Credit Repair After Identity Theft

Identity theft leaves accounts you never opened, inquiries you never made, and collections for money you never spent. The Fair Credit Reporting Act treats that differently from an ordinary error. It gives you a faster tool, the identity theft block. It also gives you a set of free protections. Companies advertising "identity theft credit repair" mostly resell those at a markup. This page lays out the free path and the difference between the block and a regular dispute.

Key points

• The 605B block (15 U.S.C. § 1681c-2) requires a bureau to block identity theft items within four business days of a complete request. The bureau must tell the furnisher, which then may not keep reporting them.
• An ordinary dispute (§ 1681i) takes up to thirty days and only asks whether the item is accurate. The block asks whether it resulted from identity theft, which is a different and faster question.
• The IdentityTheft.gov report is the "identity theft report" the statute refers to. It is free, and it generates the letters you need.
• An extended fraud alert lasts seven years and requires lenders to contact you before opening credit. A freeze is free, placed within one business day, and lifted within one hour.
• Filing an identity theft report for a debt that is really yours is a crime. Companies that do it in your name expose you, not themselves.

What is the difference between a 605B block and a regular dispute?

	Ordinary dispute (§ 1681i)	Identity theft block (§ 1681c-2)
Question the bureau answers	Is this item accurate?	Did this item result from identity theft?
What you send	A dispute identifying the error, with any evidence	Proof of identity, an identity theft report, the list of items, and a statement they are not your transactions
Deadline	Generally 30 days, up to 45	4 business days after receipt of the complete request
Furnisher effect	Bureau forwards the dispute; furnisher investigates	Bureau notifies the furnisher; blocked information may not be re-reported or sold for collection
When the bureau can refuse	If the dispute is frivolous or the furnisher verifies	If the block was requested in error, on a material misrepresentation, or you received goods, services, or money from the transaction
Best use	Wrong balance, wrong date, mixed file, paid item showing unpaid	Accounts, inquiries, and collections a thief created

The statute's refusal grounds are worth reading closely, because they are the guardrail against abuse. A bureau may decline or rescind a block on three findings. The block was requested in error, the request rested on a material misrepresentation, or you actually got the goods, services, or money. That is why the block is only for real identity theft, and why the FTC treats a false identity theft report as a crime.

What is an identity theft report, and is a police report required?

The free sequence at IdentityTheft.gov:

1. File the report

   Answer the questions about what happened. The site produces your FTC Identity Theft Report and a personal recovery plan.

2. Print the affidavit and the sample letters

   The site generates pre-filled letters to the bureaus and to the companies where the thief opened accounts. Those are the letters companies charge to write.

3. Add a police report if a creditor asks

   Bring the FTC report, a government ID, proof of address, and any evidence of the theft to the police department. Some departments take it online. Keep the report number.

4. Send the block request to each bureau

   Proof of identity, the FTC report, the list of fraudulent items, and the statement that they are not your transactions. Send it separately to Equifax, Experian, and TransUnion, by mail with tracking or through their fraud portals.

5. Send the furnisher letters

   Notify each lender or collector that the account is fraudulent. Use the IdentityTheft.gov letter or our furnisher dispute letter. The identity theft dispute checklist tracks all of it.

Extended fraud alert or freeze, and why not both?

Protection	Duration	Cost	What it does	Where it falls short
Initial fraud alert	1 year, renewable	Free	Lender must take reasonable steps to verify identity; one free report from each bureau	Lender judgment call; a determined thief with your details can pass
Extended fraud alert	7 years	Free; requires an identity theft report	Lender must contact you in person or by your chosen method; two free reports in 12 months; 5-year prescreen opt-out	Requires the report; does not stop existing-account takeover
Security freeze	Until you lift it	Free	Blocks most new-credit pulls of your file	Must be placed at each bureau separately; does not stop existing-account fraud; some pulls (employment, tenant screening, insurance) are outside the freeze law

The alert propagates: place it at one bureau and that bureau must refer it to the other two. The freeze does not; each bureau must be contacted. Our credit freeze and fraud alert entries cover the mechanics, and the broader identity theft on your credit report guide covers closing accounts and the full timeline.

What do "identity theft credit repair" companies sell that is free?

What the offer says	The free version	The catch to watch for
"We file your identity theft affidavit"	IdentityTheft.gov generates it in one session	Some companies file reports for debts you owe; the FTC calls that a crime
"We send block letters to all three bureaus"	The site produces the letters; postage is the only cost	Charging before sending is a CROA violation
"Seven-year fraud alert placement"	One call or online form at any bureau; it propagates to the others	Nothing to add
"Credit freeze setup at all bureaus"	Free by law since 2018; three online forms	Some sell paid "lock" products that duplicate the freeze
"Fraud monitoring"	Free weekly reports at AnnualCreditReport.com; the extended alert adds free reports	Monitoring is a convenience, not a repair
"Removal of fraudulent accounts"	The 605B block, four business days	A "guaranteed removal" promise is a CROA violation on its face

The FTC's August 2026 complaint against a credit repair network alleges the company filed false identity theft reports at IdentityTheft.gov without consumers' knowledge to remove legitimate debts. The company is not named here because the case had not been adjudicated at this writing; the allegations are linked in the sources. The lesson is structural: a company that files reports in your name is putting your signature on a sworn statement.

What if the bureau or lender will not block?

Escalation order: a written re-request with the missing element, then a CFPB complaint naming the bureau and the furnisher, then a consumer attorney. The FCRA provides actual damages and attorney's fees for negligent violations and statutory and punitive damages for willful ones. Keep every letter, tracking receipt, and response in one folder from the first day.

Common mistakes to avoid

• ✕Sending an ordinary dispute for a thief's account instead of a 605B block request with the FTC report attached.
• ✕Placing a freeze at one bureau and assuming it covers all three — freezes do not propagate; alerts do.
• ✕Paying for an affidavit, letters, or a freeze that IdentityTheft.gov and the bureaus provide free.
• ✕Letting a company file an identity theft report for a debt that is actually yours.
• ✕Skipping the 609(e) records request, which shows the address and phone the thief used.
• ✕Stopping after the bureaus — the lenders and collectors each need their own notice.

When to talk to a professional

Frequently asked questions

How fast must a bureau remove fraudulent accounts after identity theft?

Under 15 U.S.C. § 1681c-2, a bureau must block identity theft items within four business days of a complete request. Complete means proof of your identity, an identity theft report, the list of items, and your statement that they are not your transactions. An ordinary dispute, by contrast, takes up to thirty days.

Do I need a police report to block identity theft items?

The statute requires an identity theft report, and the FTC's IdentityTheft.gov report meets that definition. A police report is not always required for the block, but the CFPB recommends filing one, and some creditors ask for it, so most people file both.

How long does an extended fraud alert last?

Seven years, under 15 U.S.C. § 1681c-1(b). It requires lenders to contact you before opening new credit. It gives you two free reports from each bureau in the first year and removes you from prescreened offer lists for five years. It can be removed earlier on request.

Is a credit freeze free after identity theft?

Yes. Federal law makes freezes free at Equifax, Experian, and TransUnion for everyone, not only victims. A freeze requested online or by phone must be placed within one business day and lifted within one hour. Each bureau must be contacted separately.

Should I pay an identity theft credit repair company?

Everything on the recovery plan is free: the FTC report, the letters, alerts, freezes, and the block. A company can sell time and organization, but it cannot charge before performing or promise a result. Any company willing to file an identity theft report for a debt you actually owe is exposing you to a crime.

Can a bureau refuse to block an account?

Yes, on three grounds: the block was requested in error, it rested on a material misrepresentation, or you received goods, services, or money from the transaction. The bureau must tell you promptly. You can re-request with more evidence, run a Section 611 dispute in parallel, and complain to the CFPB.