Identity Theft & Fraud Recovery in California
Plain-language legal information · Citations checked against primary sources · Sources linked below
Legal information, not legal advice. This is general legal information, not legal advice, and does not create an attorney–client relationship. Laws vary by state and change over time. For advice about your specific situation, consult a licensed attorney.
Start at IdentityTheft.gov — the federal front door
IdentityTheft.gov (in Spanish, RobodeIdentidad.gov) is the U.S. government's official identity-theft recovery site, run by the Federal Trade Commission under the Identity Theft and Assumption Deterrence Act. Answering its questions generates three things — an FTC Identity Theft Report, a personalized recovery plan (an interactive checklist), and pre-filled dispute letters — usually in about 15–20 minutes. If you create an account the plan saves and tracks progress; if you don't, print or save the documents before leaving the page, because they cannot be retrieved afterward.
The FTC report's legal weight comes from one hard fact: knowingly filing a false one is a federal crime. Combined with a police report, it forms an 'Identity Theft Report' as defined in the Fair Credit Reporting Act, which unlocks stronger rights — the § 605B block, an extended fraud alert, and specific duties on the companies that reported the fraudulent accounts. The FTC does not investigate or resolve individual cases; the report is your sworn declaration to a federal agency.
The identity-theft block: a 4-business-day right (FCRA § 605B)
Federal law gives victims a fast, powerful tool most never use. Once a credit bureau receives four things — proof of your identity, a copy of an identity theft report, your identification of the specific fraudulent information, and a statement that it is not related to any transaction you made — it must block that information from your credit report not later than 4 business days. The bureau must also promptly notify the company that furnished the information that it may be identity theft and that a block was requested.
A block is not guaranteed forever: a bureau may decline or rescind it if it decides the information was blocked in error, the request contained a material misrepresentation, or the consumer obtained goods, services, or money from the transaction — and it must notify you if so. Otherwise a block stays in place until removed. This is different from an ordinary dispute; it is a faster, identity-theft-specific right. Citation: 15 U.S.C. § 1681c-2.
Get the fraud account's records (FCRA § 609(e))
This is the single most underused victim right. A business that opened a fraudulent account or transacted with the imposter must, not later than 30 days after a proper request, provide — free of charge and without a subpoena — copies of the application and transaction records tied to the fraud. Those records (the fraudulent application, a wrong shipping address, a forged signature) are the documentary proof that turns 'that wasn't me' into a provable dispute.
The business may require proof of your identity and proof of the identity-theft claim (such as the FTC Identity Theft Affidavit). Federal enforcement is escalating: in FTC v. Amazon (June 2026) the company agreed to a $2.25 million civil penalty — the largest ever under § 609(e) — for refusing to give victims these records, and the FTC has said 'security' or 'privacy' are not lawful grounds for refusal. Citation: 15 U.S.C. § 1681g(e).
Fraud alerts, security freezes, and the specialty-bureau blind spot
A fraud alert tells lenders to take extra steps to verify identity before opening credit: an initial alert now lasts 1 year (you contact one bureau; it notifies the other two), and an extended alert lasts 7 years and requires an identity theft report. A security freeze is stronger — it blocks new-account access entirely, and since September 2018 it has been free to place, lift, and remove at all three nationwide bureaus. Freezes for a protected consumer (a minor under 16, or an incapacitated adult) are also free but must be requested by mail with documentation.
The common blind spot: freezing only Equifax, Experian, and TransUnion leaves gaps, because banks, telecoms, utilities, and check-acceptance services pull from specialty consumer-reporting agencies. A complete freeze list generally also includes ChexSystems (bank-account screening), LexisNexis Risk Solutions, Innovis, NCTUE (telecom/utility), and Early Warning Services. A credit 'lock' is a contractual, app-based product with a similar effect but fewer statutory protections than a freeze. Citation: 15 U.S.C. § 1681c-1.
Two forks that decide everything: takeover vs. new account, debit vs. credit
Recovery splits on two questions. First: account takeover (an existing account of yours is hijacked) versus new-account fraud (accounts opened in your name). Takeover runs through the institution's fraud process and the relevant liability rules; new-account fraud runs through the § 605B block, § 609(e) records, furnisher duties, and fraud alerts/freezes.
Second, for takeover: debit versus credit — and this fork is decisive. Under Regulation E, debit/EFT liability is tiered — up to $50 if the consumer reports within 2 business days of learning of the loss, up to $500 if later but within 60 days of the statement, and unlimited for unauthorized transfers on a statement not reported within 60 days. Under the Fair Credit Billing Act, credit-card liability for unauthorized use is capped at $50 (most issuers make it $0), and a billing-error dispute must be sent in writing within 60 days. The lesson: on a debit account the 60-day clock is a hard line — miss it and the loss can be unlimited. Citations: 12 C.F.R. § 1005.6 (Reg E); 15 U.S.C. § 1666 (FCBA).
Specialized variants each have their own route
Different kinds of identity theft need different machinery. Tax: the route generally involves filing IRS Form 14039 (Identity Theft Affidavit) and getting an Identity Protection PIN (IP PIN), now available to any taxpayer who can verify identity. Medical: the HIPAA right of access (45 C.F.R. § 164.524) and right to amend (§ 164.526) are used to correct records — this is the one variant with a patient-safety dimension, because a contaminated record (wrong blood type, allergies, medications) can cause real harm, so correction is urgent, not merely financial. Child: check whether a minor has a credit file and place a free protected-consumer freeze by mail.
Criminal identity theft: when an imposter is arrested or cited under your name, the general route involves obtaining the arrest/court records, filing a police report, and pursuing your state's record-correction or factual-innocence process — an outstanding warrant in your name can lead to a wrongful arrest, so this variant often needs a lawyer. Unemployment/benefits fraud: report to the state that issued the claim (the U.S. Department of Labor keeps a directory at dol.gov/agencies/eta/UIIDtheft), and the IRS instructs victims to report only benefits actually received and to request a corrected $0 Form 1099-G. Synthetic identity (a real Social Security number, often a child's, paired with a fabricated name) is the fastest-growing variant, and remediation is piecemeal. Elder financial exploitation routes to Adult Protective Services and the National Elder Fraud Hotline (833-372-8311).
Organizing your recovery: the evidence packet
Identity-theft recovery generates a lot of paper, and keeping it organized is what makes each step work. Core documents to keep: your FTC Identity Theft Report, any police report, IRS Form 14039 (tax cases), your § 605B block and § 609(e) records-request letters, letters to furnishers and collectors, credit-report snapshots at each stage (free weekly at AnnualCreditReport.com), certified-mail and return receipts (they prove your timing on the deadlines that matter), and a call log with dates, names, and reference numbers.
Different recipients need different bundles: police generally want your ID, proof of address, the FTC report, and a list of the fraudulent accounts; a creditor or furnisher wants the § 609(e) request plus the FTC report and affidavit; an attorney wants the full chronology, all dated correspondence, certified-mail proof, and credit reports showing the error persisting after a dispute — that persistence is the trigger for a Fair Credit Reporting Act claim. Street Legal AI helps you organize these records; it does not file them for you.
Myths and scams to avoid
A few dangerous myths surround identity theft. The most serious: no one — including any 'credit repair' service — should file a false identity-theft report to remove a legitimate debt. Filing a false report is a federal crime; the FTC charged exactly this conduct in FTC v. Turbo Solutions (2022). A real debt is not identity theft, and mislabeling it as fraud exposes a person to criminal liability.
Second, the 'new Social Security number' myth: the SSA rarely issues a new number, warns it is seldom a solution, and a new number orphans a person from their own credit, work, and benefits history — and the fraud often follows anyway. Third, identity-theft 'protection' services that overpromise: the FTC's $100 million LifeLock settlement (2015) targeted a company that falsely advertised bank-grade safeguards it did not maintain — the core protections (freezes, fraud alerts, IdentityTheft.gov) are free. Finally, recovery-scam re-victimization: fraudsters, sometimes posing as the FTC, target known victims a second time. The real FTC never demands money, gift cards, or cryptocurrency, and never texts anyone to 'verify' their identity with a photo ID.
When self-help isn't enough — and how the law can get you a lawyer at no upfront cost
Self-help genuinely fails in some situations, and that is when counsel is warranted: a bureau or furnisher refuses to correct after a proper dispute or block; a wrongful criminal record or warrant exists; a foreclosure or eviction arises from the fraud; large-dollar new-account fraud heads toward litigation; or benefits are denied. A critical, underused fact for anyone who cannot afford a lawyer: the Fair Credit Reporting Act shifts fees. Under § 1681n (willful violations) and § 1681o (negligent violations), a consumer who wins can recover actual or statutory damages plus costs and attorney's fees.
In practice this means many consumers can obtain a plaintiff's-side FCRA attorney on contingency at no upfront cost — and a well-organized packet (the dispute, proof the error persisted afterward, and certified-mail proof) is exactly what such an attorney needs, because the statute pays their fees. The window to sue is generally 2 years from discovery of the violation or 5 years from the violation, whichever is earlier (§ 1681p), and each failure to correct can count as a separate violation.
Free help you can use today (Tier 0)
You never have to pay to recover from identity theft. IdentityTheft.gov gives you the FTC recovery plan, report, and pre-filled letters — free, online, for anyone. The Identity Theft Resource Center (ITRC) offers free live victim advisors and case plans at 888-400-5530. The FTC consumer line is 1-877-FTC-HELP. The CFPB complaint portal (consumerfinance.gov/complaint) handles disputes with financial institutions and bureaus. The IRS Taxpayer Advocate Service and Low Income Taxpayer Clinics help with stalled tax cases.
For civil legal help if you are income-eligible, Legal Services Corporation grantees and legal aid (lsc.gov) are free. The National Elder Fraud Hotline (833-372-8311) serves older victims, and the FBI's IC3 (ic3.gov) takes reports of internet-facilitated fraud. Identity theft is stressful and disorienting — none of it is your fault, and these resources exist precisely because recovery is a process, not a single call.
California: the numbers that matter
Police must take your report
YES — even if the theft happened in another jurisdiction
California is the strongest self-help state: § 530.6 requires your local police or sheriff to take an identity-theft report, and § 530.6(b) lets a victim petition the court for a judicial determination of factual innocence. After you report the fraud, a debt generally cannot be sold (Civ. Code § 1785.16.2) and you can obtain a credit block (Civ. Code § 1785.16(k)). Breach-notice law is Civ. Code § 1798.82; unemployment fraud routes to EDD (edd.ca.gov).
Criminal identity-theft statute
Willfully obtaining and using another's personal identifying information
California's core identity-theft crime is Cal. Penal Code § 530.5 — willfully obtaining someone's personal identifying information and using it for an unlawful purpose without consent. It works together with the mandatory-police-report and factual-innocence provisions of § 530.6.
Sources
This guide references California's statutes and rules of court, plus public legal-aid resources. Specific statute figures for California are verified against primary sources, with the statute cite and check date shown on each figure. Always confirm current law with your state's official website or a licensed attorney.
Go deeper with the attorney-ready Identity Theft Recovery Guide pack.
See inside · Coming soon