Identity theft can happen to anyone, and California residents face unique challenges when their data is exposed. The first hours and days after discovering fraud are critical-taking the right steps immediately can limit damage and speed up recovery.
We at Bontrager Law have helped countless Californians navigate identity theft reporting and reclaim their financial security. This guide walks you through exactly what to do, your legal rights, and how to prevent it from happening again.
What to Do in the First 24 Hours
The clock starts ticking the moment you discover identity theft. Within the first day, contact your bank and credit card companies to report fraudulent transactions and request card cancellations. Call the fraud department directly-don’t use the number on your card, which could be compromised. Ask them to flag your account, freeze new transactions, and send replacement cards. If your debit card was stolen, liability caps at $50 if you report within two business days, according to the Electronic Funds Transfer Act. Beyond that window, you could lose significantly more. Many banks now offer zero-liability policies, but you must report promptly to qualify. While on the phone, ask each institution for the name and direct contact of the person handling your case, plus a reference number for your records.
Contact the Credit Bureaus Immediately
Next, call Experian at 1-888-397-3742, Equifax at 1-800-525-6285, and TransUnion at 1-800-680-7289 to place a 90-day fraud alert on all three reports. A fraud alert tells creditors to verify your identity before opening new accounts in your name. The bureaus will send you free copies of your credit reports during this period-review them carefully for unfamiliar accounts or inquiries. This is not optional; it’s your first line of defense against additional fraud. After placing the alert, expect mail from each bureau with instructions on obtaining your reports. California law also allows you to request up to 12 free monthly credit reports within 12 months after filing a police report, giving you extended visibility into your credit activity.
File Your Police Report and FTC Complaint
File a police report with your local department and keep a copy-this document becomes essential proof when disputing fraudulent accounts. You’ll need it to request free credit reports and to support disputes with creditors. After the police report, file a complaint with the Federal Trade Commission at identitytheft.gov. The FTC received over 1.1 million identity theft reports in 2022, and their database feeds information to law enforcement agencies nationwide. Complete the FTC Identity Theft Affidavit on their website and save it; you’ll send copies to creditors and credit bureaus as you dispute fraudulent accounts.
These three actions-bank notification, fraud alerts, and official reporting-create a documented trail that protects you and accelerates dispute resolution with creditors. With your foundation in place, you’re ready to understand the legal protections California offers and how to challenge fraudulent accounts on your credit reports.
California’s Identity Theft Laws and Your Recovery Path
How California Protects Identity Theft Victims
California Penal Code 530.5 makes identity theft a crime, which means you have both criminal and civil remedies available. The law covers using someone else’s personal information to obtain credit, goods, services, or medical treatment without permission. This framework is stronger than many states’ approaches because California recognizes identity theft as a standalone offense with serious penalties for perpetrators. When you file a police report, you initiate a criminal complaint that can lead to prosecution. The California Department of Justice maintains an Identity Theft Registry specifically for victims, and law enforcement references this when investigating cases.
What matters most for your recovery is that this legal foundation gives you leverage when disputing fraudulent accounts. Creditors and credit bureaus take police reports seriously because they know California treats identity theft as a serious crime. When you send your police report and the FTC Identity Theft Affidavit to creditors, they understand you have legal backing, not just a complaint.
Disputing Fraudulent Accounts on Your Credit Reports
Send dispute letters directly to each credit bureau using certified mail, and include copies of your police report and FTC Identity Theft Affidavit. The bureaus have 30 days to investigate and respond. For accounts opened fraudulently in your name, contact the creditors directly and ask them to close the accounts and report them to bureaus as closed at your request. Many creditors have dedicated fraud departments that move faster than standard customer service lines.
California Civil Code 1798.93 protects you when debt collectors contact you about fraudulent debts. State clearly that you are a victim of identity theft and dispute the debt’s validity. If a collector ignores this, they have violated state law and you have grounds for a complaint.
Pursuing Civil Claims Against Responsible Parties
You can pursue damages if a company’s negligence or breach of contract led to your identity theft. This applies to data breaches, unauthorized access, or failure to secure your information. You must prove the company failed in its duty to protect your data and that this failure directly caused your losses. Documentation and evidence that creditors and courts take seriously will strengthen your case. With your legal rights clarified and your dispute strategy in place, the next step focuses on protecting yourself from future identity theft through credit monitoring, freezes, and strong account security practices.
Securing Your Credit and Accounts After Identity Theft
Credit monitoring after identity theft works best when you check your reports every 30 days for the first year, then quarterly afterward. California’s law allows you 12 free monthly credit reports within 12 months after filing a police report-pull one report from each bureau every four months rather than all three at once, giving you continuous coverage throughout the year. When reviewing each report, look for accounts you don’t recognize, inquiries from creditors you never contacted, and payment histories that don’t match your actual accounts. Promotional inquiries are normal and don’t indicate fraud, but unfamiliar hard inquiries or new accounts demand immediate action. Contact the bureau in writing with certified mail to dispute any fraudulent items, attaching copies of your police report and FTC Identity Theft Affidavit. The bureau has 30 days to investigate and remove verified fraudulent entries from your credit file.
Credit Freezes Provide the Strongest Defense
A security freeze is far more effective than a fraud alert because it prevents creditors from accessing your credit report entirely without your explicit permission. California law allows you to freeze your credit for free, which blocks criminals from opening new accounts in your name even if they have your Social Security number. Place the freeze with all three bureaus-Experian, Equifax, and TransUnion-using their fraud hotlines or online portals. When you need to apply for legitimate credit, you temporarily lift the freeze for specific lenders, then replace it. This approach eliminates the risk that a thief opens accounts while you monitor for fraud.
Proven defense strategies emphasize security freezes as the gold standard for identity theft victims because they work passively without constant monitoring for breach attempts.
Passwords and Two-Factor Authentication Stop Account Takeovers
Change every password associated with financial accounts, email, and any service storing payment methods within 48 hours of discovering identity theft. Try passwords with at least 10 characters combining uppercase letters, lowercase letters, numbers, and symbols-avoid dictionary words or personal information like birthdates or family names. A password manager like Bitwarden or 1Password eliminates the temptation to reuse passwords across accounts, which remains one of the fastest ways criminals expand their access after stealing one credential. Enable two-factor authentication on every account that offers it, particularly email and banking platforms. Text message verification works better than nothing, but authentication apps like Google Authenticator or Authy are significantly more secure because they resist interception through SIM swaps. If a thief gains access to an account despite your password change, two-factor authentication stops them from changing your password or transferring funds.
Final Thoughts
Identity theft reporting in California demands immediate action, but your recovery extends far beyond filing a police report and placing fraud alerts. Check your credit reports every four months using California’s 12 free monthly reports, monitor your bank and credit card statements weekly, and maintain your passwords and two-factor authentication indefinitely. Most victims discover fraudulent activity within the first three months, though some uncover new fraud years later-staying vigilant prevents criminals from reopening accounts or targeting you again.
You should consider legal representation if creditors refuse to remove fraudulent accounts from your credit reports, if debt collectors pursue you for debts you didn’t create, or if a data breach caused your identity theft and you want to pursue damages against the responsible company. California law gives you the right to sue for actual damages, and many companies settle rather than face litigation. Contact Bontrager Law for a free case review to understand your options without obligation.
Your credit will recover, fraudulent accounts will be removed, and your financial security will return as you work through identity theft reporting in California. The effort you invest now in monitoring and protecting your accounts pays dividends for years to come.