For U.S. consumers, the right evidence and deadline depend on where the fraud appears. A new account or collection on a credit report, an unauthorized credit-card charge, an ACH withdrawal, and an IRS notice each use a different process.

If identity theft put information on your credit report, send each reporting bureau that lists the item a specific request for a block under section 605B of the Fair Credit Reporting Act (FCRA). Include an FTC Identity Theft Report, proof of identity, and details that identify every fraudulent item. For other transactions, notify the company that handled the account as well; a credit-bureau dispute won't automatically recover money from a bank.

Match the dispute to the problem

Problem Process that controls Evidence and timing
Fraudulent account, collection, or inquiry on a credit report FCRA identity-theft block under section 605B Identity-theft report, proof of identity, and exact item details; a qualifying request is generally handled within four business days
Incorrect information that isn't identity theft Standard FCRA dispute Evidence of the error; the credit reporting company usually investigates within 30 days, with limited situations allowing up to 45 days
Unauthorized credit-card purchase Fair Credit Billing Act (FCBA) billing-error process Written notice that reaches the card issuer within 60 days after the first statement showing the error was sent
Unauthorized debit, ACH, or other electronic transfer The bank's error-resolution process, often under federal electronic-transfer rules Notify the bank promptly and follow its instructions; the credit-card 60-day rule doesn't automatically apply
Tax return or federal tax-account fraud IRS identity-theft process Follow the IRS notice and current form instructions; Form 14039 may apply in some cases

Send separate notices when the same incident affects more than one system. A bank dispute won't remove an account from your credit reports, and a bureau dispute won't necessarily return money taken from a bank account.

Stop further misuse and preserve your records

Take these steps as soon as you find the fraud:

  1. Contact the affected company. Ask for its fraud department. Find out whether it can close the account, replace a card or login, and flag the activity.
  2. Secure accounts that still belong to you. Change passwords, turn on multifactor authentication, review recovery information, and check for unauthorized changes to your mailing address, phone number, or email.
  3. Download all three credit reports. Use AnnualCreditReport.com, save copies, and mark every unfamiliar account, collection, inquiry, address, or balance.
  4. Consider a fraud alert and credit freezes. An initial fraud alert lasts one year. An extended alert can last up to seven years when you have a qualifying identity-theft report. A freeze is separate and must be requested from each bureau.

You can place an initial alert with Equifax, Experian, or TransUnion; the bureau you contact generally notifies the other two. The alert asks potential creditors to take additional steps to verify your identity. It doesn't block access to your file or delete an account already reported.

A freeze restricts most prospective creditors from accessing your file, which can help with new-account fraud. It won't correct information already reported or stop a thief from taking over an existing bank, card, or email account. See Experian's fraud-alert guidance and credit-freeze guidance for examples of documents a bureau may request.

Assemble an evidence packet

Prepare a separate packet for each bureau, creditor, bank, or card issuer. Keep the originals and send copies or use a secure upload. Put the disputed items in a simple list so the recipient can match each item to the supporting document.

File an FTC Identity Theft Report

Use the FTC's IdentityTheft.gov service. Save the completed report, affidavit, recovery plan, and confirmation number.

Describe each item as specifically as you can:

A general statement that someone stole your identity may not connect the FTC report to a particular account. Match the report to the credit-report entry or transaction whenever possible.

Prove your identity and address

Include the documents the recipient requests, which may include:

Follow the recipient's current instructions about whether to include a full Social Security number, date of birth, or only selected digits. Don't send original documents, and don't email sensitive records unless the recipient provides a secure method.

Add records that show what happened

Useful documents can include:

You don't have to identify the thief. The packet should show which information is fraudulent and why you didn't authorize it.

Write a short factual statement

A signed statement can clarify the facts, but a notarized affidavit isn't automatically required for every FCRA block request. Use a notary only when the recipient specifically requires one.

State what you know, identify the disputed items, and avoid guessing about who committed the fraud. Any police report should also be truthful and specific. If law enforcement won't take a report, record that response and continue with the FTC report and the other dispute processes.

Request an identity-theft block from each credit bureau

When identity theft caused an account, collection, inquiry, or other information to appear on a credit report, ask for a block under FCRA section 605B. Don't rely only on a general claim that the information is inaccurate.

A qualifying request generally includes:

Send the request to every bureau reporting the item. A request sent to Equifax won't remove the same account from Experian or TransUnion.

A police report may help with a creditor or an extended fraud alert, but it isn't a universal requirement for a section 605B request. Check the bureau's current instructions and provide the identity-theft report and other documents they require.

Steps for sending the request

  1. Mark the exact entries on each report. Note the creditor, account number, date, balance, and page where each item appears.
  2. Complete the FTC report. Make its details match the items you're challenging.
  3. Prepare a cover letter. List each item separately and say that it resulted from identity theft.
  4. Use the bureau's current dispute channel. Online submission may be convenient. Tracked mail creates a separate record, but use the current dispute address listed by the bureau rather than an old address.
  5. Save proof of delivery. Keep the letter, attachments, upload confirmations, tracking record, and case number.
  6. Review the response and a fresh report. Check whether the item was blocked and whether related entries, such as a collection account or inquiry, remain.

For a qualifying request, the bureau generally must block the reported information within four business days after receiving the request. That is different from an ordinary FCRA investigation, which usually takes 30 days.

Use this as a starting point:

[Date]

[Credit reporting company]
Re: Request to block information resulting from identity theft under FCRA section 605B

I am requesting a block for the following information because it resulted from identity theft:

Creditor or company:
Account or reference number:
Date opened or reported:
Amount or balance:
How it appears on my credit report:

I did not open, authorize, or benefit from this account or transaction. Please block this information from my credit file and send me written confirmation of the action taken.

Enclosures:
- FTC Identity Theft Report
- Proof of identity
- Proof of address, if requested
- Credit-report pages identifying the disputed item
- Supporting records

[Name]
[Address]
[Phone or email]
[Signature]

Fill in every field and identify all disputed items. A form letter with no account details can delay the review.

Use a standard dispute for other credit-report errors

A standard FCRA dispute is the better route for a mixed-file problem, incorrect balance, duplicate account, wrong payment history, or another error that isn't the result of identity theft. Include the relevant report page and documents showing what should be corrected.

A credit reporting company generally has 30 days to investigate. Some investigations can take up to 45 days. If the bureau says the information was verified, send the creditor or collection company the same account-specific evidence through its published dispute channel and ask it to correct or stop reporting the information.

Don't submit the same vague dispute repeatedly. A bureau may treat a dispute as frivolous or irrelevant when it doesn't contain enough detail to investigate.

Dispute unauthorized credit-card charges separately

The FCBA billing-error process covers many unauthorized charges on a credit-card account. It is separate from a request to remove a fraudulent account from a credit report.

Write to the card issuer at the billing-inquiry address shown on the statement, not the address used for payments. Your written notice should reach the issuer within 60 days after the first statement showing the error was sent to you. A phone call can help stop further activity, but written notice is the safer way to preserve the billing-error process.

If the issuer sent the statement to a different address, the FCBA procedure has an additional address-notice condition. The FTC says you must have sent the issuer your new address in writing early enough for it to have the address at least 20 days before the billing period ended. Mention the address change when you contact the issuer if that situation applies.

The issuer generally must acknowledge the complaint within 30 days unless it resolves the problem sooner. It generally must resolve the dispute within two billing cycles and no later than 90 days. While it investigates, pay the part of the bill that isn't disputed. The FTC's credit-card billing-error guidance explains the written-notice process.

Include:

A basic notice can look like this:

[Date]

[Card issuer's billing-inquiry address]
Re: Unauthorized credit-card transactions on account ending [last four digits]

I am disputing the following transactions as unauthorized billing errors:

Merchant:
Transaction date:
Amount:

I did not authorize these transactions. Please investigate and provide written confirmation of the result. Enclosed are copies of the relevant statement and supporting identity-theft records.

[Name]
[Address]
[Signature]

If a thief opened the entire card account, tell the issuer that the account opening itself was unauthorized. Also send a separate FCRA block request to every bureau reporting that account.

Debit, ACH, and other bank transfers follow a different route

The FCBA credit-card deadline doesn't automatically apply to debit-card purchases, ACH withdrawals, or other electronic fund transfers. The available protection and timing can depend on the payment method and when the statement or notice was provided, so report the activity as soon as you find it.

Call the bank's fraud number immediately, then follow its written error-reporting instructions. Ask for a confirmation number and whether it needs a signed letter, transaction list, police report, or other documents. Keep watching the account for additional withdrawals.

Save the statement page, transaction IDs, screenshots, bank messages, and a timeline showing when you discovered and reported the activity. If the account or balance was also furnished to a credit bureau, the bank investigation doesn't replace a credit-report dispute.

Handle tax-related identity theft through the IRS

Form 14039, the IRS Identity Theft Affidavit, is for tax-related identity theft. It isn't a general form for removing a credit-card account or bank transaction. If the IRS sent a notice, follow that notice first and use the current form and submission instructions it provides.

The IRS may request identity verification and tax documents. The four-business-day credit-report block and the credit-card 90-day resolution period don't apply automatically to an IRS case.

An Identity Protection PIN can help reduce the risk of someone filing a future federal tax return using your information. It won't remove a fraudulent account from your credit report or resolve an existing tax matter. The Taxpayer Advocate Service's explanation of IP PINs explains that distinction.

Request records from the business involved

FCRA section 609(e) may allow an identity-theft victim to request application and transaction records from the business that handled the account or transaction. Send a written request with proof of identity, a qualifying identity-theft report, and enough information to identify the account.

Ask for records such as:

A qualifying request generally must be answered within 30 days. The company may redact information belonging to another person. These records can help you challenge the account with a bureau, explain the fraud to a collector, or find out whether the business attached someone else's information to your file.

A concise request could say:

I am a victim of identity theft and request copies of the application and business transaction records related to account [number] under FCRA section 609(e).

Enclosed are my proof of identity and identity-theft report. Please provide the records for [account or transaction] dated [date], including the application, account-opening information, transaction history, delivery records, and related communications.

[Name]
[Address]
[Signature]

If the dispute is denied

A denial doesn't necessarily mean the company proved you authorized the activity. The packet may have been incomplete, sent to the wrong address, or processed as a standard dispute instead of an identity-theft block.

  1. Read the written reason. Look for missing identity documents, an unidentified account, an unreadable attachment, or a statement that the information was verified.
  2. Check the submission record. Confirm that every page arrived and that you used the current dispute address or portal.
  3. Respond to the stated problem. Label each attachment and explain how it supports the specific account or transaction.
  4. Dispute with the furnisher directly. Send the creditor or collection company the same account-specific evidence through its published dispute channel.
  5. Request the business records. A section 609(e) request may reveal the application address, delivery location, or other information used by the thief.
  6. File a complaint with the Consumer Financial Protection Bureau when appropriate. Include your timeline, dispute letters, delivery proof, and responses. A complaint can prompt a response, but it doesn't guarantee deletion or reimbursement.
  7. Don't ignore a lawsuit or collection deadline. If a collector files a court case or the loss is substantial, consider contacting a consumer-law attorney or legal-aid organization in your state.

If a bureau keeps reporting the item after a valid block request, state clearly that you're requesting the FCRA identity-theft block, not another general investigation. Ask for the reason in writing and keep every response.

Identity-theft dispute checklist

Start by saving your reports and filing the FTC report. Then send an item-specific packet to each bureau or company that handled the fraudulent activity, using tracked delivery or a saved online submission record.