Identity Theft Investigation: Steps, Evidence and When to Hire a PI

Posted on by

An identity theft investigation has two tracks that run side by side. The first is yours and it is urgent: report the theft, freeze the damage and keep records. The second is finding out who did it, and that is where police, and sometimes a private investigator, come in. Do the first track today. Decide on the second once you know what was taken and how.

This guide is written mainly for US readers, with notes where rules differ in Australia, Canada and elsewhere. We are a private investigation firm, so we also explain what an investigator can add, and where the official agencies are the right door to knock on first.

Pi melbourne
Build a Clearer Evidence Trail
Pi Melbourne provides professional surveillance and expert evidence collection for clients investigating concerns such as fraud and other difficult situations.

Visit Pi Melbourne

TL;DR

  • Report identity theft at IdentityTheft.gov, place a fraud alert and pull your credit reports before anything else.
  • Keep a written log of every call, letter and deadline. Good records are the raw material of any later investigation.
  • Police and federal agencies hold the legal power to prosecute. A private investigator builds the evidence trail: who, where, how and what else is exposed.
  • Business owners with a suspected insider or breach should involve law enforcement before notifying anyone, and bring in an investigator early to preserve evidence.
  • Cross-border cases are possible to investigate, but they need an investigator who works internationally.

Table of Contents

What counts as identity theft, and how you find out

Identity theft happens when someone uses your personal or financial information without permission. USAGov lists the usual targets: names and addresses, Social Security numbers, bank account numbers and medical insurance account numbers.

The same page names the warning signs that most victims notice first:

  • Bills for items you did not buy.
  • Debt collection calls about accounts you never opened.
  • Unfamiliar accounts or transactions on your credit report.
  • Loan denials you cannot explain.
  • Mail that goes missing or stops arriving.

The Office of the Comptroller of the Currency adds two more: an IRS notice that someone filed a tax return in your name, and missing bills or statements that may point to a change of address. A stopped bill matters because thieves often redirect mail so you do not see what they have opened.

One point worth knowing before you rely on a monitoring service. The FTC notes that monitoring can flag things like change-of-address requests or new utility and wireless accounts, but some misuse, such as a tax return, Medicare or unemployment benefits fraud, may not trigger an alert. Checking those records yourself still matters.

First 24 hours: limit the damage

Speed counts. The FTC’s recovery guide tells victims to act quickly and sets out the core sequence. Here it is in working order.

  1. Place a fraud alert. IdentityTheft.gov says you can place a free one-year fraud alert by contacting one of the three credit bureaus, and that bureau must tell the other two. Businesses then have to verify your identity before issuing new credit in your name. You can renew it after a year.
  2. Order your credit reports and mark every account, inquiry or debt you do not recognize. The Missouri Attorney General’s checklist lists exactly these: accounts you did not open, debts you did not know about, and inquiries from companies you do not know.
  3. Call the fraud departments of affected banks, card issuers and lenders, including mortgage and student loan companies, and ask for replacement cards. New Jersey Consumer Affairs gives this advice in its identity theft brochure.
  4. Report to the FTC and the police. The FTC guide describes an Identity Theft Report, built from an FTC complaint plus a police report.

That last document is more useful than it sounds. According to the same FTC guide, an Identity Theft Report can be used to remove fraudulent information from your credit report, stop a company collecting debts that came from the theft, place an extended fraud alert, and get information from companies about the accounts the thief opened or misused. That last item is the first real investigative lead many victims get.

If you are in Australia, the Australian Cyber Security Centre gives the same logic: change passwords, check accounts for transactions you do not recognize, and contact your bank at once so it can block or investigate suspicious activity. Canadian readers should read the government’s guidance on SIN fraud, which lists police, the Canadian Anti-Fraud Centre, credit bureaus and creditors as the places to report.

How to investigate identity theft yourself, and keep your evidence clean

Most searches for how to investigate identity theft come down to one skill: documentation. You are not trying to play detective. You are building a file that police, banks and, if you hire one, an investigator can act on.

IdentityTheft.gov advises you to note unfamiliar accounts and transactions from your credit reports, write down who you contacted and when, and keep copies of every letter you send. State consumer agencies go further. New Jersey recommends:

  • a log of every phone call with date, time and the name of the person you spoke with;
  • copies, never originals, of all paper and electronic correspondence;
  • a record of time and money you spend sorting it out;
  • a note of every deadline;
  • certified mail with return receipt requested for important letters.

A practical file looks like this:

Item What to keep Why it matters
Credit reports Dated copies, with unknown entries highlighted Shows what was opened and when
Account statements Statements with the fraudulent charges marked Shows where money moved
Call log Date, time, name, reference number Proves you reported promptly
Letters Copies plus certified-mail receipts Proves what each company was told
Emails and texts Screenshots with headers or timestamps Phishing messages can reveal the thief’s route
Mail changes Any change-of-address confirmations Often the link between the theft and a physical address

Two cautions at the point where people tend to go wrong. Do not confront anyone you suspect, even if you think you know who it is. And do not log into a suspicious site or reply to a suspicious message to “see what happens”: that can put your remaining accounts at further risk.

Tax, benefits and children: special cases

Some identity theft runs through a government system, and those channels have their own steps. For tax-related theft, the IRS runs a victim assistance process described on its identity theft guide. Social Security number misuse goes to the SSA’s Office of the Inspector General, which takes reports through its fraud reporting page.

Children are a quiet target because nobody checks a child’s credit. The FTC says that when a child’s identity is misused, you contact the companies involved to close the accounts and confirm in writing that the child is not responsible. Then you contact the three credit bureaus and ask them to remove the fraudulent accounts from the child’s credit report. Its page on protecting your child has the details. If the person responsible may be a relative or someone close to the family, that is a case where a discreet professional investigator can help while the official report moves forward.

What a private investigator can do in an identity theft case

Police take the report and hold the power to arrest and prosecute. Many departments have limited time for individual consumer fraud, so victims often end up with a report number and little else. This is the gap a private investigator fills.

In our work, an identity theft engagement typically covers:

  • Tracing the trail. Using the accounts, addresses, phone numbers and emails your documents reveal, an investigator works out which leads connect and which are dead ends.
  • Identifying the person. Many cases turn out to involve someone known to the victim: an ex-partner, a relative, a former employee, a tenant, a carer. Lawful open-source and public-record research, together with social media investigation, can narrow a list of names.
  • Surveillance. When a suspect is using a physical address, such as a mail drop or a home where fraudulent deliveries arrive, professional surveillance can document who collects what and when.
  • Court-ready evidence. Photos, video and written reports prepared so they can support legal proceedings or be handed to police.
  • Finding where the money went. Where the theft has led to losses, an asset search can help establish what exists and where.

What an investigator does not do is break the law on your behalf. Legitimate investigators do not hack accounts, pretext banks for confidential records or intercept private communications, because evidence gathered that way can ruin a case and expose the client. If anyone offers you that, walk away. A good investigator also tells you when to hand the file to police, and prepares it so the handover is useful.

When to call law enforcement first

Always report. A police report and an FTC report are what unlock the formal remedies above, and a private investigator cannot substitute for them. Go straight to the authorities when:

  • a government benefit, tax return or Social Security number is involved;
  • you have received a threat or are being extorted;
  • the loss is large or involves many victims;
  • you believe a crime is under way and an immediate arrest is possible.

Then bring in an investigator if you want the case pushed further, or if the answer to “who did this” matters to you for a civil claim, a family law matter or an employment decision.

Surveillance in identity theft and fraud cases

Surveillance is one of the most misunderstood tools. It does not find a hacker overseas. It does answer physical questions: who is receiving the parcels, who is collecting the mail, who lives at the address on the fraudulent application, and whether a person’s daily life matches what they claim.

Our surveillance work is built around evidence that can be used. We use advanced technology to produce court-ready photos and video, and our reports record times, locations and observations in a form a lawyer or police officer can read. Our published surveillance pricing runs from $1,000 to $1,450 as a one-off fee, and our page on what a private investigator costs in Melbourne explains what shapes the final figure. For the principles behind it, see our guide to surveillance done the right way.

If the suspect may be an employee, check the rules first. Our overview of workplace surveillance laws covers what employers can legally monitor in Australia.

Finding people anywhere in the world

Identity thieves often sit in another country, and victims often need to locate someone who has moved abroad: a former business partner, an ex-employee, a relative who has disappeared with documents. Locating people overseas is possible, but it depends on the country, what records are public there and what privacy law allows.

Privacy regimes differ sharply. The Swedish Authority for Privacy Protection, for example, lets people complain about misuse of their data and choose which national authority to approach in cross-border matters. That is a reminder that what can be searched in one country may be protected in another, and a competent investigator works within each country’s rules.

We take on cases that cross borders, including missing persons work. One example is our write-up of a missing person found in the UK. Our firm also keeps a page on investigators across Australia. If you are looking for a person rather than a thief, our team handles missing persons and child recovery as well, and the page on our former FBI agent describes that side of the work.

Hiring former FBI staff and ex-military investigators for advice

People often search for former FBI agents, former special forces soldiers or ex-military personnel when a case feels beyond ordinary help. The instinct is reasonable. Former federal agents understand how fraud cases are built for prosecution: what a prosecutor needs, how to structure a chain of evidence and how multi-jurisdiction cases move. Former military personnel bring discipline in planning, patient observation and calm under pressure, which is why they suit surveillance and recovery work.

Our team includes former law enforcement, ex-military personnel and polygraph specialists, and our firm has worked with former FBI investigators on missing persons and child kidnapping matters. If you want advice from someone with that background, say so when you contact us and we will tell you honestly who on the team is best placed for your case.

What to ask any investigator you consider, whatever their résumé:

  1. Are you licensed to operate where the case sits?
  2. How will evidence be gathered and recorded so a court can use it?
  3. What will you hand to police, and when?
  4. What is the fee structure, in writing?

A military or federal background is a strength, but the method matters more than the label. Hiring someone to do anything outside the law is never what a legitimate firm offers.

When the victim is a business

A business may discover that employee or customer data has been misused, or that a staff member is selling identities. The FTC’s data breach guide for business says to consult law enforcement about the timing of notification so it does not impede the investigation, and to weigh state laws, the type of information, the likelihood of misuse and the potential damage when deciding whether to notify individuals.

In Australia, the OAIC describes a response of contain, assess, notify and review. The Notifiable Data Breaches scheme requires notification of eligible breaches that are likely to cause serious harm where remedial action has not prevented that risk.

Four steps in an Australian data breach response

Containment is where an investigator earns their fee. Before logs are overwritten or a suspect is alerted, we can help establish whether the cause is external or internal. Where staff are involved, our guides to employee theft investigations and fraud in small business explain the warning signs, and our corporate investigations team can step in.

Our perspective

Most victims come to us after weeks of phone queues and a report number that has gone nowhere. They are not short of information. They are short of someone who will connect it.

We believe an identity theft case is won on the quality of the file. Our investigations are tailored to the scenario: a stolen identity inside a divorce is a different job from a fraud inside a company. We bring experienced former police, ex-military and polygraph specialists to the work, along with technology that produces evidence suited to legal proceedings.

Our advice is simple. Report first, document everything, and do not confront anyone. Then talk to us about what the evidence points to. We will tell you plainly whether your case needs an investigator, the police, or both.

P.i Melbourne

Talk to an investigator about your case

If you have reported the theft and want to know who is behind it, we can review what you have and tell you what is realistic. Our private investigation services include fraud investigation, surveillance, missing persons and evidence collection for court, and every engagement is tailored to the client’s situation.

Pi melbourne

Bring your call log, credit reports and any correspondence. The more organized your file, the faster we can start.

FAQ

Can a private investigator find out who stole my identity?

Often, yes, especially when the thief is someone with a physical or personal link to you. An investigator follows the addresses, phone numbers and accounts in your documents and uses lawful research and surveillance to identify who is behind them. Results depend on the case, and nobody can promise an outcome.

Do I still need to report to the police if I hire a private investigator?

Yes. A police report and an FTC complaint together form the Identity Theft Report, which the FTC says can be used to remove fraudulent items from your credit report and stop debt collection. An investigator supports that process and does not replace it.

What should I do first if I think my identity was stolen?

Place a fraud alert with one credit bureau, order your credit reports, call the fraud departments of affected companies, and report at IdentityTheft.gov. Start your call log the same day.

Can an investigator trace someone in another country?

In many cases, yes, but it depends on that country’s records and privacy laws. We work within local rules, and we tell you early if a lead cannot be pursued lawfully.

Is it worth hiring an investigator for a small loss?

It depends on what you need. If the question is who did it, whether the thief is someone close to you, or whether the evidence is needed in a legal matter, an investigator can be worth it. For a simple card fraud, the bank and the FTC process may be enough.

Sources