Identity theft disputes don't all follow the same process. A fake loan or credit card account on your credit report belongs with the credit bureau and the company that reported it. An unauthorized charge on a card you already hold belongs with the card issuer. Debit, ACH, wire, and peer-to-peer payments follow bank or app procedures. Tax returns and medical records sit outside that system and need their own contacts.

The letters below are drafts, not guarantees. Strip out details you don't need to share, attach evidence that actually matches the item, and keep a copy of everything you send.

Which identity theft dispute process applies?

Problem Contact first Main timing or rule
Fraudulent account or inquiry on a credit report The credit bureau and the lender or creditor A regular investigation generally takes 30 days, or up to 45 days in some situations. A qualifying identity-theft block request generally has a four-business-day deadline.
Unauthorized credit card charge The card issuer's billing-dispute department Written notice generally must reach the issuer within 60 days of the statement showing the error.
Unauthorized debit, ACH, or electronic transfer Your bank or payment provider Report it immediately. Notice deadlines and investigation procedures vary by payment type.
Fraudulent federal tax return The IRS and, when appropriate, the FTC Follow the IRS notice or current Form 14039 instructions. There is no single timeline for every case.
Medical treatment, insurance claim, or hospital bill you don't recognize The provider and health insurer Use the provider's privacy and billing process. Dispute any related credit-report entry separately.

For credit-report errors, compare the FTC's dispute guidance with USAGov's credit-report error instructions. For card and bank fraud, the Office of the Comptroller of the Currency's fraud guidance is the reason the first call should be to the institution, not a later paper trail.

First steps after discovering identity theft

Call the bank, card issuer, or other affected provider using the number on your card, statement, or the company's official website. Ask whether the account should be frozen, closed, or reissued. Don't wait for a police investigation before you report an unauthorized transaction.

Secure the email account tied to your finances before you change other passwords. Use a unique password, turn on multifactor authentication, and sign out unknown devices. If a phone, driver's license, or other identity document was stolen, contact the carrier or state agency that issued it.

File a report at IdentityTheft.gov and save the recovery plan it generates. That report can help explain the theft to creditors. A police report isn't required for every dispute, but it can matter when a creditor asks for one or when you need an identity-theft report with specific facts. Write down:

Cyber-related theft can also go to the Internet Crime Complaint Center at ic3.gov. That filing may help law enforcement spot patterns. It does not replace a dispute with the company that reported the account.

Pull reports from all three major credit reporting companies through AnnualCreditReport.com. Look for accounts, collections, addresses, names, and hard inquiries you don't recognize. Checking-account, utility, phone, and home-security fraud often never appear on a major credit file. Specialty reports such as ChexSystems or NCTUE may. Experian's identity-theft reporting checklist lists several of those providers.

An initial fraud alert generally lasts one year. An extended alert can last seven years if you have an identity-theft report. You only need to request an alert from one major bureau; it should notify the other two. A credit freeze is separate: it's free, you generally place it with each bureau yourself, and it can stay in place until you lift it. A freeze can block new creditors from opening your file. It won't delete an account already reported, and it won't stop someone from misusing a bank account you already have.

Evidence to include with a credit dispute

Build one packet for each bureau and each company that supplied the information. Send copies, not originals:

Use the account's last four digits. Don't put a full account number or Social Security number in the letter unless a current dispute form requires it, and then use the company's secure website or the mailing address listed for disputes.

Sample identity theft letter to a credit bureau

Use this version when an account or other information on your report came from identity theft. The letter asks for an identity-theft block under FCRA section 605B. That four-business-day clock applies to a qualifying block request with the required information. It is not the deadline for an ordinary dispute.

[Date]

[Credit reporting company]
[Current dispute address]

Re: Request to block identity-theft information under FCRA section 605B

I am disputing information on my credit report that resulted from identity theft. I did not open, authorize, use, or receive any benefit from the account listed below.

Furnisher: [Lender or creditor]
Account ending in: [Last four digits]
Date opened: [Date]
Balance or amount reported: [$Amount]
Reason the information is fraudulent: [Brief, specific explanation]

Please block and remove this information from my credit file under FCRA section 605B. Please also send me written confirmation of the action and an updated copy of my credit report.

Enclosures:
- Copy of my government-issued identification
- Proof of address
- Copy of my FTC Identity Theft Report or other qualifying report
- Police report, if available
- Credit report page identifying the disputed item
- Supporting statements or correspondence

If you determine that this request does not meet the requirements for an identity-theft block, please treat it as a specific dispute under FCRA section 611 and tell me what information is missing.

Sincerely,

[Your name]
[Mailing address]
[Phone number or email]

Send a copy to the lender or other furnisher. The bureau and the furnisher are separate parties. Disputing with only one does not necessarily notify the other.

Online filing is fine when the bureau will accept the documents you need to attach. Mail can make it easier to keep the exact packet and the delivery date. Use the company's current dispute address, not an address copied from an old template, and consider a trackable service.

A regular credit-report dispute is the 30-day investigation, which can stretch to 45 days in some cases, such as when you send more information later or the dispute is tied to a free credit report.

Sample letter for an unauthorized credit card charge

Billing disputes are not credit-report disputes. Write to the billing-inquiries address on the statement, which may not be the payment address. Call the issuer the same day so it can lock or replace the card.

[Date]

[Card issuer]
[Billing inquiries address shown on the statement]

Re: Unauthorized transactions and billing error
Account ending in: [Last four digits]

I did not make or authorize the following transactions:

Date: [Date]
Merchant: [Merchant]
Amount: [$Amount]

Date: [Date]
Merchant: [Merchant]
Amount: [$Amount]

Please investigate these transactions as billing errors, remove any unauthorized amount from my account, and send me the investigation result in writing. I have secured the account and can provide a police report, FTC Identity Theft Report, or other documents if needed.

Please contact me at [phone or email] if you need additional information.

Sincerely,

[Your name]
[Billing address]

Under the FTC's credit card billing-error guidance, written notice generally must reach the issuer within 60 days after the first statement containing the error was sent. The issuer generally must acknowledge the complaint within 30 days unless it has already resolved the matter, and resolve the dispute within 90 days.

Keep paying the undisputed portion. Save the statement, your letter, delivery confirmation, call records, and the issuer's response.

Debit, ACH, wire, and peer-to-peer payment disputes

Don't reuse the credit card letter for a bank transfer. Report a debit card charge, ACH debit, wire, or peer-to-peer payment through the bank or provider immediately, then ask what written notice it wants.

Name the payment rail when you call:

A payment you approved after a scam is not the same as a transfer someone else sent from a hijacked account. Don't assume a refund is required. Describe the facts accurately and ask which investigation procedure applies.

Worked identity theft dispute examples

These are fact-matching examples, not promises of a result and not reports of named victims.

A personal loan appears on a credit report

Someone finds a $3,200 personal loan opened in a state they've never lived in. The useful packet starts with the report page that shows the lender, account number, opening date, and balance, plus an FTC report and, if it helps, a police report. That packet goes to the bureau with the identity-theft block letter, and a similar dispute goes to the lender's fraud or credit-reporting department. Ask the lender to close the account, stop collection activity, and confirm what it reports to the bureaus.

If the bureau later says the lender verified the account, that still isn't proof the account is yours. Dispute the furnisher directly, request the bureau's investigation result, and point to mismatches such as a wrong address, signature, phone number, or application date.

Several unauthorized credit card charges appear on one statement

Call first, lock the card, change the online password, and send a billing-error notice to the billing-inquiries address. List each merchant, date, and amount instead of writing "all charges are fraudulent." Keep the rest of the balance current and record the date the issuer received the letter. This process does not delete information from a credit report.

A peer-to-peer transfer was sent to a scammer

The consumer approved the transfer after being persuaded to send it. That is different from an account takeover in which someone else logged in. Report the payment in the app and to the linked bank right away, ask for a recall or reversal, save the messages and recipient details, and file an identity-theft or fraud report if it fits. There is no universal promise that an authorized scam payment will be refunded.

Someone filed a federal tax return using the consumer's information

This is not a credit-report dispute. Follow the IRS notice you received and read the current instructions for Form 14039 before you file it. If the notice asks you to verify your identity, complete that process instead of automatically sending a separate affidavit.

An IRS Identity Protection PIN can help stop a future federal return from being filed with your Social Security number or ITIN. It does not, by itself, unwind a return already filed. IRS cases don't share one reliable resolution time, so keep the notice, submission date, confirmation number, and every reply.

A hospital bill follows treatment the consumer never received

Contact the provider's privacy and billing offices, ask for the records and claim details attached to the bill, and put in writing that the treatment wasn't yours. Notify the health insurer's fraud department and include an FTC or police report if they ask. If the bill went to collections or landed on a credit report, dispute that reporting with the collector, the furnisher, and the credit bureau. The hospital's internal review does not automatically correct a credit file.

What to do after a denial

Read the reason and answer that reason, not a broader complaint:

If the item still isn't fixed, keep the investigation results and delivery records. USAGov identifies a complaint route, and you can also contact your state attorney general or financial regulator, or ask a qualified consumer-law professional about further options. A regulator complaint creates an escalation record. It does not guarantee removal.

For a bank dispute, finish the institution's internal appeal first, then identify the bank's regulator if the response is incomplete. For a tax case that is stalled or creating serious hardship, follow the IRS escalation instructions and consider whether the Taxpayer Advocate Service fits.

Common mistakes to avoid

People often mail a credit-report dispute to a bank, treat a debit or peer-to-peer payment like a credit card billing error, or wait for a police report before notifying the issuer. Other frequent misses: sending the letter to the payment address instead of billing inquiries, putting a full Social Security number or original ID in the envelope, and writing a vague line such as "this entire report is fraud."

An FTC report documents the theft. It does not automatically delete an account. Advertised success rates and guaranteed timelines aren't a substitute for specific evidence and the right process. Don't dispute accurate information, and don't invent facts to make a weaker claim look stronger.

There is no dependable universal success rate. What the item is, how fast you gave notice, which payment rail was used, and whether the creditor can verify the account all affect the outcome.

Identity theft dispute FAQ

Do I need a police report to dispute an identity theft account?

Not for every dispute. A police report can strengthen the record and a creditor may request one. A qualifying identity-theft block request also requires the documents specified by the FCRA, including an identity-theft report and proof of identity.

How long does a credit bureau identity theft dispute take?

A regular investigation generally takes 30 days, with some cases extending to 45 days. A qualifying request to block identity-theft information generally has a four-business-day deadline after the bureau receives the required materials. Those are different processes.

Will an FTC report remove a fraudulent account?

No. It helps document the theft, but you still need to dispute the credit entry with the bureau and the company that supplied it. For a card, bank, tax, or medical problem, send the report to the organization handling that problem.

Can I dispute a hospital bill on my credit report?

Yes, but use two tracks. Ask the provider and insurer to investigate the treatment or claim, then dispute any inaccurate collection or credit-report entry with the relevant furnisher and credit bureau.

What should I do if a company says the account was verified?

Ask for the investigation result, compare it with your evidence, and dispute the item directly with the furnisher. If the information is still inaccurate, keep the records and use an appropriate regulator or professional escalation route.

If a fake account is already on your report, save that page, file the IdentityTheft.gov report, and send the bureau packet with a copy to the furnisher. If the problem is a card charge or bank transfer, call the number on the statement first, then follow with written notice to the correct address.