If an account, loan, collection, or inquiry isn't yours, handle two jobs at the same time: notify the company involved, and dispute the related credit-report entry with every bureau reporting it. Freeze your credit files, keep copies of everything, and create an FTC Identity Theft Report. A credit-report dispute won't reverse an unauthorized bank transfer or correct a tax or medical record on its own.
These steps apply in the United States. Credit cards, debit transactions, bank transfers, tax filings, and medical records follow different rules and deadlines.
First 24 hours
- Contact the affected company. Call the fraud department using the number on a statement or the company's official website. Ask it to secure or close the account, stop additional transactions, issue new credentials or cards, and give you a case number. Request written confirmation.
- Secure email and financial logins. Change passwords from a trusted device, use unique passwords and multifactor authentication, sign out unknown devices, and check email forwarding rules. An exposed inbox can let a thief reset other accounts.
- Place a credit freeze. A freeze is free and blocks most new-credit applications that require a bureau check. You must place it separately with Equifax, Experian, and TransUnion.
- Add a fraud alert if it helps. Contact one bureau and it should notify the other two. An alert asks businesses to take extra steps to verify your identity. It doesn't block new credit.
- Report the theft to the FTC. Go to IdentityTheft.gov, complete the report, and save the Identity Theft Report, affidavit, and recovery plan. The FTC's guidance on reporting tax identity theft also explains how the tool can help with IRS Form 14039.
- File a police report when it would help. Bring identification, the FTC report, account statements, creditor letters, and other evidence. Ask for the report number and a copy. You don't always need a police report to start a credit dispute, but a detailed law-enforcement report can help with creditors, records requests, and an extended fraud alert.
Don't wait for a police report before freezing credit or notifying a bank.
Build an evidence file
Keep one folder, paper or digital, with:
- A timeline of each unauthorized account, charge, inquiry, letter, and phone call
- Credit reports with fraudulent entries marked
- Bank and card statements showing unauthorized activity
- Copies of the FTC report, police report, and identity documents
- Names, departments, case numbers, and dates for every contact
- Copies of letters and proof of delivery
- Collection notices, loan applications, account-opening emails, and suspicious messages
Send copies rather than originals. Don't put your full Social Security number in ordinary email or mail unless a secure official process specifically requires it. Use the last four digits where you can.
How to dispute fraudulent accounts with the credit bureaus
A bureau dispute only targets information in a credit report. It doesn't replace a bank's unauthorized-transaction claim or a creditor's fraud investigation.
Get all three credit reports
Use AnnualCreditReport.com, the federally authorized site, to obtain reports from Equifax, Experian, and TransUnion. Review account names, balances, collections, hard inquiries, addresses, and employers. Each bureau may hold different data, so a correction at one does not automatically correct the others.
The FTC's credit-report dispute guidance explains the basic process.
Choose the identity-theft block when it applies
If a new account, collection, or other entry resulted from identity theft, ask the bureau to block the information under FCRA Section 605B.
A complete block request generally includes:
- An FTC Identity Theft Report or another qualifying identity theft report
- Proof of your identity
- A clear description of each fraudulent item
- A statement that the information doesn't relate to a transaction you made or authorized
- A copy of the report page showing the item
Ordinary reporting errors that aren't identity theft use a standard FCRA dispute. A bureau generally has 30 days to investigate, and some situations allow up to 45 days. It can reject a request that is incomplete or looks frivolous, so identify each item and explain the problem specifically.
After a bureau receives the required materials for a qualifying identity-theft request, it generally must block the information within four business days. That deadline is separate from the ordinary dispute-investigation period.
Dispute every bureau that shows the item
You can file online or by mail. Online submissions may give a confirmation number and a place to upload documents. For mail, use the current address in the bureau's official dispute instructions. Mailing addresses change, so verify them through the FTC's dispute guidance or the bureau's current website.
Experian's dispute instructions describe its online and mail options. Send the same basic evidence to Equifax or TransUnion if those bureaus show the fraudulent information.
Certified mail with tracking isn't mandatory. It does create proof of what you sent and when it arrived.
Notify the creditor or furnisher too
Send a separate notice to the bank, lender, card issuer, collection agency, or other business that supplied the information. Ask it to close or secure the fraudulent account, stop treating the balance as yours while it investigates, correct information it furnished to the bureaus, confirm the account's status in writing, and provide relevant application and transaction records when you qualify to request them.
A bureau may contact the furnisher during its investigation. Direct notice still matters for the company's own records and collection activity.
Sample identity theft credit-report dispute letter
Adapt the letter for each bureau and each set of fraudulent items. Use the bureau's current dispute address or secure online portal.
[Your name]
[Your address]
[City, State ZIP]
[Date]
[Credit bureau name]
[Current dispute address]
Re: Request to block information resulting from identity theft under FCRA Section 605B
I am disputing information on my credit report that resulted from identity theft. I did not open, authorize, use, or benefit from the account described below:
Furnisher:
Account number, last four digits:
Date opened:
Balance or amount shown:
Report section:
Please block this information under FCRA Section 605B and send me written confirmation. I certify that the account and activity described above do not relate to a transaction I made or authorized.
Enclosures:
- FTC Identity Theft Report or qualifying police report
- Copy of my government-issued identification
- Proof of address, if requested
- Credit-report page with the fraudulent item marked
- Relevant creditor or collection letters
Please contact me through the information below if you need clarification.
Sincerely,
[Your name]
[Safe phone number or email address]Don't include more personal information than the bureau's secure process requires. Keep a complete copy of every submission.
After you file
The bureau may delete the entry, correct it, block it as identity theft, verify it with the furnisher, or ask for more information. If it says the item was verified and you know the activity is fraudulent, read the explanation against your evidence. Ask for the procedure used to verify the information and for the furnisher's contact details. Send new, relevant documentation rather than repeating a vague dispute, and dispute the item with the furnisher again. Keep the result letter and an updated report.
If the bureau failed to follow the process, you can file a complaint with the Consumer Financial Protection Bureau and attach your timeline and documents.
A consumer statement can explain the situation on a report, but it generally doesn't remove an account. Accurate information that belongs to you can't be deleted simply because it's negative.
Fraud alert versus credit freeze
The FTC's credit-freeze and fraud-alert guidance explains how to place and manage both protections.
| Protection | Who can use it | How long it lasts | What it does | Main limitation |
|---|---|---|---|---|
| Initial fraud alert | Anyone who suspects identity theft | One year | Tells businesses to take additional steps to verify an applicant | Doesn't block new credit |
| Extended fraud alert | A consumer with a qualifying Identity Theft Report | Seven years | Provides longer identity-verification protection | Requires supporting documentation |
| Security freeze | Anyone; free under federal law | Until you lift or remove it | Restricts access to your credit file for most new-credit applications | Must be placed and lifted separately with each bureau |
An initial or extended alert can help if you expect to apply for credit and don't want to manage freezes. A freeze is stronger against new accounts, but you'll need to lift it temporarily before a legitimate lender can access the file. You can use an alert and a freeze at the same time.
Neither protection stops every form of fraud. A freeze won't prevent misuse of an existing bank or card account, tax fraud, medical identity theft, or transactions with a business that doesn't use a frozen credit file.
Unauthorized charges and account takeovers
Use the process for the payment method involved.
Credit-card charge. Contact the card issuer's fraud or billing-dispute department immediately. Ask whether it requires written notice and where to send it; a billing-inquiry address may differ from the payment address. Keep the statement, dispute confirmation, and correspondence.
Debit-card or electronic bank transaction. Notify the bank or credit union promptly, secure the account, and ask how to open an electronic-transfer investigation. Deadlines and protections can depend on when you report the transaction.
ACH payment. Contact the bank and the company that initiated the debit. Ask whether the payment can be stopped or returned and whether the account needs new routing or account numbers.
Bank-account takeover. Change online-banking credentials from a safe device, remove unfamiliar users, replace compromised cards, and ask whether the account should be closed and reopened.
Wire transfer or peer-to-peer payment. Contact the sending institution and payment provider immediately and request a recall or fraud review. Recovery isn't guaranteed, especially after funds have been withdrawn.
New loan, card, or collection account. Contact the creditor and dispute the related credit-report entry with each bureau showing it.
The FTC report can support these claims, but it doesn't guarantee a refund. The payment rail's dispute rules, the account agreement, and the timing of your notice still matter.
Specialized identity theft disputes
Tax identity theft
If someone used your Social Security number to file a fraudulent federal tax return, follow the IRS process:
- Review the IRS instructions for Form 14039, Identity Theft Affidavit. The IRS Form 14039 guidance explains when to file online or submit a paper form.
- If the IRS sent a 5071C, 5747C, or 4883C identity-verification letter, use the verification instructions in that letter before filing anything else.
- Request an IRS Identity Protection PIN through the IRS process. The IRS IP PIN guidance explains how it protects future federal tax returns.
- Keep copies of returns, notices, wage documents, and every IRS confirmation.
- Continue meeting your legitimate tax filing and payment obligations. An identity theft affidavit doesn't eliminate the need to file or pay taxes that you actually owe.
Medical identity theft
Contact the health-care provider, insurer, and the provider's privacy office. Ask for the records and Explanation of Benefits documents connected to the treatment, then request correction of inaccurate information. Medical records may be amended rather than erased, so ask the provider to add a fraud notation and confirm what it changed.
If the provider doesn't address a privacy or records problem, consider a complaint to the U.S. Department of Health and Human Services Office for Civil Rights. If medical debt appears on your credit report, dispute that entry separately with the bureaus and the furnisher.
Driver's license and Social Security misuse
Contact your state's department of motor vehicles or identity-theft unit for instructions on correcting a license or driving record. There is no single nationwide DMV form; requirements vary by state.
Report suspected Social Security number misuse to the Social Security Administration Office of the Inspector General. An OIG report doesn't automatically correct a credit file or guarantee that the SSA will issue a new number, so continue the separate bureau and creditor disputes.
Child and synthetic identity theft
A parent or legal guardian can ask the three bureaus whether a minor has a credit file and request a protected-consumer freeze when appropriate. The FTC's freeze guidance includes information about freezing a child's credit. Be prepared to prove your identity and relationship to the child.
Synthetic identity theft combines a real Social Security number with invented names, addresses, or other details. List every incorrect identifier and account, explain which information is genuinely yours, and send the evidence to each affected bureau, creditor, and collection agency.
Identity theft dispute timeline
There is no single deadline for full recovery, because each company controls a different record.
| Approximate timing | What to do or expect |
|---|---|
| Same day | Secure accounts, notify banks and creditors, and place freezes or alerts |
| First few days | File the FTC report, obtain a police report if useful, and gather credit reports |
| Within four business days | A qualifying identity-theft block request is generally processed by a bureau after complete documentation arrives |
| About 30 days | A standard credit-report dispute usually receives an investigation result; some cases allow 45 days |
| Following weeks or months | Creditors, banks, the IRS, medical providers, and state agencies follow their own investigation and correction timelines |
| Ongoing | Review reports and account statements, follow up on unresolved items, and keep your evidence file current |
Count a bureau deadline from the date it receives a complete dispute, not from the day you first noticed the fraud. If a bureau asks for missing information, send it through the official channel and save proof.
FCRA rights and important limits
U.S. consumers generally have these protections under the Fair Credit Reporting Act:
- Free disputes. You can challenge information that is inaccurate, incomplete, or not yours.
- Investigation. A bureau generally must investigate a properly submitted dispute within 30 days, subject to limited extensions.
- Identity-theft block. You can request that qualifying information resulting from identity theft be blocked under Section 605B when you provide the required report, identification, and statement.
- Transaction records. Section 609(e) can let an identity theft victim request application and transaction records from a business. A written request typically needs proof of identity, an identity theft report, and a description of the records. Qualifying records requests generally must be answered within 30 days without charge.
- Free fraud alerts and freezes. Initial and extended alerts are free, and security freezes are free.
These rights don't require a bureau to remove an account that is accurate and belongs to you. They also don't decide whether a bank must refund a transfer or whether a medical provider must erase a record. Those questions follow the separate process for the account, payment method, tax agency, insurer, or provider involved.
Mistakes that slow recovery
Waiting for a police report before contacting banks or freezing credit is a common delay. So is disputing an item with only one bureau when all three reports show it, or sending a generic letter that never identifies the account.
Other problems: mailing original documents or a full Social Security number through an insecure channel; using an old bureau mailing address; assuming a credit freeze stops activity on an existing account; treating a fraud alert as a block on new credit; skipping notice to the creditor or payment provider; ignoring an IRS notice, collection letter, or court paper; and claiming a legitimate account is fraudulent instead of explaining the specific error.
Secure the affected account today, place freezes with Equifax, Experian, and TransUnion, save an FTC Identity Theft Report, and send a complete FCRA block request for every fraudulent credit-report entry.