If an unfamiliar account or charge appears, use the process tied to that specific record or transaction. A credit-report dispute, an FTC Identity Theft Report, a fraud alert, a credit freeze, and a bank fraud claim do different jobs. Sending the same generic letter to every company can delay the response you actually need.

This article is for U.S. consumers. Deadlines and procedures vary by payment method, account type, and state. It provides general information, not legal advice.

Quick action checklist

• [ ] Get current copies of all three credit reports using the free-report instructions in the FTC's credit-report dispute guide.
• [ ] Report the identity theft at IdentityTheft.gov and save the report and recovery plan.
• [ ] Place a credit freeze with each bureau if you want to restrict access to your credit file. Consider a fraud alert as well.
• [ ] Contact the bank, card issuer, lender, collector, or payment app involved in the unauthorized transaction or account.
• [ ] Gather copies of your identification, proof of address, statements, account notices, and relevant correspondence.
• [ ] Send a specific dispute to each bureau reporting the inaccurate item and, when appropriate, to the company that supplied the information.
• [ ] Record submission dates, confirmation numbers, delivery details, claim numbers, and response deadlines.
• [ ] Check the reports again after the investigation and continue watching for new accounts or transactions.

What actually controls an identity theft problem?

Start with the record or transaction you need to correct. The process for removing an unfamiliar account from a credit report is not the process for reversing money that left a bank account.

The FTC's credit-freeze and fraud-alert guidance explains how these security tools work. The FTC's identity theft recovery information and USA.gov identity theft guidance can help with problems outside your credit reports.

12 common identity theft dispute mistakes

1. Assuming there is a two-day deadline for a credit-report dispute

There is no universal rule requiring you to dispute an identity theft account within 48 hours or lose the right to challenge it. Waiting is still risky. New charges, late payments, collections, or account takeovers may continue while you delay.

For a credit-report dispute, the FCRA process generally gives a credit bureau 30 days to investigate. Some situations allow a longer period, often up to 45 days. Banks and card issuers can have different procedures and deadlines, especially for unauthorized transactions.

Do this instead: Report the problem as soon as you find it, but don't send an incomplete or inaccurate dispute just to meet an invented deadline. Secure the account, collect the available evidence, and submit a clear packet promptly.

2. Writing only "fraud" or "not mine"

A vague statement doesn't identify the exact problem. The issue might be that you don't recognize the account, or that the balance, payment history, account status, or another detail is wrong.

Include:

• The name of the company reporting the account
• The account number or last four digits
• The credit report and date where you found the item
• The specific information that is inaccurate
• A short explanation of what happened
• The correction, block, or removal you are requesting
• The documents supporting your statement

If the account is yours but the balance or payment history is wrong, say so. If you never opened or authorized the account, state that clearly. A dispute is not a request to erase accurate negative information simply because it lowers your score.

3. Expecting the FTC report to remove the account automatically

IdentityTheft.gov creates a recovery plan and an Identity Theft Report that you can provide to businesses. The FTC says the report can help show businesses that someone stole your identity. It is useful evidence, but it is not a direct instruction to a credit bureau.

Use it as evidence: Include the FTC report in a separate dispute packet. Send that packet to every bureau displaying the account, and contact the lender or other company that supplied the information. Follow the company's own requirements for fraud documentation.

Review the report before submitting it. Make sure each account, date, and type of misuse is described accurately. Don't add a creditor or event you cannot support.

4. Treating a police report as either mandatory or unnecessary

A police report can strengthen an identity theft request, but it is not a universal prerequisite for every credit-report dispute. Some companies or specific requests may ask for one, while others may accept an FTC report and identity documents.

Check the requirements first: Ask the bureau or business what it requires for the action you want. If you file a police report, bring your FTC report, identification, and relevant statements. Describe only facts you know. If a police department will not take a report, keep a record of that response and submit the other available evidence.

For an extended fraud alert, keep your FTC or police documentation available. Eligibility and renewal can require identity theft documentation.

5. Checking only one credit bureau

Creditors do not always report to all three nationwide bureaus. An account missing from Equifax might still appear on Experian or TransUnion, and the account details may differ between reports.

Get current reports from all three bureaus. Mark the exact entries that are fraudulent, then submit a separate dispute to each bureau reporting the item. A correction at one bureau does not automatically update the other two.

Use each bureau's current official instructions. The FTC's dispute guide explains the process and provides bureau-specific information. Addresses and submission procedures can change, so don't rely on an old letter template.

6. Confusing a fraud alert, credit freeze, and dispute

These tools address different risks:

• Fraud alert: Tells businesses checking your credit file to take steps to verify your identity. An initial alert generally lasts one year. An extended alert can last longer for eligible identity theft victims and may require an FTC or police report. You can usually place an alert through one bureau, which then contacts the others.
• Credit freeze: Restricts access to your credit file for most new-credit applications. A freeze is free and stays in place until you ask the bureau to remove it. You generally need to manage a freeze with each bureau.
• Credit-report dispute: Challenges inaccurate information already appearing on a report.

A fraud alert or freeze will not delete an existing account. A credit-report dispute will not necessarily prevent someone from trying to use your bank account.

Match the tool to the risk: Use a freeze or alert to reduce further credit-related harm, then dispute the fraudulent information separately.

7. Copying an old mailing address or assuming certified mail is the only valid method

Bureaus change addresses, forms, and online procedures. Sending a well-written dispute to an outdated address can delay processing. Certified mail can help document delivery, but it is not automatically the only acceptable submission method.

Use the bureau's current official dispute instructions. If online submission accepts your documents, save the confirmation page, reference number, and uploaded files. If you mail the packet, send copies, keep the complete packet, and retain delivery or tracking information.

For example, Experian's official dispute instructions explain how to submit supporting documents. Check the current instructions for each bureau instead of copying an address from a forum or old article.

8. Sending original documents or exposing more personal information than necessary

A dispute packet may require identification, proof of address, an FTC report, a police report, or account statements. Sending original documents creates a risk that they will not be returned.

Do not email a full Social Security number or account password through an ordinary, unsecured channel. Do not send unrelated bank statements when one page proves the point.

Protect the packet:

• Send copies, not originals.
• Follow the bureau's instructions for acceptable identification and address documents.
• Redact unrelated account numbers and transactions when the remaining information still proves your claim.
• Leave enough information visible to match the document to the account.
• Keep a private copy of everything you submit.

Use only official websites, secure portals, or verified mailing instructions when personal information is involved.

9. Filing a mass dispute filled with repeated claims or "magic" legal codes

A statute citation cannot replace evidence. Submitting the same form letter against every negative item can obscure the identity theft issue you need reviewed. No special phrase guarantees deletion.

Make each claim traceable: Organize the dispute around the actual error. You can include several fraudulent accounts in one clearly labeled packet if the bureau's instructions allow it, or send separate submissions when that is clearer. For each account, explain what is wrong and identify the supporting document.

If you submit new information later, explain what it is and why it addresses the earlier result. Do not simply resend the same letter without adding relevant evidence.

10. Disputing with the bureau but not contacting the company involved

The bureau maintains the report, but the lender, collector, card issuer, or other company supplied the account information. That company may have a separate fraud team and may be able to close the account, correct its internal records, or review collection activity.

Send the credit-report dispute to each applicable bureau and notify the company that reported the account. Use the company's official fraud or identity theft channel. Ask for a claim number and a list of required documents.

For an unauthorized credit-card charge, contact the card issuer through its fraud or billing-dispute process. For a debit, electronic funds transfer, bank-account withdrawal, or payment-app transaction, contact the bank or provider directly. The credit-report process will not protect money that already left an account.

11. Failing to track the dispute and review the result

A phone call without a record is easy to lose. Even a successful submission can be difficult to follow if you do not know when it was sent, which documents were included, or when the response should arrive.

Create a simple log with:

• The company and bureau contacted
• The date and method of submission
• The account number or last four digits
• The documents included
• A confirmation or delivery number
• The name and number of any fraud claim
• The expected response date
• The result and any next step

A bureau generally has 30 days to investigate, with limited situations allowing 45 days. When the response arrives, compare it with a new copy of the credit report. A letter saying an item was "verified" does not end the review. Check whether the information actually changed and whether the result addressed the account you disputed.

12. Paying a recovery service without checking what it actually does

IdentityTheft.gov provides a free report and recovery plan. Be cautious about anyone who charges for those government steps, promises guaranteed deletion, tells you to dispute information you know is accurate, or asks for your bureau login credentials.

Professional help can be reasonable for a mixed credit file, repeated identity theft, collection lawsuits, or significant financial harm. It is not automatically necessary for a straightforward, well-documented dispute.

Before hiring anyone, get the services, total fees, cancellation terms, and expected timeline in writing. Verify the person's license if applicable. Do not hand over passwords or allow a company to make statements you cannot verify.

How to build an identity theft dispute packet

A strong packet is specific and easy to match to the report. Include:

1. A short dispute letter addressed to the correct bureau.
2. A copy of the relevant credit-report page with the item marked.
3. The creditor's name and account number or last four digits.
4. A clear explanation of why the information is inaccurate.
5. A copy of your FTC Identity Theft Report and a police report if available or requested.
6. A copy of acceptable identification and proof of address.
7. Statements, emails, account-opening notices, or other evidence supporting your timeline.
8. A list of the documents enclosed.

Send a separate letter for each bureau. Keep the language factual and avoid unnecessary personal details.

Plain-language dispute template

[Date]

Re: Identity theft dispute for [bureau] - account ending [last four digits]

I dispute the following information on my credit report:

Company reporting the account: [name]
Account number: [last four digits]
What is inaccurate: [brief, specific explanation]

[If true: I did not open, use, or authorize this account.]

Please investigate the information and correct, block, or remove any information that cannot be verified or is inaccurate. If the enclosed identity theft documents meet the applicable requirements, please process the related identity theft request.

Enclosures:
- Credit-report page identifying the account
- Identity Theft Report
- Police report, if available or required
- Identification and proof of address
- Supporting statements or correspondence

Please send the investigation result to:
[mailing address]

Use the sentence about not opening or authorizing an account only when it is accurate. Do not include your full Social Security number in a letter unless the official instructions specifically require it and provide a secure way to submit it.

Short bank or card-issuer message

On [date], I reported an unauthorized [charge, withdrawal, transfer, or account] involving [account or transaction details]. I did not authorize it. Please open a fraud claim, secure the account, tell me which documents you need, and provide the claim number and response instructions.

A bank or issuer may require its own form. Complete it promptly and continue following the provider's instructions for disputed balances, replacement cards, account access, or transaction evidence.

What to do if the bureau says the account was verified

Do not immediately send ten identical disputes. Instead:

1. Read the response and identify which account and information were reviewed.
2. Compare the result with the current credit report.
3. Contact the company that supplied the information and ask how to submit an identity theft claim.
4. Add relevant evidence that was missing from the first packet.
5. Send a concise follow-up explaining what is new and what correction you want.
6. Keep all earlier letters, attachments, delivery records, and response dates.
7. If the problem remains unresolved, consider a complaint to the Consumer Financial Protection Bureau or your state consumer-protection office. For serious losses or a mixed-file problem, qualified legal help may be appropriate.

Each follow-up should address the reason given for the earlier result. Repeating the same form letter without new information is unlikely to clarify the dispute.

Questions consumers often ask

Do I need a police report to dispute identity theft with a credit bureau?

Not for every dispute. A police report may be useful or specifically requested for certain identity theft requests, and it can support an extended fraud alert. Ask the bureau or business what documents its process requires. An FTC Identity Theft Report is also important evidence.

Will IdentityTheft.gov remove a fraudulent account?

No. IdentityTheft.gov provides a recovery plan and an Identity Theft Report. You still need to dispute the credit-report entry with the relevant bureau and contact the company that reported or opened the account.

Should I get a freeze or a fraud alert?

A freeze provides a stronger barrier against most new credit applications and remains until you remove it. A fraud alert asks businesses to verify your identity and is usually easier to place through one bureau. Neither tool corrects an existing account, so use the appropriate dispute process too.

Is online or mail submission better?

Use the method listed in the bureau's current official instructions. Online submission can provide a confirmation number and document upload, while mail lets you keep a physical packet and delivery record. Whichever method you choose, save the complete submission and proof of delivery.

What if the identity theft affected taxes, benefits, medical records, or a driver's license?

A credit bureau cannot correct those records. Use the relevant agency's identity theft process, and start with USA.gov's identity theft guidance if you are unsure where to report the problem.

Before sending anything, mark the exact account or transaction, gather only the documents that support your claim, and write down the date you expect a response. That record will make the next step easier if the first investigation does not fix the problem.