Identity Theft on Your Credit Report

Finding accounts you never opened — or collections for debts that were never yours — is disorienting and frightening. The good news: identity theft recovery follows a known path. Most of it is free, and federal law gives you tools that ordinary credit disputes don't have. This playbook walks the path in order.

What do you do first?

1. Lock the doors

   Place a fraud alert or security freeze (compared below), change passwords on financial accounts, and call the fraud departments of any company where an account was opened or misused. Ask them to close or freeze the fraudulent accounts.

2. File your FTC identity theft report

   At IdentityTheft.gov, answer the guided questions to create an official identity theft report and a step-by-step recovery plan. Save the PDF and your reference number — you will attach this report to almost everything that follows.

3. Pull all three credit reports

   Get your Equifax, Experian, and TransUnion reports free at AnnualCreditReport.com and inventory every account, inquiry, and address that isn't yours. Errors can appear on one report and not the others.

4. Consider a police report

   A local police report is most useful when you know the thief, when the fraud happened in person nearby, or when a company insists on one. For many steps, the FTC report alone is enough.

Fraud alert or security freeze — which one?

That's the recovery version of a freeze — placed after something has already gone wrong. Placing one preventively on a child's file, before it exists at all, is a different situation with its own steps; see our parents' guide to student credit for freezing a child's credit before college.

How does the FCRA identity theft block work?

This is the tool that separates identity theft recovery from ordinary dispute work. A regular dispute asks the bureau to investigate accuracy, typically a 30-day process. A 605B block, backed by your FTC report, requires much faster action and reaches further. Once notified, the companies that supplied the fraudulent data generally may not continue reporting it or sell the debt for collection. Send block requests in writing to each bureau reporting the items, and dispute directly with the furnishers as well. Sample letters are in our bureau dispute and furnisher dispute templates.

What does the full recovery timeline look like?

Recovery is rarely one-and-done. Fraudulent debts sometimes get sold to a new collector who reports them all over again. The block-and-dispute cycle applies to the new appearance too, and your saved documentation makes round two much faster.

Common mistakes to avoid

• ✕Handling everything by phone and keeping no written record of who agreed to what.
• ✕Disputing with only one bureau when the fraudulent account appears on two or three reports.
• ✕Paying a fraudulent collection just to make the calls stop — payment doesn't prove innocence and can complicate the block.
• ✕Placing a fraud alert and assuming it blocks new accounts the way a freeze does.
• ✕Paying for 'identity repair' services that perform the same free steps listed on IdentityTheft.gov.
• ✕Tossing the file once things look clean — resold fraudulent debts often resurface months later.

Frequently asked questions

What should I do first if I find identity theft on my credit report?

Contain the damage, then create the official record. That means placing a fraud alert or security freeze, changing passwords on financial accounts, and contacting the fraud departments of any company where an account was opened or misused. Then file at IdentityTheft.gov to generate an FTC identity theft report and a recovery plan, and pull all three credit reports free at AnnualCreditReport.com to inventory every account, inquiry, and address that is not yours.

What is the difference between a fraud alert and a security freeze?

Both are free. A fraud alert asks creditors to verify your identity before opening credit and requires contacting only one bureau, which must notify the other two; an initial alert lasts one year and an extended alert with an identity theft report lasts seven. A security freeze blocks most access to your report for new-credit checks entirely, must be placed with each of the three bureaus separately, and stays until lifted. The freeze is the stronger tool.

How do I get fraudulent accounts removed from my credit report?

Section 605B of the Fair Credit Reporting Act lets you block information that resulted from identity theft. You send each bureau your identity theft report, proof of identity, a list of the fraudulent items, and a statement that they do not relate to any transaction of yours. The bureau generally must block those items within four business days and notify the furnishers, who generally may not continue reporting the items or sell the debt for collection.

Do I need a police report for identity theft?

Not always. For many steps the FTC identity theft report from IdentityTheft.gov is enough. A local police report is most useful when you know the thief, when the fraud happened in person nearby, or when a company insists on one.

Can a credit bureau refuse an identity theft block?

Yes, in limited circumstances. A bureau can decline or reverse a block if it reasonably concludes the request misstates the facts, such as evidence that you obtained goods or money from the transaction. Because the block relies on a sworn identity theft report, precise, documented requests limited to genuinely fraudulent items are the ones that hold.

Does a security freeze stop collectors on existing accounts?

No. A freeze restricts access for new-credit decisions, so current lenders and collectors for existing accounts can generally still see the file. That is why the freeze is paired with the block-and-dispute work rather than used as a substitute for it. Fraudulent debts also sometimes get sold to a new collector who reports them again, and the block-and-dispute cycle applies to the new appearance too.

When to talk to a professional

If the fraud is on a credit card

• A fraud claim was denied
• A billing dispute was mishandled