If an unfamiliar transaction appears, identify the payment rail before you write. A credit-card purchase, an ACH debit, and a new collection account may all look like fraud, but they follow different notice rules and often go to different departments. A generic email sent to everyone can miss both the right address and the relevant deadline.

The templates below are editable examples for U.S. consumers. They aren't government forms or legal advice. Email may work for a bank or creditor, but a credit bureau may require its official dispute portal or a mailed request. For a credit-card billing error, the billing-inquiry address on the statement matters.

Match the notice to the problem

For credit-report errors, see the FTC's guidance on disputing credit report errors. The FTC's credit freeze and fraud alert guidance explains how those two protections differ.

Before you send anything

1. Secure the affected account. Call the number on the back of the card or on a statement. Ask the institution to lock or replace the card, secure online access, and stop recurring debits when appropriate.
2. Create an FTC identity theft report. File at IdentityTheft.gov and save the report number and downloaded documents. Older paperwork may call this an identity theft affidavit.
3. Review all three credit reports. Use AnnualCreditReport.com, the official source for free credit reports. List each unfamiliar account, inquiry, collection, and address.
4. Consider a police report. A creditor may ask for one, and it can be used for an extended fraud alert. It isn't automatically required for every credit-report block request.
5. Freeze your credit. A security freeze is free, but you must place it separately with each bureau. It generally stays in place until you ask the bureaus to lift it.
6. Keep an evidence file. Save statements, report pages, emails, confirmation numbers, delivery records, and a call timeline. Redact unrelated account numbers and personal information from copies.

Sending the notice safely

• Use the bank's secure message center or the contact method printed on your statement whenever possible.
• Don't send your full Social Security number, online-banking password, card security code, or an unredacted statement through ordinary email. Use the last four digits unless a verified secure upload requests more.
• Attach clear copies, not originals. A filename such as FTC-report-bank-2026-03-10.pdf makes the file easier to identify.
• If ordinary email isn't accepted, ask the recipient for the correct department, mailing address, or secure-upload method.
• Send a separate dispute to every bureau listing the inaccurate item. One bureau's correction doesn't automatically update the other two.
• For a credit-card billing dispute, use the billing-inquiry address on the statement. A message sent only to a general fraud inbox may not satisfy the written-notice process.

Editable dispute templates

Replace the bracketed text and delete sections that don't apply. Keep a complete copy of every request and its attachments.

1. Credit-card charge you didn't make

Send this to the billing-inquiry address printed on the statement. You can also report the transaction through the issuer's separate fraud channel.

Subject: Written billing-error notice: unauthorized charge on [date]

[Date]

To: [Card issuer and billing-inquiry department]
Account ending in: [last four digits]

I am writing to dispute a transaction on my credit-card account. I did not make or authorize this charge.

Transaction details:
- Merchant:
- Amount:
- Transaction date:
- Statement date on which it first appeared:
- Transaction or reference number:

Please treat this letter as written notice of a billing error under the Fair Credit Billing Act. Investigate the transaction, provide any credit or correction required, and send me the result in writing. I will continue paying amounts that are not in dispute while the review is pending.

Attached or enclosed:
- [Statement with the charge marked]
- [FTC identity theft report number, if applicable]
- [Police report number, if available]
- [Other relevant evidence]

Please send correspondence to:

[Your full name]
[Mailing address]
[Phone number]
[Email address]

Sincerely,

[Your full name]

The written notice generally must reach the issuer within 60 days after the statement showing the error was sent. The issuer's payment address may not be the billing-inquiry address, so check the statement. If you email the notice and the issuer's instructions call for mail or a secure upload, use that channel too.

2. Debit-card or ACH transaction

Report an unauthorized electronic transfer immediately. A statement-based 60-day period can affect protections for some transactions, so don't wait for the bank to finish investigating before you report it.

Subject: Notice of unauthorized electronic transfer on [date]

[Date]

To: [Bank or credit union fraud and error-resolution department]
Account ending in: [last four digits]

I am reporting an unauthorized electronic transfer from my account. I did not authorize this transaction.

Transaction details:
- Type: [debit-card purchase, ACH debit, ATM withdrawal, or other]
- Amount:
- Date:
- Merchant or recipient:
- Statement date on which it appeared:
- Transaction or reference number:

Please secure the account and investigate this as an unauthorized electronic transfer under the applicable rules. Provide any credit, correction, or other remedy required. Confirm the date you received this notice and tell me whether you require a phone report, a particular form, written confirmation, or additional information.

Attached or enclosed:
- [Statement with the transaction marked]
- [FTC identity theft report number, if applicable]
- [Police report number, if available]
- [Other evidence]

Please send the investigation result in writing to:

[Your full name]
[Mailing address]
[Phone number]
[Email address]

Sincerely,

[Your full name]

Credit-card billing rules don't automatically apply to debit cards, ACH payments, wires, checks, or peer-to-peer payments. If the money moved through a different payment rail, ask the provider which error process and deadline apply.

3. Identity-theft block request to a credit bureau

Use this for an account, collection, or inquiry on a credit report that resulted from identity theft. Send a separate request to each bureau that lists the item, using its current official portal or mailing instructions.

Under FCRA section 605B, also known as 15 U.S.C. section 1681c-2, a bureau generally must block qualifying information within four business days after receiving a complete request and the required documents.

Subject: Request to block identity-theft information under FCRA section 605B

[Date]

To: [Experian, Equifax, or TransUnion]
Via: [Official online dispute portal or mailing address]

I request a block under FCRA section 605B for the following information on my consumer report:

- Furnisher or company:
- Account or inquiry:
- Account number, last four digits only:
- Date opened or reported:
- Amount, if applicable:
- Page or section of my credit report:

The information identified above resulted from identity theft. I did not open, authorize, or make the account, inquiry, or transaction associated with it. It is not related to a transaction that I made or authorized.

Please treat this as an identity-theft block request, not only as a general accuracy dispute. Confirm receipt and tell me promptly if anything is missing. Please confirm when each item has been blocked and, if you decline or later remove a block, explain the reason in writing.

Attached:
1. My FTC identity theft report, report number [number]
2. Proof of identity and address through your requested secure process
3. Credit-report pages with the items marked
4. [Police report, if available or requested]
5. [Other evidence]

Sincerely,

[Your full name]
[Mailing address]
[Date of birth, if requested through a secure channel]
[Phone number]
[Email address]

A complete request normally identifies the fraudulent information, includes an identity theft report, and states that the information isn't connected to a transaction you made or authorized. A police report can be useful, but don't assume it is a universal requirement for a section 605B request. Never mail original identification documents.

4. Ordinary credit-report dispute under FCRA section 611

This is the better fit when the information is inaccurate for a reason other than identity theft, or when you need to challenge an item after a bureau says it can't process the block request.

Subject: Dispute of inaccurate information on my credit report

[Date]

To: [Credit bureau]
Report confirmation number: [number, if available]

I dispute the following information on my credit report:

- Furnisher or company:
- Account or inquiry:
- Account number, last four digits:
- Information currently reported:
- Correct information:
- Why the information is inaccurate:

Please investigate this dispute under FCRA section 611. Correct or delete information that cannot be verified, then send me the investigation results and an updated report.

Attached are the report page with the item marked and documents supporting my position:
- [Document one]
- [Document two]
- [Document three]

If you need a particular document or a secure way to provide more information, tell me what is required.

Sincerely,

[Your full name]
[Mailing address]
[Phone number]
[Email address]

A standard bureau investigation generally takes 30 days. In some situations, the period can extend to 45 days. That is a different process from the four-business-day block procedure for a complete identity-theft request.

5. Notice to a creditor, furnisher, or debt collector

Send this to the business that opened the account or supplied the information. If a collector sent a validation notice, use the address and instructions in that notice rather than an address found in a search result.

If you don't know that identity theft occurred and the problem is instead a wrong balance, payment history, or account status, change the first paragraph so it describes that specific error.

Subject: Identity theft dispute: account [last four digits] is not mine

[Date]

To: [Creditor, furnisher, or collection agency]

I dispute the account or debt identified below because it resulted from identity theft. I did not open, authorize, or use this account.

- Company:
- Account number, last four digits:
- Amount claimed:
- Date opened or date of collection notice:
- Reference number:

Please mark the account as disputed, investigate your records, and correct or delete any information you furnished that is inaccurate. If your process or applicable law permits, pause collection activity while you review this dispute.

If you are a debt collector, please confirm the correct address and procedure for submitting any further written dispute. Send me the investigation result and, if available, the documents you relied on to associate this account with me.

Attached or enclosed:
- [FTC identity theft report number]
- [Police report number, if available]
- [Credit-report page or collection notice]
- [Other evidence]

Please send written correspondence to:

[Your full name]
[Mailing address]
[Phone number]
[Email address]

Sincerely,

[Your full name]

Dispute the account with the creditor or collector and with every bureau reporting it. A business's internal correction doesn't guarantee that all three credit reports will update automatically.

6. Fraud alert request

A fraud alert asks potential creditors to take extra steps to verify your identity. It doesn't remove fraudulent accounts and isn't a substitute for a credit freeze or a dispute.

Subject: Request for [initial one-year or extended seven-year] fraud alert

[Date]

To: [Credit bureau's official fraud-alert channel]

I request a [one-year initial or seven-year extended] fraud alert on my credit file because I am, or may be, a victim of identity theft.

My information is:
- Full name:
- Mailing address:
- Phone number:
- Date of birth:
- Last four digits of Social Security number:

Please confirm when the alert is active, its expiration date, and whether you notified the other nationwide credit bureaus.

For an extended alert, I have attached my [FTC identity theft report or police report]. Tell me if you need any additional identity verification through a secure channel.

Sincerely,

[Your full name]

You can request an initial alert from one bureau, which should notify the other nationwide bureaus. An extended alert lasts seven years and requires an identity theft report or police report. The Experian fraud alert instructions show one bureau's current process; check the instructions for the bureau you contact.

Where to send a credit bureau dispute

The FTC's credit-report dispute guidance lists these general paper-dispute addresses:

Check the bureau's current instructions before mailing. A section 605B block, fraud alert, or another special process may use a different address or online route. Use a trackable mailing method and keep the complete packet.

There is no universal public email address that guarantees a credit bureau will treat a message as a formal dispute. Don't rely on an address copied from an old template or an unofficial website.

Deadlines and response times

The four-business-day and 30-day credit-report timelines apply to different procedures. If required information or identity verification is missing, the bureau may treat a block request as incomplete. Ask what is missing and resubmit promptly.

Track the response

A short log can prevent a missed follow-up:

After sending:

1. Confirm receipt. Ask the bank, creditor, or bureau for a case number and the date it considers the notice received.
2. Check all three reports. Look for the account, inquiry, collection, and related addresses.
3. Use the right follow-up date. For a complete section 605B request, follow up after four business days. For a standard bureau dispute, use the stated 30- or 45-day period. A bank may give you a different investigation timetable.
4. Ask for a written explanation. If a bureau says an account was verified or refuses a block, check whether you included the identity theft report, item details, and requested identity documents.
5. Escalate an unresolved problem. After contacting the company or bureau, you can submit a complaint through the Consumer Financial Protection Bureau complaint portal. A complaint doesn't replace a dispute deadline, so keep the original notice and delivery proof.
6. Get prompt local legal help when the stakes are high. This may be appropriate if a collector files a lawsuit, money has been taken from an account, or the losses are substantial.

Credit freeze versus fraud alert

A freeze generally remains until you lift it. An initial fraud alert lasts one year, while an extended alert lasts seven years. Use either tool alongside the appropriate dispute, not instead of it. The FTC's credit freeze and fraud alert guidance explains how to start each request.

Mistakes to avoid

• Calling a template "FTC-approved" or "FTC-compliant." The FTC provides guidance and an identity theft reporting service, not one universal email form.
• Applying the Fair Credit Billing Act's credit-card deadline to an ACH, debit, wire, check, or peer-to-peer transaction.
• Sending a bureau only a general dispute when the item is clearly identity theft and you have the documents for a section 605B request.
• Assuming a police report is mandatory in every case, or assuming an FTC report alone will remove an account.
• Sending your full Social Security number or unredacted financial records through ordinary email.
• Disputing with only one bureau.
• Waiting for a transaction to post or for a collector to call before reporting suspected fraud.
• Treating a credit freeze as a refund request. A freeze helps prevent new accounts; it doesn't reverse charges or delete existing entries.

Frequently asked questions

Can I email a credit bureau identity-theft dispute?

Some bureau accounts may offer secure messaging, but there is no general email method that guarantees formal processing. Use the bureau's official portal or current mailing instructions. If you email first, send the same request through the required channel and keep proof.

Do I need a police report to block an identity-theft account?

Not automatically. A complete section 605B request generally includes an identity theft report, identifies the fraudulent information, and states that you didn't make or authorize the related transaction. A creditor may still ask for a police report, and an extended fraud alert requires an FTC identity theft report or police report.

Does a fraud alert remove a fraudulent account?

No. It warns potential creditors to verify your identity. Dispute the account with each bureau reporting it and notify the creditor or furnisher directly.

Why do some disputes mention four business days and others mention 30 days?

Four business days refers to the bureau's block process for a complete identity-theft request. Thirty days generally refers to a standard FCRA credit-report investigation. They are separate procedures.

What if the bank hasn't answered my fraud email?

Call the bank using an official number and ask whether the email was logged as a formal error notice. Submit the notice through the bank's required secure channel or mailing address, keep the delivery record, and escalate an unresolved complaint through the CFPB after contacting the institution.

Before sending a notice today, write down the statement date, identify the recipient's official address, attach only redacted evidence, and save delivery proof. Then follow up using the timeline for that payment rail or dispute process.