How to Use the FTC Identity Theft Affidavit (and What Comes After)

When an elderly parent's identity is stolen — whether through a scam call, a data breach, or a phishing email — the recovery process can feel overwhelming. There are multiple agencies to notify, accounts to dispute, and documents to gather. The Federal Trade Commission's Identity Theft Affidavit is the official document that cuts through most of that complexity.

This guide explains what the affidavit is, how to complete it with your parent, what it legally does for them, and what concrete steps come next.

What Is the FTC Identity Theft Affidavit?

The FTC Identity Theft Affidavit is a standardized declaration that a victim of identity theft submits to creditors, banks, and the credit bureaus to dispute fraudulent accounts and charges. It was created to give victims a single, recognized document that financial institutions are required to honor under the Fair Credit Reporting Act (FCRA).

When you complete an identity theft report at IdentityTheft.gov (the FTC's dedicated recovery portal), the site generates this affidavit automatically — pre-filled with the details you enter — and pairs it with a customized recovery plan that tells you exactly which steps to take and in what order.

The affidavit is not a police report, though it can be used alongside one. It is a federal document that gives your parent specific legal rights, including the right to:

• Block fraudulent information from appearing on their credit reports
• Stop debt collectors from collecting debts that resulted from identity theft
• Obtain copies of business records related to fraudulent accounts opened in their name
• Dispute fraudulent charges with creditors without having to repeatedly re-explain the situation

When Does Your Parent Need One?

The affidavit is appropriate whenever a thief has used your parent's personal information to take a financial action in their name. Common situations include:

• A new credit card, loan, or bank account was opened using your parent's Social Security number
• Your parent received bills for services they never signed up for (medical, utility, telecom)
• A tax return was filed in your parent's name before they filed their own
• Their Medicare or Social Security number was compromised in a scam
• Existing accounts showed unauthorized charges after a scam call or phishing email

If the issue is only unauthorized charges on an existing credit card (not new accounts), your first call should be directly to the card issuer — that's a simpler dispute process under the Fair Credit Billing Act. But if new accounts were opened, or if you don't yet know the full scope of what was compromised, the FTC affidavit and IdentityTheft.gov process is the right starting point.

How to Complete the FTC Identity Theft Report at IdentityTheft.gov

Sit with your parent at a computer and navigate to IdentityTheft.gov. The site walks through the process step by step. Here is what you will need:

Personal information:

• Full legal name, date of birth, address, phone number
• Social Security number (you will enter this on a secure federal government site)
• Email address for receiving the recovery plan

Details about what happened:

• What type of identity theft occurred (new accounts, tax fraud, medical, etc.)
• When your parent discovered it
• Any details about how it happened (scam call, stolen mail, data breach notification)

The site will ask follow-up questions based on what you select. You do not need to know every detail — answer what you know. The report can be updated if more information surfaces later.

What you get at the end:

• A downloadable PDF of the Identity Theft Affidavit, pre-filled with your parent's information
• A personalized recovery checklist with specific steps ranked by priority
• Pre-written letters you can send to creditors and the credit bureaus
• Guidance on how to deal with each specific type of identity theft reported

Save and print the affidavit. You will need copies of it.

Step 1: Place a Credit Freeze at All Three Bureaus

A credit freeze — also called a security freeze — prevents anyone from opening new credit in your parent's name. It is free, reversible, and the single most effective action you can take after identity theft is discovered.

You must do this at all three major bureaus separately:

• Equifax: equifax.com/personal/credit-report-services/credit-freeze
• Experian: experian.com/help/credit-freeze
• TransUnion: transunion.com/credit-freeze

Each will ask you to create an account if your parent doesn't already have one. Save the login credentials somewhere secure — you will need them if you ever need to temporarily lift the freeze (for instance, if your parent applies for a new account or card).

If your parent also has accounts that check smaller bureaus, consider freezing at ChexSystems (chexsystems.com) and Innovis (innovis.com/personal/securityFreeze) as well.

Step 2: Place a Fraud Alert

A fraud alert is a separate, lighter-weight tool. It tells creditors to take extra steps to verify identity before opening new accounts. Unlike a freeze, it does not block access — it just requires extra verification.

You only need to place a fraud alert at one bureau. That bureau is required by law to notify the other two.

• An initial fraud alert lasts one year.
• An extended fraud alert (for confirmed identity theft victims with an FTC report) lasts seven years.

For most elder identity theft situations, placing both a credit freeze AND an extended fraud alert provides the strongest combination of protection.

Step 3: Dispute Fraudulent Accounts with the Credit Bureaus

Pull a free credit report from AnnualCreditReport.com and review it carefully. Look for:

• Accounts your parent did not open
• Inquiries from companies your parent did not contact
• Addresses or employers that are not theirs

For each fraudulent account, send a dispute to the relevant credit bureau. Include a copy of the FTC Identity Theft Affidavit with each dispute. Under the FCRA, the bureau is required to remove fraudulent information that is properly disputed with an affidavit.

The pre-written dispute letters on IdentityTheft.gov are formatted correctly for this purpose and reference the legal basis for your parent's rights.

Step 4: Contact Each Affected Creditor Directly

For each fraudulent account, also contact the creditor (the bank or company that issued the credit) directly. Send:

• A copy of the FTC Identity Theft Affidavit
• A letter stating the account was opened fraudulently
• A request for copies of all documents related to the account (application, statements)

Under federal law, creditors must provide these documents to identity theft victims. Seeing the fraudulent application can reveal what information the thief had — and whether additional steps (like notifying the Social Security Administration) are warranted.

Special Steps for Medicare and Social Security Identity Theft

If your parent gave their Medicare number or Social Security number to a scammer — or if you suspect these were used fraudulently — there are additional steps beyond the standard credit bureau process.

Medicare:

• Call 1-800-MEDICARE (1-800-633-4227) to report potential fraud
• Request a new Medicare number if the card number was compromised (Medicare now uses individual Medicare Beneficiary Identifier numbers instead of Social Security numbers, which reduces this risk)
• Review the Medicare Summary Notice for any services or equipment billed that your parent never received

Social Security:

• Report at ssa.gov/fraud or call 1-800-269-0271 (the SSA's Office of Inspector General hotline)
• If a fraudulent tax return was filed in your parent's name, report it to the IRS and apply for an IRS Identity Protection PIN (IP PIN) at irs.gov/identity-theft-central. This six-digit PIN must be entered on every future tax return to prove identity, making it impossible for someone else to file in your parent's name.

Step 5: Keep Records of Everything

Create a folder — physical or digital — that contains:

• The completed FTC Identity Theft Affidavit (PDF)
• All correspondence with credit bureaus and creditors
• Confirmation numbers for credit freezes
• Copies of dispute letters sent and any responses received
• A running log of calls (date, time, name of representative, what was said)

Identity theft recovery can take months. This documentation will be essential if any disputes are contested or if the case goes further.

What If Your Parent's Identity Was Stolen in a Scam?

If the identity theft was a direct result of a scam — your parent gave their information to someone posing as the IRS, Medicare, Social Security, or a financial institution — there is an additional layer of reporting.

File a report with the FTC at ReportFraud.ftc.gov (separate from the identity theft recovery at IdentityTheft.gov). You can also file with the FBI's Internet Crime Complaint Center at IC3.gov if the scam involved online communication.

These reports go into law enforcement databases and can help investigators link cases together — particularly important when the scam is part of a larger organized fraud operation, which is increasingly common in elder fraud.

The FTC's IdentityTheft.gov recovery plan is free and genuinely well-designed. But the process still requires someone to work through it systematically — gathering documents, contacting multiple agencies, following up on disputes. For families managing this on behalf of an elderly parent, the Elder Scam Shield guide provides a companion checklist that maps the full recovery process alongside the prevention steps that reduce the risk of a second incident.

Identity theft recovery is a sprint followed by a marathon. The affidavit gets you started. Knowing the full road ahead is what gets you to the end.