Identity Theft on Your Credit Report: The Recovery Checklist
The order of operations when accounts you did not open appear on your report, and the specific rights that apply to identity theft victims.
If accounts you did not open are on your report, you have stronger rights than an ordinary disputing consumer. Use them in the right order.
1. Place a fraud alert immediately
Free, takes minutes, and you only contact one bureau — it must notify the other two. An initial alert lasts one year.
Do this first because it is fast and it slows further damage while you work through the rest.
2. Consider a security freeze
A freeze restricts access to your report entirely, which stops new accounts from being opened. Free, and placed separately with each of the three bureaus. Stronger than an alert.
3. Pull all three reports
Go to AnnualCreditReport.com. Identity theft victims are entitled to free reports beyond the standard allowance. Read all three; fraudulent accounts often appear on only one or two.
Write down everything you do not recognize: accounts, inquiries, addresses, employers, name variants.
4. File an FTC identity theft report
At IdentityTheft.gov. This generates an Identity Theft Report, which is the document that unlocks the strongest remedies available to you. It is free.
The site also generates a recovery plan and pre-filled letters based on what you report.
5. File a police report if you can
Not always necessary, but useful, and some creditors require one. Bring the FTC report with you.
6. Request a block, not just a dispute
This is the step people miss, and it is the important one.
Under the FCRA, if you provide a credit bureau with an identity theft report, proof of identity, and identification of the specific information resulting from the theft, the bureau must block that information from your report — generally within four business days of receiving your request.
A block is faster and stronger than an ordinary dispute. An ordinary dispute triggers a 30-day investigation with an uncertain outcome. A block, properly supported, is an obligation.
Your request should include:
- A copy of the Identity Theft Report
- Proof of your identity
- A clear list of exactly which accounts, inquiries, and entries are fraudulent
- A statement that the information does not relate to any transaction you made
7. Contact each creditor directly
Separately from the bureaus, notify every company where a fraudulent account was opened. Ask them to close the account, confirm you are not liable, and stop reporting it.
You are also entitled to request copies of the application and transaction records for an account opened in your name. Ask for them — they often reveal the address and contact details the thief used.
8. Check the specialty reporting agencies
The big three are not the only consumer reporting agencies. Check reports for check-writing, banking, insurance, and rental screening if the circumstances suggest the theft went beyond credit accounts.
9. Keep everything
Every letter, every report, every confirmation number, every call with a date and a name. Identity theft cases run long and the documentation is the case.