Identity theft disputes work best when each request goes to the organization that controls the record. A lender can correct a fraudulent loan on its own records and report the correction to the bureaus. It can't reverse a debit from your checking account. Your bank can investigate that debit, but it can't remove a fraudulent loan from every credit report.

If money is still leaving an account, call the bank or card issuer first. Then file an FTC identity theft report, protect your credit files, and send separate disputes to the business, every credit bureau reporting the information, and any government agency involved.

U.S. scope: These steps use U.S. agencies and consumer rules. State procedures for driver's licenses, medical records, debt collection, and taxes can differ.

Start with the loss that is still happening

Stop new transactions and account access

Call the fraud department using the number on your card, statement, or the company's official website. A phone number in an unexpected email or text may belong to a scammer.

Ask the company to:

• Lock or close the affected account.
• Replace compromised cards, account numbers, checks, or login credentials.
• Stop unauthorized ACH debits and recurring payments.
• Remove unfamiliar authorized users, devices, beneficiaries, or linked accounts.
• Give you a case number and written instructions for submitting documents.
• Preserve transaction details, statements, applications, and account-opening records.

Secure a possibly compromised email account before changing financial passwords. Change the email password, sign out of other sessions, turn on multifactor authentication, and check the recovery email address and phone number. If you suspect a SIM swap, contact your mobile provider promptly.

Make an official report

File a report at IdentityTheft.gov. The FTC report records the facts you provide and creates a recovery plan for contacting companies. Download or print the report and keep its confirmation information with your other records.

The report is evidence, not a ruling on liability. It doesn't by itself cancel a debt, reverse a payment, or require a credit bureau to delete an account.

A police report isn't necessary for every identity theft dispute. It may still help when you know who used your information, a creditor asks for one, your local agency accepts the report, or you want an extended fraud alert. If you make a report, ask for the incident number and a copy.

The FTC's Identity Theft hotline is 1-877-438-4338 if you can't use the website.

Decide whether to use a fraud alert, a freeze, or both

These tools protect your credit files in different ways:

For an initial or extended alert, contact any one of the three nationwide credit bureaus. That bureau should notify the other two. The FTC's freeze and fraud-alert guidance explains the documentation and renewal process.

A freeze remains in place until you request removal. You may need to lift it temporarily when a legitimate creditor needs to check your file, so save each bureau's confirmation, login information, or PIN.

A freeze won't close an existing account, stop fraud in a bank account, or clean up information already reported. A fraud alert won't do those things either. They are prevention measures, not replacements for account and credit-report disputes.

Gather evidence before sending disputes

Keep one secure folder, on paper or in encrypted digital storage, containing:

• Your FTC identity theft report.
• A police report, if one was filed.
• Government-issued identification and proof of your current address.
• Credit reports from AnnualCreditReport.com.
• Statements showing unauthorized charges or transfers.
• Collection letters, applications, inquiries, account numbers, and relevant dates.
• Screenshots of suspicious emails, texts, messages, or account activity.
• The name of each representative, the date and time of each contact, case numbers, and promised follow-up dates.

Send copies, not originals. Give each recipient only the information it requests. Use a secure upload system when one is available; don't put a complete Social Security number or an unredacted bank statement in an ordinary email unless the recipient specifically directs you through a secure process.

Correct fraudulent information on your credit reports

Review all three reports

Use the reports from AnnualCreditReport.com and save a copy of each one before disputing anything. Look for:

• Accounts and collections you don't recognize.
• Hard inquiries you didn't authorize.
• Unfamiliar addresses, employers, or phone numbers.
• Name variations or other personal details that don't belong to you.
• Credit limits, balances, and payment histories that don't match your records.

Mark the exact account, inquiry, or line you are challenging. A specific dispute is more useful than a general statement that your entire report is fraudulent.

Send a dispute to every bureau that lists the item

Use the bureau's current online or mail process. The FTC's credit-report dispute guidance explains what to include and where to submit it. Don't rely on a mailing address copied from an old template; addresses and submission procedures can change.

Include:

1. Your name, address, and contact information.
2. The creditor's name and the account number, using only the last few digits where appropriate.
3. A clear statement that you didn't open or authorize the account or inquiry.
4. A copy of your identity theft report.
5. Proof of identity and address if requested.
6. A copy of the report page with the disputed item highlighted.
7. The result you want, such as deletion or correction.

If the information resulted from identity theft, identify the request as an identity-theft block request under Fair Credit Reporting Act Section 605B. That is a separate process from an ordinary accuracy dispute. Follow the bureau's current documentation requirements. If the bureau says the request is incomplete, ask in writing which document or detail is missing.

An ordinary credit-report investigation generally uses a 30-day timeframe, with limited exceptions. That period doesn't mean the bank, tax agency, medical provider, or DMV will finish its separate investigation at the same time.

Dispute the item with the company that furnished it

Send a second, separate dispute to the bank, lender, card issuer, collector, or other company that supplied the information. That company may be able to close the account, stop collection activity, correct its internal records, and notify the credit bureaus.

A bureau dispute may leave the original account open. A dispute to the creditor may not update every credit file. When both problems exist, contact both types of recipient.

If a collector contacts you, state in writing that the debt is connected to identity theft and ask for the account information and documents supporting the claim. Don't ignore collection notices, but don't automatically admit or pay a debt that you are disputing.

Check what happens next

Keep each investigation result. Compare the next credit report with the copy you saved before filing.

If an item is still reported as accurate:

• Ask the bureau and furnisher to explain the basis for the result.
• Provide specific new evidence instead of repeating the same general complaint.
• Correct missing or inaccurate personal information that may be linking the item to you.
• Ask whether the applicable process allows you to add a brief statement to your file.
• Consider a complaint to the Consumer Financial Protection Bureau or your state attorney general.

A complaint can document the problem and prompt a response. It doesn't guarantee deletion or compensation.

Use the payment dispute process for unauthorized transactions

A credit-report dispute won't recover money from a bank account. The payment rail determines who you contact first and which notice procedure may apply.

The FDIC's consumer guide to credit and debit card billing issues and the NCUA's Regulation E guide describe different types of disputes.

The 60-day credit-card billing concept doesn't automatically apply to a debit, ACH transfer, wire, or payment-app transaction. Report anything suspicious as soon as you discover it, even if you aren't sure which rule controls.

Be precise about what happened. A transfer that you authorized because a scammer misled you may be classified differently from a transfer that someone made without your permission. Don't describe an authorized payment as "unauthorized" just to fit a script.

Handle tax-related identity theft through the IRS

An FTC report doesn't correct an IRS account or replace the IRS's verification process.

If the IRS sent you a notice, start with the instructions and contact method in that notice. Don't automatically file Form 14039 just because you received an official letter; follow the letter's directions.

If your federal return was rejected because someone already filed using your Social Security number, or the IRS tells you to submit an identity-theft affidavit, review the current Form 14039 instructions on the IRS website. Go to the IRS website yourself rather than using a link in an unexpected email or text.

Ask the IRS about an Identity Protection PIN, which can help protect future federal tax returns. A suspected fraudulent state return requires a separate contact with the state revenue department.

Correct other records separately

Driver's license and vehicle records

Contact your state's DMV or motor-vehicle agency through its official website. Ask what to do if someone used your identity for:

• A driver's license or identification card.
• Traffic tickets or tolls.
• Vehicle registration or title.
• An address, driving-record, or vehicle-information change.

State deadlines, hearing rights, and proof requirements vary. Ask for the agency's fraud or identity-theft unit and keep the case number.

Medical identity theft

Contact the provider's billing or privacy office and your health insurer. Identify the appointment, claim, prescription, bill, or medical record you don't recognize. Ask how to request a correction and how the provider will confirm that the inaccurate information was removed or marked.

If the bill went to a collector or appears on a credit report, dispute it with the collector, provider, and any bureau reporting it. Keep responding to billing notices while the investigation is pending rather than assuming the bill has been canceled.

Employment and benefit fraud

When someone uses your information for payroll, unemployment benefits, public assistance, or another government program, contact the employer, benefits agency, or program administrator that created the record. Ask what identity documents and reports it needs and whether an appeal or correction deadline applies.

Keep calls short and specific

A script can help you get to the right department, but use only facts that are true.

Creditor or account provider

"I'm reporting suspected identity theft involving account ending in [XXXX]. I did not open or authorize this account or transaction. Please transfer me to the fraud department, protect the account from further activity, and tell me exactly what documents and submission address you require. Please give me a case number and send the result in writing."

Bank or credit union

"I'm reporting an unauthorized [debit-card, ACH, ATM, or other electronic] transfer dated [date] for [amount]. I did not authorize it. Please open an error investigation, protect the account from further transfers, and explain your written notice process and deadlines."

Credit bureau

"I need to dispute information caused by identity theft. The item is [creditor and account or inquiry]. I have an FTC identity theft report and proof of identity. Please tell me the current process for an identity-theft block request and confirm what documents you need."

A phone call may help you learn the procedure, but submit the actual dispute through the bureau's documented online or mail channel. Save the confirmation or proof of delivery.

Identity theft dispute letter template

Use a separate letter for each bureau, furnisher, creditor, or collector. Edit the brackets and remove any statement that isn't accurate.

[Your name]
[Your mailing address]
[Date]

[Company or credit bureau name]
[Current dispute address or submission reference]

Subject: Identity theft dispute concerning [account or inquiry ending in XXXX]

I am disputing the information identified above. I did not open or authorize this account, inquiry, charge, or transaction. It resulted from suspected identity theft.

Please investigate the item and take the following action: [close the account, stop collection activity, reverse the unauthorized transaction, or correct or delete inaccurate information]. If the information is being reported to a consumer reporting agency and resulted from identity theft, please also process the applicable identity-theft block request. If a document is missing, please identify it in writing.

Enclosures: proof of identity, proof of address, FTC Identity Theft Report [number], police report [number, if available], and the relevant page of my credit report or statement.

Please send me the investigation result and any correction in writing.

Sincerely,
[Your name]
[Preferred contact method]

Don't send a bank a letter that asks only for credit-report deletion. For a bank, name the result you actually need, such as closing the account, reversing an unauthorized transfer, or stopping future debits.

Track each dispute and escalate the right problem

A simple log can prevent a missed deadline or a second round of searching. Record:

• The date and recipient.
• The submission method.
• A delivery or confirmation number.
• The case number and representative's name.
• The documents you provided.
• The expected response date.
• The result and your next action.

Calendar the response period given by each organization. If a bureau doesn't respond, a furnisher rejects a well-documented dispute, or a bank mishandles an unauthorized transaction, ask for a supervisor or written review. Sending the same general complaint repeatedly usually adds less than new, specific evidence.

For a financial company or credit-reporting problem, the CFPB may offer a complaint route. A state attorney general or state financial regulator may also be appropriate. Tax, DMV, insurance, and medical-record complaints follow separate systems, so use the agency named in the notice or the organization's official website.

Consider a qualified consumer-law professional or legal-aid organization if the theft involves a large loss, an imminent lawsuit, housing or employment consequences, or repeated refusal to correct documented information. This is practical information, not legal advice.

Monitor the accounts after the dispute

Keep a credit freeze in place unless you need to apply for credit. When access is necessary, lift it only for the needed period or creditor where that option is available, then reinstate it.

Continue checking:

• All three credit reports for new accounts, inquiries, and address changes.
• Bank and card statements for small test transactions.
• Payment-app activity and linked accounts.
• Tax notices and benefit records.
• Mail and account-security alerts.

An initial fraud alert can be renewed when needed. If you use an extended alert, keep the FTC or police documentation available because a renewal request may require it again.

Be wary of "recovery" companies that demand payment, passwords, or a one-time security code. Credit freezes are free, and you can begin the FTC reporting process without paying a private service.

Frequently asked questions

Do I need both a credit freeze and a fraud alert?

No. They address different risks, and you can use both. A fraud alert asks lenders to take additional verification steps. A freeze restricts access to your credit file for most new-credit applications.

Do I need a police report to dispute an account?

Not for every initial dispute. An FTC report may satisfy a company's process, while a police report may help with an extended fraud alert or a creditor's documentation request. Ask the specific recipient what it requires.

Will IdentityTheft.gov remove a fraudulent account?

No. The FTC report supports your recovery efforts. You still need to dispute the account with the creditor or furnisher and with every credit bureau that reports it.

How long will recovery take?

There is no single timetable. A standard credit-report investigation generally uses a 30-day period, while bank, tax, medical, and DMV investigations follow different workflows. Keep monitoring all of them while the separate organizations work on their parts.

Should I dispute an item with only one bureau?

No. Contact every bureau that lists the item. A correction at one bureau doesn't automatically ensure that the other two have updated their files.

Put the nearest deadline on your calendar today, whether it is a written card billing dispute, a bank error notice, or a bureau submission. Keep the confirmation with your evidence packet and follow up on that specific case rather than sending another generic complaint.