FTC Identity Theft Affidavit: How to File It

The affidavit is the piece that makes everything else work. Without it you are a person making a claim. With it you are a person who has sworn to facts under penalty of perjury, and federal law starts imposing deadlines on the companies you are dealing with.

It is also free, takes about 30 minutes, and most people fill it out badly enough that it slows their own case down.

What it is and where it comes from

The FTC provides the Identity Theft Affidavit through IdentityTheft.gov. You answer a series of questions about what happened and the site assembles the affidavit and your Identity Theft Report from your answers.

There is no charge. You do not need a lawyer. You do not need to have caught the thief.

That report is the document FCRA Section 605B requires before a credit bureau must block fraudulent accounts within 4 business days. It is the single most valuable piece of paper in a fraud recovery.

Before you open the form

Spend an hour gathering this. The form asks for specifics, and guessing is where people damage their own filings.

Pull all three credit reports. Equifax, Experian and TransUnion each hold separate files. Fraudulent accounts often appear on one or two, not all three. You cannot identify what you have not looked at.

Build a list. For each fraudulent item write down:

• Creditor name exactly as it appears on the report
• Account number as shown, usually partially masked
• Date the account was opened
• Balance or amount shown
• Which bureaus it appears on
• Any hard inquiry tied to it

Write your timeline. When did you first notice. What tipped you off. Any breach notice you received. Any calls you have already made, with dates and names.

Collect what you already have. Bank or card statements showing charges you did not make, collection letters, denial letters, breach notifications.

Filling it out, section by section

Your information

Use your legal name as it appears on your ID and your current address. If you have moved in the last two years, include the previous address too. Address history is how the bureaus match you to a file, and a mismatch is the most common reason a package is bounced as incomplete.

What happened

Write plainly and factually. Dates, amounts, and what you observed. Do not speculate about who did it or how unless you actually know.

A good entry reads like this:

On 14 August 2026 I received a collection notice from a company I have never done business with for an account I did not open. I checked all three credit reports on 15 August and found two accounts opened in June 2026 at addresses I have never lived at.

A weak entry reads like this:

Someone stole my identity and ruined my credit, probably from a data breach.

The first gives a bureau facts to act on. The second gives it a reason to ask questions.

The accounts

This is the section that decides whether your 605B package is complete. List every fraudulent item individually with the detail from your prepared list.

Do not write “all accounts opened after June 2026.” The statute requires you to identify the specific information, and vague identification means the 4 business day clock does not start.

The declaration

You sign under penalty of perjury. Read what you are signing.

You are stating that the accounts listed are not yours and that you did not receive goods, services, or money from them. If any part of that is not true for any item on your list, take that item off the list. One false entry can taint the whole filing.

The mistake that costs people their block

The FCRA lets a credit bureau decline or rescind a block where it was based on a material misrepresentation of the facts, or where you obtained goods, services, or money as a result of the transaction.

That is the trap. People with a mix of real debt and fraudulent debt sometimes include a real account “since I am filing anyway.” It is understandable and it is a serious mistake. It can void the block on the accounts that genuinely were fraud, and it is a false statement on a federal filing.

Keep the affidavit clean. Fraud only. If you also have real debt you cannot pay, that is a separate problem with separate solutions.

After you submit

IdentityTheft.gov produces two things: your Identity Theft Report and a personal recovery plan with the letters and next steps for your situation.

Download and save both immediately. Keep a PDF, and keep a paper copy. You will be sending copies repeatedly and you do not want to be regenerating this under pressure.

Then, in order:

1. Place a fraud alert. Call any one bureau, it must notify the other two. The initial alert lasts 1 year.
2. Consider a freeze, which is stronger because it blocks new accounts from being opened. See how to freeze your credit.
3. Decide on a police report. You do not need one for the bureaus, but you do need one for an extended 7 year fraud alert, and some companies insist. See how to file a police report for identity theft.
4. Send your 605B packages, one per bureau, certified with return receipt.

What each package must contain

A 605B block only starts when the bureau has all four required items. Your affidavit covers two of them. Send:

1. Proof of identity: copy of photo ID plus proof of address
2. A copy of your Identity Theft Report
3. Your itemized list of the fraudulent information
4. Your signed statement that the information is not yours

Send copies, keep originals. Certified with return receipt, because the receipt establishes the date of receipt, and the date of receipt is what the 4 business day deadline runs from.

Notarization

The FTC affidavit is signed under penalty of perjury and is not generally required to be notarized for the credit bureaus.

Individual companies sometimes demand notarization as internal policy. That is their prerogative and arguing about it wastes time you do not have. A notary at most banks or shipping stores costs a few dollars. Get it notarized and remove the excuse.

If a company rejects your affidavit

Ask, in writing, for the specific reason. Most rejections are one of:

• Incomplete identity proof. Usually an address that does not match their records. Send proof for both addresses.
• Accounts not specifically identified. Send the itemized list again with full detail per account.
• They want their own form. Some creditors have an internal fraud affidavit. Fill theirs out too. It costs an hour and removes the argument.
• No reason given. That is when you escalate. See how to file a CFPB complaint against a credit bureau.

Keep every rejection letter. A pattern of unexplained rejections after a complete filing is exactly the evidence an FCRA attorney wants to see.

The short version

• The affidavit is free at IdentityTheft.gov and takes about 30 minutes
• Pull all three reports first so you can identify accounts specifically
• Vague identification means the 4 business day clock never starts
• You sign under penalty of perjury, so list fraud only, never real debt
• Save the Identity Theft Report as a PDF, you will send it many times
• Send packages certified with return receipt, because the receipt sets the deadline

Credit Booster AI pulls all three of your reports in one place and flags the accounts that do not match your history, so the list you put on the affidavit is complete before you sign it.