lose depends on which type of card the thief used and how fast you pick up the phone.
For credit cards, federal law caps your liability for unauthorized charges at $50, and you owe nothing for charges made after you notify the issuer.5Office of the Law Revision Counsel. 15 USC 1643 Most major issuers waive the $50 as a matter of policy.
Debit cards are the dangerous category. Under the Electronic Fund Transfer Act, your liability depends entirely on when you report:6Office of the Law Revision Counsel. 15 USC 1693g
- Report within 2 business days and your maximum liability is $50.
- Report after 2 business days but within 60 days of receiving your statement and liability rises to $500.
- Report after 60 days and the bank has no obligation to reimburse anything the thief took after that window closed.
If you spot an unauthorized debit transaction, call your bank the same day. Ask them to close the compromised account, reissue cards, and open a new account with new numbers.
Freeze and Alert Your Credit
Pull your credit reports from all three bureaus through AnnualCreditReport.com. The bureaus now offer free weekly online reports.7AnnualCreditReport.com. About This Site Look for accounts you did not open, inquiries you did not authorize, and addresses or employers you do not recognize.
You have two tools, and you can use both.
A fraud alert tells lenders to verify your identity before issuing new credit. An initial alert lasts one year. With your FTC Identity Theft Report, you can request an extended alert that lasts seven years. You only need to contact one bureau; it must notify the other two.8Federal Trade Commission. Credit Freezes and Fraud Alerts
A credit freeze is stronger. It blocks access to your credit report entirely, so nobody can open new credit until you lift it. You must contact each bureau separately.
Massachusetts law reinforces the freeze. Bureaus must place a freeze within three business days of your request, confirm it in writing within five business days, and cannot charge you to place, lift, or remove it.9General Court of Massachusetts. Massachusetts General Laws Chapter 93 Section 62A State law also requires bureaus to notify you in writing before changing your name, date of birth, Social Security number, or address while a freeze is in place, which stops a thief from quietly rewriting your profile to pass future verification checks.
Block Fraudulent Entries, Then Dispute What Remains
Federal law gives you something stronger than a dispute. If you send a credit bureau your identity theft report, proof of identity, and a statement identifying the fraudulent items, the bureau must block that information from your report within four business days.10Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft Blocking removes the entries; disputing only marks them as contested.
For any remaining errors, file a dispute with each bureau that shows them. Bureaus must investigate and resolve disputes within 30 days of receiving your notice and then notify you of the results within five business days.11Office of the Law Revision Counsel. 15 USC 1681iHow Long Does It Take to Repair an Error on a Credit Report?
Report to the Federal Agencies the Thief Touched
Which agencies you call depends on what the thief did. You don’t need all of them, but you shouldn’t skip the ones that apply.
Social Security Number
If your SSN was compromised, the Social Security Administration directs you to report through IdentityTheft.gov rather than to the SSA directly.12Social Security Administration. Report Stolen Social Security Number If someone is using your number to collect benefits, report that separately to the SSA Office of the Inspector General.13Office of the Inspector General. Report Fraud
In extreme cases, after you have exhausted every other remedy and someone is still actively using your number, the SSA may issue a new one. You must show evidence of ongoing harm despite all other protective steps, and you cannot get a new number to escape bankruptcy, legal obligations, or bad credit. A new number also brings its own problems because your credit history does not carry over automatically.14Social Security Administration. Identity Theft and Your Social Security Number
Federal Taxes
If someone filed a federal return in your name, submit IRS Form 14039 (Identity Theft Affidavit) with a paper tax return.15Internal Revenue Service. How IRS ID Theft Victim Assistance Works One exception: if the IRS already contacted you through its Taxpayer Protection Program about a suspicious return, do not file Form 14039. Follow the instructions in the IRS letter instead.16Internal Revenue Service. Form 14039 – Identity Theft Affidavit
Stolen Mail
When the theft involved checks, statements, or tax documents taken from your mailbox, report it to the U.S. Postal Inspection Service at mailtheft.uspis.gov or 1-877-876-2455.17United States Postal Inspection Service. Report
Stolen Passport
Report a lost or stolen passport using Form DS-64 at travel.state.gov or by calling 1-877-487-2778.18U.S. Department of State. Statement Regarding a Lost or Stolen US Passport Book and/or Card (DS-64) Once reported, the passport is electronically cancelled. If the passport was already expired, you do not need to file this form.
Unemployment Benefits
If someone filed for unemployment in your name, report it to the U.S. Department of Justice’s National Center for Disaster Fraud, which will notify the Department of Labor’s Office of Inspector General. You also have to report to the state unemployment agency separately; the federal report does not substitute.19U.S. Department of Labor. Report Unemployment Identity Fraud
If a 1099-G arrived for benefits you never collected, the state should issue a corrected form and update your IRS records. File your taxes on time using only the income you actually received. Don’t wait for the corrected 1099-G or the investigation to finish, and don’t report the phantom income.19U.S. Department of Labor. Report Unemployment Identity Fraud
Contact Massachusetts State Agencies
Attorney General’s Consumer Advocacy and Response Division
The Massachusetts Attorney General’s CARD unit is the state-level resource for identity theft victims. CARD does not typically investigate individual cases but can walk you through your rights and options. Call the Consumer Hotline at (617) 727-8400, or file a consumer complaint through the AG’s website.20Mass.gov. Report Identity Theft
Department of Revenue
If someone filed a fraudulent Massachusetts return in your name, call the DOR at (617) 887-6350. The DOR also runs a Fraud Protection Program you can opt into by calling (617) 887-6367 or messaging through MassTaxConnect. Once enrolled, any time a return is filed under your SSN, DOR mails you a PIN and requires online identity verification before releasing a refund.21Mass.gov. Tax Scams and Fraud Enrollment carries forward each year until you opt out, so sign up even after the current problem is resolved.
If Your Medical Records Were Used
Medical identity theft is its own problem. If someone received care under your name, your health records may now carry someone else’s diagnoses, allergies, blood type, or medications. The billing mess matters; the clinical mess can be dangerous.
Under HIPAA, you have the right to ask healthcare providers to amend your medical records. Providers must respond, though they can deny the request in limited circumstances, such as when they believe the existing record is accurate. They are not required to delete information, but they must append your correction so the file reflects the truth. If the provider agrees the entry is wrong, they may remove it entirely if their retention policies allow.
Contact every provider and insurer the thief used. Request an accounting of disclosures to see who has accessed your records. Review explanation of benefits statements from your health insurer for services you did not receive. Report the fraud to the insurer’s fraud department and to each provider who treated the thief, and ask them to flag the fraudulent entries in their systems.