Credit Reports · 10 guides
Identity Theft on Your Credit Report: The Recovery Playbook
A step-by-step identity theft recovery plan: the FTC report, fraud alerts vs. security freezes, FCRA blocking, and disputes with bureaus and furnishers.
On this page
Finding accounts you never opened — or collections for debts that were never yours — is disorienting and frightening. The good news: identity theft recovery follows a known path, most of it is free, and federal law gives you tools that ordinary credit disputes don't have. This playbook walks the path in order.
Short answer
Recovery centers on IdentityTheft.gov. You file an FTC identity theft report, place a fraud alert or security freeze, then use that report to have the credit bureaus block the fraudulent information under the Fair Credit Reporting Act — generally within four business days — while also disputing with the companies where accounts were opened. Then you monitor.
What do you do first?
Short answer
Contain the damage, then create the official record. Freeze or alert your credit files, contact the fraud departments of affected companies, and file at IdentityTheft.gov to generate your FTC identity theft report and a personal recovery plan. That report is the key that unlocks the stronger legal tools later in the process.
Lock the doors
Place a fraud alert or security freeze (compared below), change passwords on financial accounts, and call the fraud departments of any company where an account was opened or misused. Ask them to close or freeze the fraudulent accounts.
File your FTC identity theft report
At IdentityTheft.gov, answer the guided questions to create an official identity theft report and a step-by-step recovery plan. Save the PDF and your reference number — you will attach this report to almost everything that follows.
Pull all three credit reports
Get your Equifax, Experian, and TransUnion reports free at AnnualCreditReport.com and inventory every account, inquiry, and address that isn't yours. Errors can appear on one report and not the others.
Consider a police report
A local police report is most useful when you know the thief, when the fraud happened in person nearby, or when a company insists on one. For many steps, the FTC report alone is enough.
Fraud alert or security freeze — which one?
Short answer
Both are free. A fraud alert asks creditors to verify your identity before opening credit and requires only one bureau, which must notify the other two. A security freeze blocks most access to your report for new-credit checks entirely, but must be placed with each of the three bureaus separately. The freeze is the stronger tool.
| Fraud alert | Security freeze | |
|---|---|---|
| What it does | Tells creditors to take reasonable steps to verify identity before extending credit | Blocks most lenders from seeing your report at all, stopping new accounts cold |
| How to place it | Contact any one bureau; that bureau must notify the other two | Contact each of the three bureaus separately |
| Cost | Free | Free |
| Duration | Initial alert lasts one year and is renewable; an extended alert with an identity theft report lasts seven years | Stays until you lift or remove it; can be lifted temporarily when you apply for credit |
| Everyday friction | Low — credit applications still go through, with verification | Higher — you must lift the freeze before applying for credit |
Freezes don't touch existing accounts
A freeze restricts access for new-credit decisions. Your current lenders, and collectors for existing accounts, can generally still see your file — which is why the freeze is paired with the block-and-dispute work below, not a substitute for it.
How does the FCRA identity theft block work?
Short answer
Section 605B of the Fair Credit Reporting Act lets you block information that resulted from identity theft. You send each bureau your identity theft report, proof of identity, a list of the fraudulent items, and a statement that they don't relate to any transaction of yours. The bureau generally must block those items within four business days and notify the furnishers.
This is the tool that separates identity theft recovery from ordinary dispute work. A regular dispute asks the bureau to investigate accuracy — typically a 30-day process. A 605B block, backed by your FTC report, requires much faster action and reaches further: once notified, the companies that supplied the fraudulent data generally may not continue reporting it or sell the debt for collection. Send block requests in writing to each bureau reporting the items, and dispute directly with the furnishers as well — sample letters are in our bureau dispute and furnisher dispute templates.
In plain English
A dispute says: please check whether this is accurate. A block says: this came from a crime, here is the official report, take it out of my file. Because the block relies on your sworn identity theft report, accuracy is everything — bureaus can decline or reverse a block if they reasonably conclude the request misstates the facts.
Keep the paper trail — blocks can be challenged
Send block requests and disputes by mail with tracking, keep copies of everything, and stick to items that are genuinely fraudulent. A bureau can refuse or rescind a block in limited circumstances, such as evidence you obtained goods or money from the transaction. Precise, documented requests are the ones that hold.
What does the full recovery timeline look like?
A typical identity theft recovery sequence
Day 0 — discovery
Freeze or alert your credit files, contact affected companies' fraud departments, and change passwords.
Day 0–1 — official report
File at IdentityTheft.gov, save the identity theft report, and pull all three credit reports to inventory the damage.
First week — letters out
Send written 605B block requests and disputes to each bureau reporting fraudulent items, plus disputes to each [furnisher](/glossary/furnisher). File a police report if your situation calls for one.
About 4 business days after receipt
Bureaus generally must block the identity-theft items and notify the furnishers that supplied them.
Days 30–45
Standard dispute investigations conclude — generally within 30 days, up to 45 in some cases. Review the written results against your reports.
Ongoing
Re-check all three reports regularly — they're free weekly — keep the freeze in place if it suits you, and watch for the debt resurfacing with a new collector.
Recovery is rarely one-and-done. Fraudulent debts sometimes get sold to a new collector who reports them all over again; the block-and-dispute cycle applies to the new appearance too, and your saved documentation makes round two much faster.
Common mistakes to avoid
- Handling everything by phone and keeping no written record of who agreed to what.
- Disputing with only one bureau when the fraudulent account appears on two or three reports.
- Paying a fraudulent collection just to make the calls stop — payment doesn't prove innocence and can complicate the block.
- Placing a fraud alert and assuming it blocks new accounts the way a freeze does.
- Paying for 'identity repair' services that perform the same free steps listed on IdentityTheft.gov.
- Tossing the file once things look clean — resold fraudulent debts often resurface months later.
When to talk to a professional
Strongly consider talking to a professional
Consider a consumer attorney if fraudulent items reappear after proper block requests, if a bureau or furnisher refuses to correct documented fraud, or if a collector sues you over an identity-theft debt. The FCRA and FDCPA both provide remedies — including damages and attorney's fees — which is why many consumer attorneys evaluate these cases free. Free or low-cost help may be available through legal aid, and complaints can be submitted to the CFPB.
If the fraud is on a credit card
Terms used on this page
Sources
This page is based on the following official and authoritative sources. Always check the source itself for the most current rules.
Educational information — not advice
This topic involves court deadlines and rights you can permanently lose.
This page provides general educational information about credit, debt, and consumer protections. It is not legal advice, financial advice, or credit repair services, and reading it does not create any professional relationship. Laws, procedures, deadlines, and dollar amounts vary by state and change over time.
Before acting or deciding not to act, strongly consider consulting a licensed attorney in your state. If cost is a concern, legal aid organizations may help for free. See our full disclaimer.
Templates & checklists for this topic
- Credit Bureau Dispute Letter (Free Template)A free educational sample letter for disputing an inaccurate item on your Experian, Equifax, or TransUnion credit report, with mailing and tracking tips.
- Furnisher Dispute Letter (Free Template)A free educational sample letter for disputing inaccurate credit information directly with the company that reported it, plus when to use this route.
Related guides
- How to Dispute Credit Report Errors (Bureau Process)What counts as a credit report error, how to file disputes with Equifax, Experian, and TransUnion, and what happens during the FCRA's 30-day investigation.
- Furnisher Disputes: Going Straight to the Company That Reported ItWhat a furnisher is, how the FCRA's direct-dispute right works, and how furnisher disputes compare with bureau disputes on speed, proof, and leverage.
- How to Get Your Free Credit Reports (Without Getting Upsold)Free weekly credit reports from all three bureaus come only from AnnualCreditReport.com. How to request them online, by phone, or by mail, upsell-free.
- How to Read Your Credit Report, Section by SectionA plain-English walkthrough of every credit report section — personal info, accounts, collections, public records, and inquiries — and what to verify in each.
- Experian vs. Equifax vs. TransUnion: Why Your Three Reports DifferWhy your Equifax, Experian, and TransUnion reports rarely match, why scores differ by bureau and model, and what that means for checking and disputing.