Identity theft on a credit report is not a mistake the bureaus catch on their own. A stranger opens a card in your name, the lender reports it to Equifax, Experian, or TransUnion, and it sits on your file next to your real accounts, piling up late marks until you flag it.
Federal law gives you a specific way to fight back. Under the Fair Credit Reporting Act Section 605B, a bureau must block identity theft items within four business days of a complete request. The process is not automatic, though, and it only starts when you start it, at each bureau, in writing.
How Does Identity Theft Get Onto Your Credit Report?
It gets there the same way a real account does: a lender approves an application and reports it. The FTC took more than 1.1 million identity theft reports through IdentityTheft.gov in 2024 (FTC, 2025). Thieves get what they need from data breaches, phishing, mail theft, and stolen papers. A Social Security number, a birth date, and a current address are enough to open most kinds of credit.
The lender runs the application through its underwriting system. That puts a hard inquiry on your file even though you never applied. Once the account opens, the creditor reports it to one or more of the three nationwide bureaus.
To the bureau, the new tradeline looks ordinary. It stays that way until you flag it as fraud. Meanwhile the missed payments, charge-offs, and collections keep landing on your report, and the damage grows every month nobody notices.
New Accounts and Taken-Over Accounts Need Different Fixes
Credit identity theft comes in two kinds, and each one has its own paperwork. New account fraud means the thief opened a fresh credit line in your name. Account takeover means the thief got into an account you already had, changed the contact details, and ran up the balance before you caught it.
| Type of fraud | What shows up on your report | Main fix |
|---|---|---|
| New account fraud | A new tradeline, often with a hard inquiry | A Section 605B block at each bureau, backed by the FTC report |
| Account takeover, credit card | Charges on a card you already hold | The card issuer resolves it under the Truth in Lending Act |
| Account takeover, debit card | Withdrawals from an account you already hold | The bank resolves it under the Electronic Fund Transfer Act |
With a takeover, the bureau updates your file once the creditor confirms the fraud. With a new account, the bureau block does most of the work, and you drive it.
Start With an FTC Identity Theft Report at IdentityTheft.gov
Your first move is a free report at IdentityTheft.gov, the FTC’s own portal, which also builds you a personal recovery plan. The report is a sworn statement, made under penalty of perjury, that the accounts, inquiries, or other items you list were not yours. Most people finish it in under thirty minutes.
For credit reporting, federal law treats the FTC report like a police report. Bureaus and creditors have to accept it as the base for a Section 605B block. You can still file a police report for the crime itself, and you should when a creditor asks for one.
Bureaus will also want a government photo ID, proof of your current address such as a utility bill, and a clear list of each item you are contesting. Vague or partial requests get rejected all the time. How specific your paperwork is decides whether the four-business-day clock ever starts. For the full sequence, read What you need to do if your identity is stolen: 7 critical steps.
Place a Free Fraud Alert, Initial or Extended
A fraud alert tells lenders to check it is really you before they open new credit. An initial alert lasts one year, costs nothing, and needs no paperwork. Ask one bureau and it has to tell the other two, so one call covers all three.
An extended alert lasts seven years and requires your FTC Identity Theft Report. It also gets you two free credit reports from each bureau within twelve months and takes you off prescreened credit and insurance offers for five years. Service members on deployment can use an active-duty alert instead, which lasts one year. For the details, see Extended Fraud Alert Under FCRA Section 605A.
Freeze Your Credit Separately at All Three Bureaus
A freeze is the strongest tool you have to stop new accounts, and it has been free at all three bureaus since 2018. That year the Economic Growth, Regulatory Relief, and Consumer Protection Act amended the FCRA. A freeze locks your report, so most lenders cannot pull it and most new applications die there. It does not touch your existing accounts or your score.
Here is how the three protections compare.
| Tool | How long it lasts | What you need | Where to ask |
|---|---|---|---|
| Initial fraud alert | 1 year | Nothing | Any one bureau, which tells the other two |
| Extended fraud alert | 7 years | Your FTC Identity Theft Report | Any one bureau, which tells the other two |
| Active-duty alert | 1 year | Active military status | Any one bureau |
| Credit freeze | Until you lift it | ID at each bureau | Equifax, Experian, and TransUnion, one by one |
The bureau has to place a freeze within one business day of an online or phone request. It has to lift it within one hour through the same channels. Plenty of people keep freezes on all the time and lift them only to apply for credit, a job, or an apartment. The trade-offs are laid out in Credit Freeze vs Fraud Alert vs Credit Lock.
Pull All Three Reports and Mark Every Item That Isn’t Yours
The most common complaint about a wrong credit report is that the account belongs to someone else. By our own count, 66.9% of the 3,482,718 complaints recorded in the CFPB’s public Consumer Complaint Database under “Incorrect information on your report” from July 2025 through June 2026 named “Information belongs to someone else.” The next two issues were incorrect account information at 18.4% and incorrect account status at 8.7%.
Those complaints are unverified consumer allegations. The CFPB does not confirm the facts in them.
Go through all three reports line by line: accounts, hard inquiries, addresses, names, and employers. Each bureau keeps its own file, so a fraud account can show up on one report and not the others. If you find an account you never opened, Why Is There an Account I Don’t Recognize on My Credit Report? walks through what it can mean.
Seeing the problem is only the first half. Martha M. put it plainly in a 1-star Trustpilot review of Credit Karma on June 22, 2026: “they let me suffer identity theft which negatively impacted my credit in general.” A monitoring app can show you the fraud. You still have to write to each bureau to dispute it.
Call Each Creditor’s Fraud Department, Then Put It in Writing
Call the fraud department at every business where a fake account was opened and ask them to close or freeze it. Then follow up in writing. Send a copy of your FTC report, ask that the account be closed as fraud, and ask that collection stop.
Use certified mail with a return receipt. That receipt is your proof of the date they got it. Skip this step and the creditor keeps sending letters, keeps calling, or sells the account to a debt buyer, even after the bureau has blocked it.
Section 605B Makes Each Bureau Block Fraud Within Four Business Days
The law is 15 U.S.C. §1681c-2, and it sets a hard clock once the bureau has everything it needs. The four-business-day block starts only when all four of these elements arrive in a form the bureau can process.
| Element | What satisfies it |
|---|---|
| Proof of identity | A government photo ID and proof of current address |
| Identity Theft Report | A copy of your FTC report from IdentityTheft.gov |
| Items to block | Each account, inquiry, or address named one by one |
| Your statement | A signed line saying you did not make the transaction |
Once the bureau accepts the block, the fraud is suppressed from your file. The bureau also tells the furnisher, meaning the creditor that reported the account, that you say the item came from identity theft. The furnisher then cannot keep reporting it unless the bureau later reverses the block on one of the grounds the law allows. For the full block process, see How to Block Identity Theft Items Under FCRA Section 605B.
How to Write and Send a Block Letter to Each Bureau
Write one letter per bureau, attach the same packet to each, and send all three the same day. The steps below keep the four-day clock from stalling on a missing page.
| Step | What you do | What to keep |
|---|---|---|
| 1. File | Get your FTC Identity Theft Report | A saved copy of the report |
| 2. Gather | Copy your photo ID and a recent utility bill | One set per bureau |
| 3. List | Write down each fraud item from that bureau’s report | Account numbers and dates as printed |
| 4. Write | Draft the letter covering the points below | A signed copy |
| 5. Mail | Send by certified mail, return receipt requested | The receipt and mailing date |
| 6. Confirm | Get a confirmation reference number | The number, filed with the letter |
Every letter should say five things.
- Who you are. Your full name, current address, date of birth, and the last four digits of your Social Security number.
- What you dispute. Each item listed separately, with the account name and number exactly as the report shows it.
- Why. A plain statement that these items came from identity theft and you did not open or use them.
- What you want. A block of each item under FCRA Section 605B.
- What is enclosed. Your FTC Identity Theft Report, photo ID, and proof of address.
The Bureau Has 30 Days to Reinvestigate a Regular Dispute
A dispute without an FTC report is a regular accuracy dispute, and it runs on a slower clock. Under FCRA Section 611, a bureau has to do a reasonable reinvestigation and generally finish within 30 days, up to 45 in some cases (FCRA Section 611). It has to delete or correct anything it cannot verify.
That is why the FTC report matters. Without one, bureaus often handle identity theft as a routine dispute, which takes longer and protects you less. Here is who owes you what, and how fast.
| Who | Clock | What they owe you |
|---|---|---|
| Bureau, 605B block | 4 business days after a complete request | Block the fraud and notify the furnisher |
| Bureau, regular dispute | 30 days, up to 45 in some cases | Reinvestigate; delete or correct what it cannot verify |
| Bureau, freeze request | 1 business day | Place the freeze |
| Furnisher | During the bureau’s review | A reasonable, independent investigation |
Log the date each letter arrived. Your own record is how you know when a deadline has passed.
The Creditor That Reported the Account Has to Investigate Too
The bureau is only half of it, because the furnisher that sent the data has its own duty. Both the bureau and the furnisher must run a reasonable, independent investigation, and one that just repeats the furnisher’s records can break the FCRA (FCRA Section 611(a)(1)(A) and Section 623(b); Cushman v. Trans Union, 3d Cir. 1997). You are dealing with two parties, and both answer to the law.
Most disputes reach the furnisher through e-OSCAR, the industry’s automated system, as a short code rather than a full review of your documents (e-OSCAR). Consumer advocates and the CFPB point to that system when they call reinvestigations shallow. It is one more reason to send the full packet to the creditor yourself.
If a debt collector picks up the fraud account, you have a separate right. You can demand that the collector validate the debt and dispute a debt it cannot verify (FDCPA, 1977).
Medical Identity Theft Needs a Second Track With the Provider
Medical identity theft happens when a thief uses your details to get care, prescriptions, or insurance benefits. It usually reaches your credit report only after an unpaid bill is sold to a collector who reports it. By then, claims have gone out under your name, which can affect your insurance and your medical records.
Recovery runs on two tracks. You file the FTC report and seek a Section 605B block on the collection account. At the same time, you work with the provider’s compliance office to fix the clinical and billing records. Under HIPAA, providers must amend records that are wrong or unauthorized, though how long that takes varies by provider.
Tax Identity Theft Calls for an IRS IP PIN
Tax identity theft means someone filed a federal return with your Social Security number and took the refund. The first sign is often an IRS rejection when you file, because a return under your SSN was already processed. It does not always put an entry on your credit report, but it often shows up alongside broader schemes that do.
The IRS offers an Identity Protection PIN to anyone who wants it. It is a six-digit code, and your federal return is not accepted without it. The program is free and voluntary, you enroll through your IRS Online Account, and confirmed victims are enrolled for you.
A Protected Consumer Freeze Shields a Child From Synthetic Fraud
Synthetic identity fraud mixes real data, often a child’s Social Security number, with a made-up name and birth date to build a new credit identity. Bureaus do not flag an SSN that has never been used. So the fake identity can build a thin file for months or years, and it often goes unnoticed until the young adult applies for a first card.
Parents and guardians can place a free protected consumer freeze for a minor at each of the three bureaus. The bureau needs proof of your identity, proof of your authority over the child, and papers showing the child’s identity. The freeze stops the bureau from creating or releasing a file for the child until you lift it, which shuts down one of the main ways this fraud starts.
A Bureau Can Reverse a Block, and You Can Push Back
A bureau may rescind a 605B block on four grounds under the law. They are that the information was blocked in error, that you made the transaction, that you got goods or services from it, or that you made a material misrepresentation. The bureau must tell you in writing, before or promptly after, and name its reason.
Reversals and repeat entries are a known problem. Consumers often told the CFPB that identical inaccurate items came back after being removed (CFPB, 2024).
A rescission does not end your options. You can send more documents or file a complaint with the CFPB, where credit reporting made up 88% of all complaints in 2025 (CFPB, 2026). You can also sue under Sections 616 and 617 of the FCRA for willful or negligent noncompliance.
Three Mistakes That Stall an Identity Theft Cleanup
Most delays come from the same three slips, and all three are easy to avoid.
- Filing with one bureau. Each bureau keeps its own file and handles blocks on its own. A block at Experian does nothing at Equifax or TransUnion. You need three requests, each with its own copy of the FTC report and papers.
- Skipping the creditor. Even after the bureau blocks the tradeline, the creditor can keep calling, keep writing, or sell the debt. Send written notice with your FTC report by certified mail, return receipt requested.
- Sending a partial request. The bureau does not have to block until all four elements arrive. People who mail a request and never confirm it find out weeks later it was marked incomplete. A confirmation reference number is your proof the request is moving.
Who Should Draft Your Identity Theft Dispute Letters?
After the FTC report, most of an identity theft cleanup is letters to three bureaus and a handful of creditors, and the options split into software you run, a firm you pay, or a free app that watches. What matters here is the price, whether you see and sign each letter, and whether the tool reaches all three bureaus.
| Tool | What you pay | What that buys | Bureaus | Trustpilot |
|---|---|---|---|---|
| CreditRefresh | $49.99/mo, no setup fee, cancel anytime. Mail letters yourself free, or pay RushMail per letter | Drafts a letter for each item you flag, for you to review and sign | All three | 4.3 (9 reviews) |
| Dispute Beast | From $49.99/mo for required monitoring. Mail letters yourself free, or pay Sprint Mail per letter | An AI app that generates dispute letters, bundled with monitoring | All three | 4.2 (2,067 reviews) |
| DisputeBee | $49/mo personal, $129/mo business | Letter templates; you import reports, print, mail, and track replies | All three | 3.2 (68 reviews) |
| The Credit People | $99/mo standard, $119/mo premium, or $599 for 6 months | A done-for-you service; you do not approve each letter | All three | 1.7 (17 reviews) |
| Lexington Law | $139.95/mo, invoiced at the end of each service period | An attorney-backed firm works the file; letters are not shown to you | All three | 3.2 (624 reviews) |
| Credit Karma | Free, paid for by lender referrals | Monitoring that flags issues; Direct Dispute reaches TransUnion only | TransUnion | 1.1 (912 reviews) |
Every price is that company’s own published rate, read off that company’s own site on September 15, 2026. Trustpilot scores and review counts as published on September 24, 2026.
How CreditRefresh Drafts Every Identity Theft Letter Across All Three Bureaus for $49.99
Every step in an identity theft cleanup ends in a letter, and each one has to reach the right bureau with the right items named. In CreditRefresh’s September 18, 2026 member-data extract, 2.3% of disputed bureau-level items in mailed rounds had a recorded outcome. Within that subset, 47.9% were no longer reported on a newer pull of the same bureau, while 52.1% remained reported with a changed balance, status or negative flag. Those figures cover mailed disputes of every type, identity theft blocks and ordinary accuracy disputes together.
CreditRefresh pulls your reports from Equifax, Experian, and TransUnion through a secure, authorized data feed. Our AI checks every tradeline, inquiry, and personal detail for signs of FCRA violations, including the errors that follow identity theft. It then drafts custom dispute and block-request letters for you to review, and nothing goes out until you sign it.
CreditRefresh works alongside your FTC Identity Theft Report and does not replace it. You file the report at IdentityTheft.gov, freeze each bureau, and use our drafted letters for the 605B block requests, the follow-ups, and the creditor notices. Mail them yourself or hand a round to RushMail for a small per-letter fee. It is included with Refresh Monitoring at $49.99 a month, with no setup fee and no contract. We do not give legal advice, and we recommend a licensed consumer protection attorney for complex identity theft cases.
It is backed by our 100% money-back guarantee: members who work the full program and see no bureau score rise above where they started can claim back every Refresh Monitoring payment. It is a refund promise, never a score promise.
Frequently Asked Questions
Do I have to dispute with all three bureaus if the fraud only shows on one?
Only the bureaus that show the fraud need a block request. Pull all three reports first, though, because a thief’s account often lands on more than one file, and each bureau handles its own blocks.
Can I dispute identity theft items without an FTC report?
Yes, as a regular accuracy dispute under FCRA Section 611. Bureaus often treat that as routine, which runs on the longer 30-day clock and gives you less protection than a 605B block.
Does a credit freeze stop a thief from using my existing cards?
No. A freeze blocks new credit pulls and leaves existing accounts alone, so call the card issuer or bank about a takeover and let them resolve it under the Truth in Lending Act or the Electronic Fund Transfer Act.
What if a debt collector keeps calling after the bureau blocks the account?
Write to the collector, enclose your FTC report, and demand validation of the debt under the FDCPA. Keep sending by certified mail so you have a dated record of every letter.
How much do credit repair companies charge to handle identity theft?
Traditional credit repair firms commonly charge $79 to $139 a month plus a setup fee. Under CROA, they cannot charge you before the work is done.
Does CreditRefresh file my FTC Identity Theft Report for me?
No. You file it yourself, free, at IdentityTheft.gov, and we draft the dispute and block-request letters that go with it for you to review and sign.
When should I talk to a lawyer about identity theft on my credit report?
Talk to a licensed consumer protection attorney when a bureau keeps rescinding blocks, when a minor’s identity was used for synthetic fraud, or when you are weighing a lawsuit. Sections 616 and 617 of the FCRA let you sue for willful or negligent noncompliance.
Results may vary. No specific outcome is guaranteed. CreditRefresh is an application that helps consumers identify potential inaccuracies and Fair Credit Reporting Act violations on their credit reports and generates dispute and block-request correspondence. It does not provide attorney review, legal advice, or representation in court. Consumers facing complex identity theft matters, including synthetic fraud, repeated bureau rescissions, or pending litigation, should consult a licensed consumer protection attorney.
CreditRefresh drafts the identity theft letters you send to Equifax, Experian, and TransUnion, and nothing goes out until you review and sign it. Backed by a 100% money-back guarantee.
