Identity theft disputes depend on what was used and which record needs correction. For a U.S. consumer, stop any ongoing loss first, notify the bank or business involved, file an FTC identity theft report, protect your credit files, and send written disputes to each credit bureau and the company that supplied the information.
A credit freeze won't reverse an unauthorized bank transfer. An FTC report won't automatically delete a credit account. The Fair Credit Reporting Act (FCRA), Regulation E, credit-card billing rules, and IRS procedures govern different parts of the recovery process.
This is general consumer information, not legal advice.
What to do in the first 24 hours
1. Stop further access and preserve evidence
Contact the bank, card issuer, lender, or service provider using the phone number on a statement, card, or official website. Don't use a number from an unexpected email or text.
Ask the company to:
- Lock or close the affected account.
- Replace a compromised card or account number.
- Stop unauthorized recurring payments or transfers.
- Explain whether it needs a written fraud claim.
- Give you a case number and the deadline for supporting documents.
Change passwords from a trusted device, starting with your email account. Use unique passwords and multifactor authentication. If your phone number may have been taken over, contact your mobile carrier about an unauthorized SIM change or port.
Save statements, transaction alerts, emails, letters, account numbers, screenshots, and delivery confirmations. For each contact, record the date, time, department, representative, and case number.
2. Create an FTC identity theft report
Report the theft at IdentityTheft.gov. The FTC tool creates a recovery plan and an identity theft report that can support requests to creditors, credit bureaus, and other businesses.
The report documents the theft, but it doesn't itself remove an account or reimburse a loss. You still need to notify every affected company.
A police report isn't required for every initial credit dispute. It can help when a company requests additional proof, when you need transaction records, or when you want an extended fraud alert. If you make a report, ask for a copy and the report number.
3. Protect your credit files
You can place a free security freeze with each of the three nationwide credit bureaus. A freeze generally prevents prospective creditors from accessing your file, but you must place it separately with Equifax, Experian, and TransUnion. Use the official contact information on each bureau's website or on your credit report.
You can also place a fraud alert. A fraud alert placed with one bureau generally notifies the other two.
| Protection | Duration | What it does | Main limitation |
|---|---|---|---|
| Initial fraud alert | 1 year | Asks businesses to take reasonable steps to verify your identity before opening new credit | It doesn't block access to your file |
| Extended fraud alert | 7 years | Provides longer notice to businesses reviewing your credit | You generally need an identity theft report and identity verification |
| Security freeze | Until you lift it | Blocks most prospective creditors from accessing the frozen file | It doesn't stop account takeover, existing creditors, or every type of account opening |
A freeze is different from a voluntary credit-lock product, which can have its own terms. Look for the statutory freeze option offered by each bureau. A freeze also won't remove inaccurate information, so dispute fraudulent entries separately.
How to dispute identity theft on your credit report
Step 1: Get all three reports
Request your reports from AnnualCreditReport.com, the federally authorized source. If the website says it isn't available where you are, the FTC's free-credit-report instructions explain alternative request methods, including mail.
Check every report for:
- Accounts you never opened.
- Hard inquiries you didn't authorize.
- Collections linked to fraudulent accounts.
- Incorrect balances or payment histories.
- New addresses, employers, or phone numbers.
- Legitimate accounts that now show unauthorized activity.
One bureau's correction won't necessarily update the other two. Send a separate dispute to every bureau that reports the item.
Step 2: Send a written dispute to the bureau and the furnisher
The credit bureau is the company that publishes the report. The furnisher is the lender, creditor, collector, or other business that supplied the information.
Dispute with both when possible. Use the bureau's online portal or the dispute mailing address printed on your report. For a mailed dispute, use a trackable delivery method and keep the complete package.
Include:
- Your full name, current address, and identifying information requested by the bureau.
- The report page with the fraudulent item clearly marked.
- The account name and partial account number.
- A short statement that you didn't open, use, or authorize the account.
- A copy of your FTC report and police report when available or required.
- A copy of identification or proof of address if requested.
- The result you want, such as deletion or an identity-theft block.
Don't send original identification documents. Leave out unrelated financial records and lengthy explanations that make the disputed item difficult to identify.
Step 3: Ask whether an identity-theft block applies
An ordinary dispute asks the bureau to investigate inaccurate information. An identity-theft block is a separate request under FCRA Section 605B for information that resulted from identity theft.
A qualifying request generally identifies the item, includes proof of identity, provides an identity theft report, and states that the information doesn't relate to a transaction you made or authorized. Federal law generally requires a bureau to block qualifying information within four business days after receiving the required materials.
The bureau can ask for more information or decline a request that doesn't meet the requirements. Follow the bureau's current instructions about the type of identity theft report or other documents it accepts.
Sample credit-report dispute wording
Subject: Identity-theft dispute and request to block information
I am disputing the following item on my credit report:
Company:
Account or inquiry:
Date shown on report:
I did not open, use, or authorize this account or inquiry. It resulted from identity theft. Please investigate the item and delete it or block it from my credit report under the Fair Credit Reporting Act.
Enclosed are copies of my identification, the relevant report page, and my identity theft documentation. Please send me the written results of your investigation.
Sincerely,
[Name]
[Address]
[Date]Use a separate notice for unauthorized charges to a bank or card issuer. A credit-report dispute doesn't automatically resolve the underlying transaction.
How long does a credit dispute take?
A credit bureau generally has 30 days to investigate a dispute. The period can extend to 45 days in some circumstances, including when additional relevant information is supplied during the investigation.
The bureau should send you the result and an updated report when a change is made. Keep the result even if the item is deleted because the information can reappear later.
If the bureau says the information was verified:
- Check whether the same item appears on another bureau's report.
- Send new evidence and a more precise explanation to the bureau and furnisher.
- Ask the bureau for a description of the procedure it used to verify the information.
- File a complaint with the Consumer Financial Protection Bureau after you've disputed the item and can show what you sent.
If you submitted the documents needed for an identity-theft block, state clearly that you are requesting a Section 605B block, not only an ordinary investigation.
A police report doesn't force a bureau to delete information that is accurate and doesn't result from identity theft. The goal is to remove or block fraudulent or inaccurate information, not legitimate debts.
Request records from the business that opened the account
FCRA Section 609(e) may allow an identity theft victim to obtain application and transaction records from a business that extended credit or maintained the account.
Have these materials ready:
- Proof of your identity.
- An identity theft report.
- A police report if the business requests one.
- Details identifying the account or transaction.
For a qualifying written request, the business generally must provide the records within 30 days. It may redact information belonging to another person.
Ask for records such as the application, delivery address, phone number, email address, device information, transaction history, and documents used to verify the applicant. These records can help show that someone else opened the account and may assist law enforcement.
Bank account, debit card, and credit card fraud
The payment method controls the next step. A credit-report dispute isn't a substitute for notifying the bank or card issuer.
| Payment method | What to do | Important timing |
|---|---|---|
| Debit card or electronic transfer from a bank account | Notify the bank immediately and ask for its written fraud procedure | If an access device was lost or stolen, notice within two business days generally limits liability to $50 or less. If an unauthorized transfer appears on a statement, report it within 60 days after the statement was sent or later transfers may not be protected |
| Credit card | Call the issuer and send a written billing-error notice to the address for billing inquiries | Send the written notice within 60 days after the statement showing the charge was sent. Federal law generally limits liability for unauthorized use to $50, although issuer policies may provide stronger protection |
| Wire transfer, payment app, or money transfer | Contact the provider and your bank immediately and request a recall or fraud review | Protections vary by service and by whether you authorized the transfer, even if a scammer persuaded you to make it |
For an unauthorized electronic fund transfer, Regulation E generally allows the bank 10 business days to investigate after receiving notice. Longer periods may apply when the bank provides provisional credit or an exception applies. Ask whether the bank requires written confirmation after a phone report.
For a credit-card billing error, send the notice to the billing-inquiries address, not the payment address. Pay undisputed amounts on time while the issuer reviews the charge.
Tell the bank exactly what happened. A transaction you didn't make is different from a transfer you personally approved after being deceived, and the available protections can differ.
Tax identity theft and IRS Form 14039
Tax identity theft may occur when someone files a federal tax return using your Social Security number or employer identification information.
If the IRS sends an identity-verification notice, follow the instructions in that notice. Don't automatically send Form 14039 in response to a verification letter unless the IRS tells you to do so.
If your electronic return was rejected because a return was already filed, or if the IRS identity theft guidance directs you to use the form, complete Form 14039, Identity Theft Affidavit and follow the form's current filing instructions. Keep a copy of the return, the form, and all IRS correspondence.
Also consider:
- Contacting your state tax agency if state tax fraud may have occurred.
- Responding promptly to IRS identity-verification letters.
- Enrolling in an IRS Identity Protection PIN through the IRS IP PIN program.
- Keeping tax records separate from ordinary credit-dispute documents.
IRS processing times depend on the type of case and the notice you received. Don't rely on a fixed 120- or 180-day promise.
Medical, synthetic, and other forms of identity theft
Medical identity theft
Contact the provider, health plan, and billing department connected to the fraudulent treatment or claim. Ask for:
- Copies of the relevant medical and billing records.
- A written correction or amendment to the record.
- Confirmation that future claims won't be tied to your patient file.
- An explanation of any collection account reported in your name.
Under HIPAA, a covered provider or health plan generally must act on a request to amend a record within 60 days, with a possible 30-day extension in some cases. It doesn't necessarily have to erase a record it believes is accurate, but you may be able to add a statement of disagreement. The U.S. Department of Health and Human Services medical-records guidance explains access and amendment rights.
If a related medical collection appears on your credit report, dispute that entry separately with the credit bureaus and the collection company.
Synthetic identity theft
Synthetic identity theft combines real information, such as a Social Security number, with a fake name, address, or date of birth. It can be harder to recognize because some parts of the file may be yours.
List each identity element that is accurate and each one that is fraudulent. Send that information to the bureaus and furnishers, request blocks for fraudulent accounts, and don't dispute legitimate accounts merely because they are associated with a mixed file.
Benefits, employment, or utility fraud
If someone used your information for unemployment benefits, Social Security, employment, utilities, or another service, contact the agency or provider named in the notice. Ask for a case number, written confirmation of the fraud report, and instructions for correcting its records.
Keep a recovery file and follow up
Use one log for every dispute:
| Date | Company or agency | Contact and case number | Documents sent | Next deadline | Result |
|---|
Save the original letter, envelope, email confirmation, uploaded documents, tracking number, and response. A clear record helps when different companies give you different instructions.
If a credit bureau or furnisher misses the applicable deadline or doesn't correct a documented error, submit a complaint through the CFPB complaint portal. Attach the original dispute, proof of delivery, the response, and the specific correction you want.
For a bank, follow its formal complaint process. If the response remains incomplete, identify the bank's federal or state regulator. An FTC report can document the theft, but the FTC doesn't itself order a bank or bureau to reverse an individual account.
Consider legal aid or a consumer attorney if the theft affects housing, employment, benefits, or a large financial loss, or if a company continues reporting an account after receiving complete identity-theft documentation.
After the fraudulent information is removed
Keep the credit freeze in place until you no longer need the extra protection. If you lift it for an application, use a temporary lift or a specific bureau PIN when available.
Continue to:
- Review all three credit reports periodically.
- Check bank and card statements for new activity.
- Remove unfamiliar email recovery addresses and phone numbers.
- Use unique passwords and multifactor authentication.
- Keep an IRS IP PIN if tax identity theft occurred.
- Watch for new collection letters, account-opening notices, or verification requests.
Don't pay a company that promises to erase accurate information or tells you to create a false police report. Start with the affected company, the FTC report, the statutory credit freeze, and written disputes supported by documents.
Frequently asked questions
Do I need a police report to dispute an identity-theft account?
Not always. You can begin an ordinary dispute without one. An extended fraud alert and a Section 605B block require identity-theft documentation, and a business may ask for a police report when you request account records.
Should I use a fraud alert or a security freeze?
Use a fraud alert when you want lenders to take extra verification steps. Use a freeze when you want to block most new-credit inquiries. A freeze is usually the stronger choice after confirmed new-account fraud, but it won't stop existing-account takeover or bank-transfer fraud.
What if the bureau says the account was verified?
Ask for the investigation result and the procedure used to verify the item. Send precise new evidence to the bureau and furnisher, then submit a CFPB complaint with proof that you already disputed the information.
How long will identity theft recovery take?
Credit investigations generally take 30 days, with some disputes taking up to 45 days. Bank, medical, and IRS matters follow different procedures and may take longer. The notice date, payment method, and documents you provide can affect the result.
Will an FTC report get my money back?
No. It creates a recovery plan and useful documentation. Refunds, reversals, and account corrections must be requested from the bank, card issuer, creditor, provider, or agency that controls the disputed transaction. Save the report and send it with your written request to that institution.