Identity theft isn't one dispute. The right move depends on where the fraud landed: a new credit account, an existing card, a bank transfer, a tax return, medical records, or a benefits claim. Start with the company or agency that controls the affected account, then create an official identity-theft record, then use the dispute path that matches the problem.

For U.S. consumers, the main tools are usually an FCRA credit-report block, a Regulation Z billing-error dispute, a Regulation E electronic-fund-transfer error claim, IRS identity-theft procedures, or a provider or health-plan correction process. Deadlines and protections can differ by payment method, account agreement, and state law.

What rule controls your identity-theft problem?

A credit freeze is useful, but it has narrow aim. It won't reverse a debit transfer, erase an existing account, or fix an IRS record. A credit-bureau dispute also won't recover money from a stolen bank transfer. Send each demand to the party that can actually act.

Start with these four steps

1. Secure the affected accounts

Call the bank, card issuer, creditor, phone carrier, health plan, or other company. Use a number from a statement, card, or official website, not a link in a suspicious text or email.

Ask the company to:

• Stop further unauthorized transactions.
• Lock or close the compromised account.
• Issue a new card, account number, or login credential where appropriate.
• Remove unauthorized users and devices.
• Give you a case number and written confirmation of the report.
• Explain what documents it needs and where to send them.

If your email may be exposed, secure it first. Change reused passwords, sign out unknown sessions, enable multifactor authentication, and check for unfamiliar recovery addresses or automatic forwarding rules. If your phone number was taken over, contact your mobile carrier about a SIM-swap or account takeover.

2. Create an evidence file

Keep a dated log with:

• The fraudulent account, transaction, inquiry, or record.
• The date you noticed it and the date it occurred, if known.
• The amount and account number, using only the last four digits in ordinary correspondence.
• Every company, agency, or bureau you contacted.
• Case numbers, names, call dates, and promised follow-up dates.
• Copies of statements, credit reports, emails, letters, screenshots, and shipping records.

Send copies rather than original documents. Redact unrelated account information and avoid putting your full Social Security number in ordinary email.

3. File an FTC identity-theft report

Use IdentityTheft.gov to describe what happened and download the resulting recovery plan and Identity Theft Report. The report creates a consistent record that can support requests to creditors, credit bureaus, debt collectors, and government agencies.

An FTC report doesn't automatically remove an account, reverse a payment, or order a creditor to act. It is evidence for the separate disputes you still need to file.

4. Consider a police report

A local police or law-enforcement report can add useful documentation, particularly if a creditor, insurer, or government agency asks for one. Bring your FTC report, identification, account records, and a short timeline. Ask for the report or case number if the agency accepts it.

A police report isn't automatically required for every credit dispute. For an extended fraud alert or a particular creditor's investigation, follow the documentation instructions given by the bureau or company.

Fraud alert or credit freeze: which should you use?

A fraud alert asks lenders to take extra steps to verify your identity. A freeze restricts access to your credit report for most new-credit applications.

An initial fraud alert can generally be started with one nationwide credit bureau; confirm that all three bureaus show it. An extended alert requires additional documentation, so use the current instructions from the bureau handling your request. Experian's fraud-alert guidance describes the initial and extended alert options.

A credit freeze is free and must be placed separately with Equifax, Experian, and TransUnion. Save each confirmation and the PIN or account details needed to lift the freeze temporarily. You can usually schedule a temporary lift when applying for credit.

Freezes are strongest against new-account fraud, but they won't stop someone who already has access to your checking account, credit-card login, email, phone number, or existing line of credit. Contact those providers separately.

Dispute fraudulent accounts and inquiries on your credit report

Get current reports from all three bureaus through AnnualCreditReport.com. Mark every account, collection, inquiry, address, or employer entry you don't recognize. An unfamiliar item isn't automatically identity theft, so compare it with your bank records and contact the listed creditor if necessary.

Build a credit-bureau dispute packet

For each bureau reporting the fraudulent information, include:

1. A clear written request identifying each item by creditor, account number, and date.
2. A copy of your FTC Identity Theft Report.
3. Proof of identity and current address, following the bureau's instructions.
4. A copy of the report page with the item highlighted.
5. A police report if you have one or the bureau specifically requests it.
6. A statement that you didn't authorize or benefit from the account or transaction, if that is true.

You can usually submit a dispute online or by mail. Online submission may provide a quick confirmation; mail can give you a detailed delivery record. Use the bureau's current dispute instructions rather than relying on an old mailing address. Save the complete submission and confirmation number.

Send a separate notice to the creditor, lender, or collection agency that furnished the information. Ask it to investigate, close or flag the fraudulent account, stop collection activity while it investigates, and notify every bureau to which it reported the information.

Sample identity-theft block request

Use only statements that are accurate. Keep a copy of everything you send.

[Your full name]
[Your address]
[Date]

Re: Request to block information resulting from identity theft under FCRA Section 605B

I am a victim of identity theft. Please block the following information from my consumer report:

• Furnisher: [company name]
• Account or inquiry number: [number or last four digits]
• Date opened or reported: [date]
• Reason it is fraudulent: [brief explanation]

I did not authorize, benefit from, or incur this account or transaction. Please send written confirmation of the block or explain what additional documentation is required.

Enclosures: FTC Identity Theft Report, proof of identity, proof of address, and report pages identifying the disputed information.

Sincerely,
[Signature]
[Printed name]

Section 605B is different from an ordinary accuracy dispute

Section 605B of the Fair Credit Reporting Act lets an identity-theft victim ask a credit bureau to block information that resulted from the theft. After receiving a complete request with the required identity proof, identity-theft report, itemized information, and consumer statement, the bureau generally must block the information within four business days.

That four-business-day block is not the same as the ordinary investigation timeline. A regular credit-report dispute generally must be investigated within 30 days, or up to 45 days in certain circumstances. Ask for the result in writing.

A bureau may reject or remove a block if the request is incomplete, the information was not caused by identity theft, the request contains a material misrepresentation, or the creditor provides a valid basis for removing it. If that happens, ask which document or item is missing and resubmit a focused packet.

A block affects the information on your consumer report. It does not by itself close the creditor's account, refund a charge, repair a tax record, or settle a dispute with a debt collector.

Dispute unauthorized charges using the right payment process

Don't send the same generic letter to a card network, bank, and credit bureau. The payment rail determines the first notice and deadline.

Credit-card charges

Contact the card issuer immediately. For the federal billing-error process, send written notice to the billing-dispute address shown on the statement, not merely the payment address. Notice generally must reach the issuer within 60 days after the statement showing the error was sent.

Identify the charge, state that it was unauthorized, and attach supporting records. Continue paying the undisputed portion of the bill while the dispute is pending. The issuer's zero-liability policy may provide broader protection than the legal minimum, but check the card agreement.

Visa or Mastercard may have network rules that shape the issuer's investigation. You still dispute the charge with the card issuer, not directly with the network as your primary remedy.

Debit-card transactions and electronic fund transfers

For an unauthorized debit-card transaction or electronic transfer from a bank account, notify the bank or credit union promptly. If a card or other access device was lost or stolen, reporting within two business days after learning of the loss can help limit liability under Regulation E. If an unauthorized transfer appears on a statement, report it within 60 days after the statement was sent; waiting longer can expose you to additional liability.

Regulation E generally requires the institution to investigate promptly, often within 10 business days, although permitted extensions and special cases exist. If the bank asks for written confirmation after an initial phone report, send it promptly and keep proof of delivery.

Peer-to-peer payments

Report an unauthorized transfer to both the payment app and the linked bank immediately. The analysis can differ if you personally approved the transfer after being deceived by a scammer. An authorized scam payment may not receive the same treatment as a transfer made by someone who accessed your account without permission.

Wires, checks, and cryptocurrency

Contact the sending institution and the recipient platform immediately and request a recall, freeze, or stop-payment action where available. Recovery isn't guaranteed, and these transactions don't all receive the same federal protections as credit-card billing errors or unauthorized electronic fund transfers.

A complaint to the Consumer Financial Protection Bureau can help document an unresolved problem with a bank, card issuer, lender, or credit-reporting company. It does not replace a required billing-error notice or an account provider's fraud form.

Handle tax, Social Security, and benefits identity theft

IRS tax-return or refund fraud

Use the IRS identity theft guide for individuals if:

• The IRS says a return was already filed using your Social Security number.
• You receive an IRS notice about income or a return you didn't submit.
• Your refund is delayed because the IRS needs to verify your identity.
• Someone used your information to claim a dependent or tax credit.
• Your IRS account shows activity you don't recognize.

The IRS may instruct you to file Form 14039, Identity Theft Affidavit. Follow the instructions for your specific situation, including whether to attach the form to a paper return after an electronic filing is rejected.

Don't send duplicate Forms 14039. The IRS identity-theft assistance guidance warns that duplicate submissions and repeated status contacts can cause delays. Keep delivery records and respond to identity-verification requests through official IRS channels.

Get an IRS IP PIN

An Identity Protection PIN is a six-digit number used to help prevent someone else from filing a federal tax return using your information. Request or manage one through the IRS IP PIN page. The PIN changes each year.

An IP PIN helps protect future federal returns; it doesn't remove a fraudulent return already filed or resolve a refund dispute by itself. The IRS may require additional identity verification, including an in-person visit to a Taxpayer Assistance Center in some cases.

Social Security and government benefits

Review your Social Security earnings record for wages you didn't earn. Contact the employer shown on the record and use the Social Security Administration's official fraud-reporting process if the entry isn't corrected. The SSA Office of Inspector General reporting page is a starting point for suspected Social Security fraud.

For unemployment, public benefits, or other government programs, report the misuse to the agency that issued the benefit or notice. Save the claim number, correspondence, and confirmation of your report. A credit freeze generally won't stop someone from using your information in a benefits system.

Medical, utility, phone, and synthetic identity theft

Medical identity theft may appear as an unfamiliar bill, prescription, test, insurance claim, or explanation of benefits. Contact the provider's billing or privacy office and your health plan. Request the relevant records, identify the entries you dispute, and ask for the provider's process for correcting or amending the file.

If someone opened a phone, utility, rental, or other service account in your name, contact that company directly. Request closure or removal of the account, copies of the application or transaction records where available, and the name of any consumer-reporting agency that supplied information about you. Dispute the item with that agency if it appears on a report.

Synthetic identity fraud can combine a real Social Security number with a fabricated name or address. It may not appear as an obvious account on the three major credit reports. Ask the affected lender or service provider which database it used, and follow up with any specialty consumer-reporting company involved.

Request records from a creditor

If a creditor says it cannot investigate without more information, ask for the application and transaction records connected to the identity theft. Section 609(e) of the FCRA may allow a properly identified victim to request those records after providing an identity-theft report and other required documentation.

Make the request in writing and state exactly which account and dates are involved. A records request supports your dispute, but it doesn't replace a credit-bureau block request or a credit-card, debit-card, or bank-transfer notice.

Recovery timeline

These are general U.S. timeframes, not promises:

• Immediately: Secure email, banking, card, phone, and other affected accounts. Report unauthorized transactions.
• Within the applicable payment deadline: Send the required credit-card or electronic-transfer notice. Earlier is safer.
• Same day or soon after discovery: File an FTC report, place freezes or alerts, and obtain credit reports.
• Within four business days: A credit bureau generally must block information after receiving a complete Section 605B request.
• About 30 days: A standard credit-report dispute is generally investigated within 30 days.
• Up to 45 days: Some credit-report investigations can take longer when additional relevant information is submitted or another statutory exception applies.
• Tax matters: IRS identity-theft cases have no single completion date. Refunds may be delayed while the IRS verifies the return and reviews the claim.
• After the first dispute: Recheck reports, statements, email, and government accounts until the written results match your records.

If a company or bureau won't fix the problem

Follow up with a short letter that lists the original submission date, delivery confirmation, disputed item, and missing action. Include copies of the earlier evidence rather than starting an unrelated new explanation.

For a credit report, ask for the written investigation result and the procedure used to verify the information if the item remains. For a bank or card dispute, ask for the written decision, the documents relied on, and the applicable error-resolution deadline.

Use the CFPB complaint portal after giving the company a reasonable opportunity to handle a credit-reporting, bank, card, or lending problem. For an IRS case, follow the IRS victim-assistance instructions instead of sending repeated forms. A low-income taxpayer may also qualify for help from a Low Income Taxpayer Clinic.

Consider qualified legal or nonprofit consumer assistance if a creditor continues collection after receiving credible identity-theft documentation, a bureau repeatedly refuses a properly supported block, or the losses are substantial. This is general information, not advice for your specific facts.

Common questions

Do I need a police report to dispute identity theft?

Not always. An FTC Identity Theft Report, proof of identity, and an itemized request may support a credit-report block. A bureau, creditor, insurer, or government agency may separately request a police or law-enforcement report, especially for an extended alert or transaction records.

Will a credit freeze remove fraudulent accounts?

No. A freeze helps restrict new-credit applications. It doesn't erase an existing account, reverse charges, stop an account takeover, or correct a tax or medical record. Those issues require separate disputes.

What if the fraudulent account doesn't appear on my credit report?

Contact the company that opened or reported the account. Ask which consumer-reporting agency or database it used and dispute the information there. Checking, rental, employment, utility, and medical systems may not use the three nationwide credit bureaus.

What if I approved a payment because of a scam?

Report it immediately to the bank, card issuer, payment app, or wire provider. The result may differ from a transaction made without your permission, but prompt notice can improve the chance of stopping or recovering funds.

How long does identity-theft recovery take?

A complete FCRA identity-theft block request generally has a four-business-day deadline, while an ordinary credit dispute generally takes 30 days and sometimes 45. Bank and card deadlines can be much shorter. IRS and medical-record cases vary, so keep the case open until each provider gives a written resolution.

The fastest way to lose ground is to send one generic letter everywhere. Pick the account or transaction that hurts most, secure it with the provider, create the FTC report, then send the dispute that matches that payment or record type.