Identity theft rarely creates just one problem. A fake credit-card account, an unauthorized debit, and a fraudulent federal tax return each follow a different process.
Contain the damage first. Lock down active accounts, report the theft to the FTC, and check every credit bureau and company record where the false information appears. When you provide all required materials, FCRA Section 605B generally requires a bureau to block the identified identity-theft information no later than four business days after receipt. An ordinary credit-report dispute generally takes up to 30 days, or up to 45 days in certain cases.
These steps are for U.S. consumers. They aren't legal advice.
Start with the first day
Start with the accounts and deadlines you can control. Paperwork can follow.
- Secure active accounts. Call your bank, card issuer, lender, or payment app using a trusted phone number. Lock affected cards, change passwords, sign out other sessions, and turn on multifactor authentication.
- Create an FTC report. Use IdentityTheft.gov and save the report number, completed report, and recovery plan. It documents the theft. It doesn't by itself remove a credit entry.
- Add a fraud alert or freeze. You can place an initial fraud alert with one credit bureau. It lasts one year, and that bureau should notify the other two. A security freeze restricts access for most new-credit applications, but you must request it separately from Equifax, Experian, and TransUnion.
- Review your credit reports. Get current reports through AnnualCreditReport.com. Record the creditor, account number, balance, date opened, and every bureau showing the item.
- Contact the company behind the item. Ask its fraud department to close or flag the account and tell you which documents it needs. Keep the case number.
- Handle tax fraud separately. A fraudulent federal return or an IRS notice belongs in the IRS process, not a credit bureau dispute.
File a police report if a crime is ongoing, someone faces a safety risk, or a company specifically asks for one. You can freeze credit and notify a bank before that report is available.
The credit-report rules that matter
Turns out, a normal dispute isn't always the strongest credit-file remedy. The cause of the entry determines which request fits.
| Situation | Main rule or tool | What to request | Usual timing |
|---|---|---|---|
| A fraudulent account or transaction caused by identity theft | FCRA Section 605B | A block of the identified information | No later than four business days after the bureau receives the required materials |
| Ordinary inaccurate or incomplete information | FCRA Section 611 | An investigation and correction or deletion of information that cannot be verified | Generally 30 days; certain cases can take up to 45 days |
| Initial fraud alert | FCRA fraud-alert provisions | A notice telling potential creditors to verify your identity | One year |
| Extended fraud alert | FCRA fraud-alert provisions | A longer alert after providing an identity theft report | Seven years |
| Security freeze | Federal and state freeze rules | Restrict access for most new-credit applications | No investigation deadline; keep it active until you lift it |
A Section 605B packet needs four core pieces: proof of identity, an identity theft report, a clear description of each fraudulent item, and a statement that the item did not result from a transaction you made. An FTC identity theft report can qualify for this purpose.
A police report isn't required for every request. The bureau may ask for information that confirms your identity or clarifies the disputed item. It may decline the request or remove a block if required information is missing or the request appears false.
Each tool has a separate job. The FTC report documents the theft, a freeze restricts most new-credit access, and a bureau request addresses the credit file. None of them automatically refunds a bank account or corrects an IRS return.
Federal law sets the baseline. State law may add protections involving freezes, breach notices, government records, or identity theft reports. Check the rule where you live before relying on a deadline from another state.
Send a focused credit dispute
Send the request to every bureau that displays the item. Online filing gives you a confirmation number; a mailed packet gives you a physical record of what you sent.
Use copies, not originals. Follow each bureau's current instructions and provide only the personal information it requests.
Identity theft block letter template
Subject: Request to block identity-theft information under FCRA Section 605B
Name:
Current address:
Date of birth:
Last four digits of Social Security number:
Date:
I am requesting a block under FCRA Section 605B for the following information:
Furnisher:
Account number or last four digits:
Date shown on my credit report:
Bureau report page or reference number:
I did not open, authorize, or benefit from this account or transaction. The information resulted from identity theft.
Please block this information from my consumer report and send written results. If this request is missing a required document, please identify what is missing.
Enclosures:
Identity theft report
Proof of identity
Proof of address, if requested
Credit report page identifying the fraudulent item
Signature:
Use a different request for an ordinary accuracy dispute. Name the account, explain exactly what is wrong, and ask the bureau to investigate and correct or delete information that is inaccurate, incomplete, or unverifiable. "My report is wrong" is too vague.
A mailed packet usually needs the relevant report page, not the entire file. Follow the bureau's current mailing instructions and use trackable delivery. Save the receipt, packet, upload confirmation, and every response.
Contact the creditor or furnisher too
A credit bureau can't close a bank account, reverse a charge, or change the creditor's internal records. Contact the company that supplied the information as well.
Ask that company to flag the account as identity theft, correct its records, and confirm the result in writing. If collection activity is involved, ask whether it will pause that activity while the fraud investigation is pending. Send the same identity theft documents to a debt collector and keep proof of delivery.
Synthetic identity cases get messy. An account may use your real name, address, or Social Security number alongside invented details. Point out each detail that belongs to you, then state clearly that you didn't open or benefit from the account.
Bank, debit card, credit card, and payment-app fraud
Thing is, the payment rail controls the deadline and the possible remedy. A credit-file dispute doesn't replace prompt notice to the bank.
| Payment problem | First contact | What controls the next step |
|---|---|---|
| Unauthorized debit card, ATM, ACH, or other covered electronic transfer | Bank or credit union | Regulation E may apply |
| Unauthorized credit-card charge | Card issuer | The issuer's unauthorized-use and billing-error process |
| Wire transfer fraud | Bank's wire-fraud team | The bank's wire rules and the facts of the transfer |
| Payment-app transfer | App provider and linked bank | How the payment was authorized, processed, and reported |
Notify the bank immediately. For a covered electronic transfer, the 60-day period after the statement first showing the transaction generally matters.
If a debit card or other access device was lost or stolen, reporting the loss within two business days can limit liability to $50. Reporting later, but within 60 days after the statement first showing the transaction, can raise liability to as much as $500.
For a covered dispute, the bank generally has 10 business days to investigate after receiving notice. It may provide provisional credit and take longer when the rule allows that approach. If it asks you to confirm an oral report in writing, meet the stated deadline.
An authorized payment can be harder to recover. If you approved a transfer yourself after someone deceived you, the transaction may not count as an unauthorized electronic fund transfer. Report it anyway, preserve the messages, and ask the provider which fraud process applies.
Call first. Write it down right after. Do both.
Tax identity theft follows a separate process
Tax identity theft follows the IRS process. A credit bureau's 30-day investigation period doesn't control the IRS.
If someone used your personal information to file a fraudulent federal tax return, review the IRS guidance on when to file Form 14039, Identity Theft Affidavit. The IRS says eligible taxpayers may complete Form 14039 online or use the paper form, then print and mail or fax it according to the instructions.
Follow the exact directions on any IRS notice. Letters such as 5071C, 5747C, and 4883C may require identity verification. A 5747C notice may direct you to verify your identity in person at a Taxpayer Assistance Center.
Keep the notice, tax return, wage documents, identity records, submission confirmation, and IRS correspondence together. Ask the IRS whether an Identity Protection PIN fits your situation.
A credit bureau packet won't handle a tax case. Use the IRS process.
Medical, employment, license, and account-takeover records
Credit reports aren't the only records identity thieves can affect. Start with the organization that created or controls the record.
| Problem | Contact first | Useful request or evidence |
|---|---|---|
| Medical identity theft | Provider's billing or privacy office and health plan | Itemized bills, medical records, explanation of benefits, and a request to correct inaccurate records |
| Employment background information | Screening company and employer | The report, the disputed entries, and the screening company's dispute instructions |
| Driver's license misuse | State DMV fraud unit | License records, identity documents, and any theft report |
| Social Security or benefit misuse | Agency named in the notice | The notice, account records, and the agency's fraud procedure |
| Account takeover | Bank, website, or app | Login alerts, device details, password-reset records, and unauthorized activity |
For medical records, ask how to request an amendment through the provider's process. A correction won't automatically erase a bill, so check any collection account separately.
For an employment screening problem, identify the exact entry that is wrong. A complaint sent only to the employer may never reach the company that supplied the report.
Track deadlines and escalate carefully
To be honest, one log can do the job. Record the date, company, disputed item, confirmation number, documents sent, response deadline, and next action.
For a Section 605B request, count four business days from the bureau's receipt of all required materials. If the bureau says something is missing, ask for that explanation in writing. For an ordinary dispute, mark the 30-day deadline and the possible 45-day extension.
Ask for investigation results in writing. If the bureau changes the entry, request a new report or written confirmation showing the correction. If it says the information was verified, ask which information was verified and review the furnisher's response.
For credit reporting, banks, lenders, and many debt-collection problems, you can use the CFPB complaint portal. A complaint creates an escalation record. It isn't a court order, and it doesn't cover every identity theft issue.
Use the IRS notice process for tax identity theft. Use the state DMV or the relevant agency for government records. If a creditor or collector threatens a lawsuit, or the fraud has caused serious financial loss, consider speaking with a licensed attorney or legal aid office.
The FTC report is useful documentation. It won't repair every account by itself.
Mistakes that slow disputes
Incomplete requests and missed deadlines create avoidable delays.
- Sending a vague statement without naming the account or transaction.
- Disputing with only one bureau when the item appears on all three.
- Waiting for a police report before freezing credit or notifying a bank.
- Sending original identity documents or a full Social Security number by ordinary email.
- Missing the bank's statement deadline while focusing only on the credit report.
- Treating a freeze, FTC report, or fraud alert as a refund request.
Common questions
Do I need a police report to dispute identity theft?
No, not for every first step. You can create an FTC report and contact companies without waiting for police paperwork. A police report may help when a creditor requests one or when the case requires a formal law-enforcement record.
Is an identity theft block the same as a normal credit dispute?
No. A normal dispute asks the bureau to investigate inaccurate information. A Section 605B request asks the bureau to block information tied to identity theft after you provide the required documents.
Will a credit freeze remove a fraudulent account?
No. A freeze limits access for most new-credit applications. It doesn't erase an existing account, correct a credit report, or stop activity on an account that was already opened.
What if the bureau says the account was verified?
Request the investigation result and review the furnisher's information. Send focused evidence addressing that specific account. If the response remains unsupported or incomplete, consider a CFPB complaint.
Does Form 14039 fix credit-report fraud?
No. Form 14039 is for suspected tax-related identity theft. Use the FTC, credit bureau, creditor, and bank processes for non-tax fraud.
Your next move
Pull current credit reports from AnnualCreditReport.com and mark each fraudulent item. Create your FTC report, place the alerts or freezes you need, and send a documented Section 605B request to every bureau showing the item.
Call the creditor or bank separately. Keep every confirmation number in one file.