If a credit account, collection, inquiry, charge, tax return, or medical bill isn't yours, don't rely on one blanket dispute. Secure your accounts first, document what happened, and send the right request to each company involved.
For U.S. consumers, the FTC report is mainly documentation and a recovery plan. A credit freeze helps stop new-account fraud. Credit bureaus handle credit-file information, while banks, card issuers, creditors, and the IRS follow separate processes.
What to do first
Take these steps as soon as you notice suspicious activity:
- Secure your email and financial accounts. Change passwords from a device you trust, use unique passwords and multifactor authentication, and sign out of unknown sessions. If your phone number may have been taken over, contact your mobile carrier.
- Contact the affected bank, card issuer, lender, or payment app. Use the number on a legitimate statement or the company's official website, not a number in a suspicious message. Ask for a fraud case number and instructions in writing.
- Place a credit freeze. A freeze can help prevent someone from opening new credit in your name.
- Save evidence. Keep statements, credit reports, account notices, emails, screenshots, dates, phone numbers, and case numbers.
- File an FTC identity theft report. Use IdentityTheft.gov to create a report and recovery plan.
Don't wait for a police report before freezing your credit or notifying a financial institution. A police report can help with some investigations, but it isn't a prerequisite for every recovery step.
File an FTC report and consider a police report
The FTC report records the details of the identity theft and gives you a recovery plan. Enter the facts carefully:
- The accounts, inquiries, charges, or documents you don't recognize
- When you first noticed the problem
- The companies involved
- Any contact you've already had with those companies
- The steps you've taken to secure your information
Save the completed report as a PDF and keep a printed copy. Use the same dates and account details in later disputes.
A local police report may be useful when a creditor, lender, bank, or law-enforcement agency requests one. Bring your identification, FTC report, account statements, and other evidence. Ask for the report or case number and keep copies of anything you submit.
The FTC report and police report support your claim; they don't automatically refund a charge, close an account, or remove information from every credit report.
Credit freeze or fraud alert: Which should you use?
Both are free, but they work differently.
| Feature | Credit freeze | Fraud alert |
|---|---|---|
| Main purpose | Restricts access to your credit report for most new-credit applications | Tells businesses to take extra steps to verify your identity |
| Where to place it | Separately with Equifax, Experian, and TransUnion | Contact one bureau; it should notify the other two |
| Duration | Stays until you lift or remove it | An initial alert lasts one year; an extended alert can last seven years for eligible identity theft victims |
| Existing accounts | Doesn't remove fraudulent accounts or stop account takeover | Doesn't remove fraudulent accounts or guarantee that new credit won't be opened |
| Best use | Stronger protection after personal information is exposed or misused | A useful warning when you expect to apply for credit or want verification steps |
Follow the FTC's instructions for credit freezes and fraud alerts to reach the official bureau websites. If you choose an extended alert, follow the bureau's instructions about submitting an FTC or police report and renewing the alert.
A freeze can remain in place after the dispute is finished. You can temporarily lift it when you apply for legitimate credit, then restore it afterward.
Find every fraudulent item on your credit reports
Get reports from all three nationwide credit bureaus through AnnualCreditReport.com. One bureau may show an account or inquiry that another doesn't.
Review each report for:
- New credit cards, loans, or collections
- Hard inquiries you don't recognize
- Incorrect balances or payment histories on accounts you do recognize
- New addresses, phone numbers, or employers
- Accounts that were closed but remain active
- Debt collectors reporting accounts you never opened
An unfamiliar address or inquiry can be a warning sign, but it isn't automatically proof of identity theft. Check whether an old address, legitimate credit application, or joint account explains it.
Create a list like this before sending disputes:
| Company | Account or inquiry | Bureau reporting it | Date noticed | Action and case number |
|---|---|---|---|---|
| [Company name] | [Last four digits] | [Equifax, Experian, or TransUnion] | [Date] | [Dispute submitted and reference number] |
Request an identity-theft block from each bureau
A routine accuracy dispute and an identity-theft block aren't the same request. If information on your report resulted from identity theft, clearly request an identity-theft block under FCRA Section 605B.
Send the request to every bureau that reports the fraudulent item. A qualifying request generally includes:
- A copy of your FTC identity theft report or another qualifying identity theft report
- Proof of your identity
- A clear list of each fraudulent account, collection, or inquiry
- A statement that you didn't open or authorize the listed item
- Your current contact information
- Copies of supporting records, such as a creditor notice or account statement
A properly documented identity-theft block request generally has a four-business-day federal deadline after the bureau receives the request and required materials. If the bureau processes it as an ordinary dispute instead, ask why in writing and keep that response.
A standard credit-report dispute has a separate investigation period that's generally 30 days, with some circumstances allowing more time. Don't assume that submitting a generic online dispute gives the bureau all the information needed for an identity-theft block.
Identity-theft block letter template
Use a separate letter or submission for each bureau. Replace the bracketed text and make only statements that are accurate.
Subject: Request to block information resulting from identity theft
[Your full name]
[Your current address]
[City, State ZIP]
[Date of birth]
[Last four digits of your SSN]
[Phone number and email]
[Date]
I'm requesting that you block information on my credit file that resulted from identity theft under FCRA Section 605B.
I didn't open or authorize the following account, collection, or inquiry:
- Company:
- Account or inquiry number:
- Date opened or reported:
- Amount, if applicable:
- Why I believe it resulted from identity theft:
Please block this information from my credit file and send written confirmation of the result. Please also send an updated copy of my credit report if available.
Enclosures:
- Copy of my FTC identity theft report or other qualifying report
- Copy of proof of identity
- Copy of proof of address, if requested
- Supporting account or credit-report records
Please contact me at [phone number or email] if additional information is needed.
Sincerely,
[Signature]
[Printed name]Send copies, not original documents. If you mail the request, use the bureau's current address and a trackable service. If you submit online, save the confirmation page, uploaded files, and reference number.
Dispute with the creditor or furnisher too
The company that supplied the information to a bureau is often called the furnisher. This may be a bank, card issuer, lender, collection agency, or other creditor.
Contact that company's fraud or identity-theft department separately. Ask it to:
- Investigate the account or transaction
- Secure or close an account that wasn't yours
- Stop sending collection communications while it reviews the claim, if its policy allows
- Correct information it furnished to the credit bureaus
- Confirm the result in writing
- Tell you where to send any additional documents
A bureau dispute may correct a credit report, but it doesn't necessarily close the creditor's account. Likewise, a bank's fraud investigation may not update every credit report automatically.
Creditor dispute letter template
Subject: Identity theft dispute for account [account number]
[Your full name]
[Your address]
[Date]
I'm disputing the account or transaction identified below because it resulted from identity theft. I didn't open, authorize, or use this account or charge.
Company:
Account or transaction number:
Date opened or posted:
Amount:
Related credit bureau entries, if known:
Please investigate this claim, secure or close any account that was opened fraudulently, and correct any information you furnished to consumer reporting companies. Please also explain in writing how collection activity and future reporting will be handled during and after your investigation.
Enclosed are copies of my FTC identity theft report, proof of identity, and supporting records. Please don't treat this letter as an admission that I owe the disputed debt.
Sincerely,
[Signature]
[Printed name]Don't send sensitive documents to an email address or website unless you've confirmed that it belongs to the company. Use the submission method listed on a statement, official website, or written notice.
Dispute fraudulent charges through the correct payment channel
Credit-report disputes don't reverse transactions. Notify the institution that handled the payment as soon as possible.
| Payment or account type | Next step |
|---|---|
| Credit card | Call the issuer, ask for its unauthorized-transaction or billing-error process, and send written notice through the address or channel specified on the statement. |
| Debit card or electronic bank transfer | Notify the bank or credit union immediately, report the unauthorized electronic transfer, and ask how to secure the account and document the claim. |
| ACH or recurring debit | Contact both the bank and the merchant or biller. Ask the bank about stopping future debits and the deadline for reporting the unauthorized transfer. |
| Wire transfer | Call the sending institution's fraud department immediately and request a recall or fraud review. Recovery isn't guaranteed, especially after funds have been withdrawn. |
| Payment app or peer-to-peer transfer | Report the transaction to the app and the linked bank at once. Account-takeover and authorized-transfer claims may follow different procedures. |
| Fraudulently opened account | Contact the lender or creditor's fraud department, provide the FTC report, and ask for written confirmation that the account is being investigated and secured. |
Credit-card billing rules, electronic-transfer rules, and provider contracts aren't interchangeable. The often-quoted deadline for a credit-card billing error shouldn't be applied automatically to a debit transfer, wire, or payment-app transaction. Report every transaction promptly and follow the provider's written instructions.
Handle tax, medical, and account-takeover identity theft separately
Tax identity theft
If someone used your information to file a federal tax return or you received an IRS notice about suspicious activity, follow the notice instructions. The IRS says you may complete Form 14039, Identity Theft Affidavit, online in some situations or on paper for mailing or faxing.
Keep a copy of the form, delivery confirmation, and any IRS notice. The IRS specifically warns that duplicate Forms 14039 can delay assistance. Its identity theft victim assistance guidance explains what to do if the IRS needs additional identity verification.
A credit freeze won't correct a fraudulent tax return, and an FTC report doesn't replace IRS verification.
Medical identity theft
Contact the provider and insurer through their official billing or fraud channels. Request an itemized bill and copies of records connected to the service, then dispute services you didn't receive in writing. Ask for written confirmation that the incorrect information was flagged and corrected.
Watch explanation-of-benefits notices as well as bills. Medical information and credit-report information are held by different organizations, so correcting one may not correct the other.
Existing account takeover
A credit freeze focuses on new credit. It won't secure an existing email, bank, card, phone, or payment-app account. Change the password, revoke unfamiliar devices and sessions, enable multifactor authentication, replace compromised cards, and ask the provider whether a new account number or other security step is needed.
Track the recovery without relying on a promised average
There's no single identity theft recovery timeline. A credit bureau, creditor, payment provider, and IRS case can all move at different speeds.
Use this schedule:
Immediately: Secure accounts, contact payment providers, and place freezes or alerts.
Within the first few days: File the FTC report, collect reports and evidence, and submit disputes.
After each submission: Save confirmation numbers, delivery records, uploaded documents, and the name of every representative.
When a bureau responds: Compare the updated report with your original copy. Confirm that each fraudulent item was addressed.
Ongoing: Review bank statements, credit reports, collection notices, tax correspondence, and medical bills. Keep the freeze in place unless you need to lift it for a legitimate application.
If a company gives you a deadline or promises a response, record it. If the deadline passes, follow up in writing rather than starting a duplicate claim that could create confusion.
What to do if a dispute is denied
A denial doesn't necessarily mean the matter is over. Read the response and identify whether the company says:
- The documentation was incomplete
- The account information matched its records
- The dispute was considered too vague
- The item wasn't reported by that company
- The company needs additional identity verification
Then take the matching step:
- Send a more specific request identifying each account and bureau entry.
- Add missing proof and explain why the information resulted from identity theft.
- Send the dispute directly to the furnisher if you only contacted a bureau.
- Request the investigation result and the documents or explanation supporting it.
- File a complaint with the Consumer Financial Protection Bureau if the problem involves a credit reporting company, creditor, bank, card issuer, or debt collector and the direct process hasn't resolved it.
- Consider a consumer-law attorney or legal-aid organization if the error continues, collection activity causes harm, or the financial loss is substantial.
The FTC collects identity theft reports and provides recovery tools, but it doesn't decide whether an individual creditor must refund a transaction or remove a credit entry.
Mistakes that slow identity theft recovery
Disputing an item with only one bureau when all three reports show it is one common error. Another is treating a fraud alert as a credit freeze. A freeze helps block new applications, but it doesn't remove accounts that already exist. Waiting for a police report before notifying a bank or card issuer adds delay. Sending original identification documents instead of copies creates risk. Using a phone number or link from a suspicious message can compromise the dispute.
Filing a generic accuracy dispute without identifying the identity-theft items may trigger the wrong procedure. A bank refund doesn't automatically fix credit reporting. Applying a credit-card deadline to a debit, ACH, wire, or payment-app claim can lead to missed deadlines. Sending duplicate IRS Forms 14039 slows down the process. Failing to keep the original report and written responses limits your ability to follow up.
Identity theft recovery checklist
- [ ] Secure email, bank, card, phone, and payment-app accounts.
- [ ] Contact every affected financial institution.
- [ ] Place a freeze with Equifax, Experian, and TransUnion, or add a fraud alert.
- [ ] File and save an FTC identity theft report.
- [ ] File a police report if requested or useful for the investigation.
- [ ] Download all three credit reports.
- [ ] List every fraudulent account, collection, and inquiry.
- [ ] Request an identity-theft block from each bureau reporting an item.
- [ ] Dispute the account directly with the creditor or furnisher.
- [ ] Report unauthorized transactions through the correct payment channel.
- [ ] Address tax or medical identity theft through the responsible agency or provider.
- [ ] Save documents, dates, names, and case numbers.
- [ ] Review reports and statements again after each investigation.
Common questions
Do I need a police report to dispute identity theft?
Not for every step. You can place a freeze, add a fraud alert, file an FTC report, and notify your financial institutions without waiting for a police report. A creditor or bureau may request one, and it can strengthen the documentation for some cases.
Will a credit freeze remove a fraudulent account?
No. A freeze helps restrict access to your credit report for new applications. It doesn't erase an existing account, reverse a charge, stop an account takeover, or correct a tax record. Those problems require separate disputes.
Should I dispute identity theft with the bureau or the creditor?
Do both when the fraudulent information appears on your credit report. Send the identity-theft block request to every bureau reporting the item and contact the creditor or furnisher that supplied the information.
How long does identity theft recovery take?
There isn't a reliable universal timeframe. A properly documented credit-report identity-theft block generally has a faster federal processing requirement than an ordinary dispute, while payment investigations and IRS cases follow different procedures. Track each case separately and follow up on missed deadlines.
What if the bureau says the account was verified?
Request the result in writing, compare it with your evidence, and submit a more specific identity-theft block request if the required information was missing. Dispute directly with the furnisher and consider a CFPB complaint if the reporting problem remains unresolved.