It usually arrives as a small wrong note. A credit card statement for a card you never opened. A collection call about a loan you don’t recognize. A denial for an apartment over a credit file that suddenly looks nothing like your life. Identity theft has a particular sting: the damage is on your report, under your name, for things you never did.
The good news — and there is real good news — is that the law treats you as a victim, not a debtor, and it gives you specific tools to stop the bleeding and clear your file. Used in the right order, these steps can freeze out the thief, force fraudulent accounts off your report, and protect you going forward. This is the recovery playbook, step by step.
The short version
- Freeze your credit at all three bureaus — it’s free and stops new accounts cold.
- Report the theft at IdentityTheft.gov to create your official identity theft report.
- Use that report to block fraudulent accounts from your credit file under the FCRA.
- Document everything. If a bureau or furnisher keeps reporting the fraud after you’ve done it right, you may have a claim.
Step 1: Freeze before you do anything else
Your very first move is a security freeze (also called a credit freeze) at each of the three nationwide bureaus — Equifax, Experian, and TransUnion. A freeze blocks new creditors from pulling your credit, which means the thief can’t open new accounts in your name while you clean up the old ones. Thanks to federal law, placing and lifting a freeze is free.
A freeze is stronger than a fraud alert, but the two work together, and you can use both. Know the difference:
| Fraud alert | Security freeze | |
|---|---|---|
| What it does | Warns lenders to take extra steps to verify your identity | Blocks new credit from being opened in your name |
| Your credit still accessible? | Yes, but with added verification | No new pulls until you lift it |
| Cost | Free | Free |
| How long | One year (extended alert: seven years for victims) | Until you lift it |
| Set it where | One bureau must tell the others | Each bureau separately |
Step 2: Create your identity theft report
Next, report the theft at the FTC’s IdentityTheft.gov. This generates an FTC Identity Theft Report, and the site walks you through a personalized recovery plan. That report is not just paperwork — it’s the key that unlocks several of your strongest legal rights, including the power to block fraudulent information from your credit file.
Depending on your situation, you may also file a report with local police, particularly if a specific creditor or institution asks for one. Keep copies of everything.
Step 3: Block the fraudulent accounts
This is the step that does the heavy lifting, and it’s one many victims never learn about. Under the FCRA, when you give a credit bureau an identity theft report and identify information that resulted from the theft, the bureau generally must block that information — stop reporting it — usually within a few days. The furnisher that reported it is also notified and must not keep furnishing information it knows stems from identity theft.
In other words, you are not at the mercy of the thief’s accounts sitting on your report indefinitely. Properly invoked, the block is a powerful, fast remedy. You also have the right to get copies of the fraudulent application and transaction records from the businesses involved, which can help you and any investigators see what happened.
Step 4: Dispute and document
Alongside the block, dispute the fraudulent items with each bureau in writing, the same careful way you would dispute any error — specific, documented, and copied for your records. Our guide to disputing a credit report error walks through exactly how. Enclose a copy of your identity theft report.
Throughout, keep a meticulous file: dates, names, what you sent, what they said. This record is your protection. If everyone does their job, the fraud comes off and you move on. If they don’t — if a bureau keeps reporting accounts you’ve proven are fraudulent — that documentation becomes the foundation of a legal claim.
The recovery sequence at a glance
-
1
Freeze all three bureaus
Stop new accounts immediately. Free, and reversible whenever you need credit pulled.
-
2
Report at IdentityTheft.gov
Create your FTC Identity Theft Report and recovery plan. File a police report if a creditor requires one.
-
3
Block the fraudulent accounts
Send your identity theft report to the bureaus and demand they block the information that resulted from the theft.
-
4
Dispute in writing & keep copies
Dispute each fraudulent item with each bureau, enclosing your report. Document every step.
-
5
Follow up — and escalate if needed
If the fraud keeps reappearing after you’ve done it right, that persistence is a problem the law can address. Talk to a consumer lawyer.
The documents to gather — and keep forever
Identity theft recovery is, in large part, a documentation exercise. The victims who clear their names fastest, and who are best positioned if they later need a lawyer, are the ones who build an organized file from day one. Keep all of this together:
- Your FTC Identity Theft Report from IdentityTheft.gov, and any police report.
- Every dispute letter you send to each bureau, with proof of mailing, and every response you get back.
- Your written notices to the businesses where fraudulent accounts were opened, and their replies.
- Copies of the fraudulent applications and transaction records you request from those businesses.
- Confirmations of your security freezes and fraud alerts at all three bureaus.
- A running timeline — dates, names, what was said, what it cost you.
This file is your protection in two directions. If everyone does their job, it’s the record that proves the fraud and gets it removed. If they don’t — if a bureau ignores your report or a furnisher keeps reporting an account you’ve proven is fraudulent — it’s the foundation of a claim. Don’t throw any of it away, even after the problem seems solved; fraudulent accounts have a way of resurfacing.
Your written notice to a furnisher
When you contact a business that opened a fraudulent account, do it in writing and be precise. A strong notice states clearly that the account is the result of identity theft, that you did not open it or authorize it, and that you are enclosing a copy of your identity theft report. It asks the business to stop reporting the account to the credit bureaus, to close the fraudulent account, and to provide you with copies of the application and transaction records related to the fraud. Keep a copy, send it so you have proof of delivery, and log the date. This single letter does a lot of work: it puts the furnisher on notice, triggers its obligations, and adds another dated record to your file.
Special cases: children and older adults
Two groups face identity theft that often goes undetected for a long time, and both deserve extra attention.
Child identity theft is insidious because a child has a clean Social Security number and no reason to check credit — so the fraud can run for years and only surface when the young person applies for a first card, a student loan, or an apartment. If you suspect a child’s identity has been misused, you can check whether a credit file exists in their name and, in many cases, place a protective freeze on a minor’s credit. Catching it early spares them a painful cleanup at the worst possible moment.
Older adults are frequently targeted, sometimes by people close to them, and sometimes through scams that harvest personal information. The recovery steps are the same — freeze, report, block, document — but a trusted family member may need to help, and where the misuse involves financial exploitation, additional protections and reporting channels may apply. If an older relative’s identity or finances have been compromised, treat it with the same urgency you would your own.
Freeze, alert, or monitoring — which does what
People often lump these together, but they serve different purposes, and the strongest approach usually combines them. A security freeze is the lock — it blocks new credit from being opened, and it’s free. A fraud alert is the warning sign — it tells lenders to take extra steps to verify identity, and victims can get an extended version that lasts for years. Credit monitoring is the smoke detector — it watches for new activity and alerts you, but it doesn’t by itself stop a thief from opening an account; it tells you after the fact. Monitoring is useful, but it is not a substitute for the freeze. If you do only one thing, freeze.
When fraud is mistaken for a debt you owe
Sometimes the fraudulent account doesn’t just sit on your report — a collector starts chasing you for it, or you get sued on it. If that happens, the identity theft facts become your defense. A debt that isn’t yours is a debt you don’t owe, and a collector who keeps pursuing you after you’ve provided an identity theft report may be crossing legal lines of its own. See what a debt collector cannot legally do to you, and if you’ve been served, our Warrant in Debt guide.
A special note on “mixed files.” Not all wrong accounts come from a thief. Sometimes a bureau simply confuses you with someone else who shares your name or a similar Social Security number — a “mixed file.” The recovery steps overlap, but the cause is the bureau’s own matching error, and the law expects them to follow reasonable procedures to keep your file accurate. Either way, the documented dispute is your path forward.
Before step one: contain the breach
The freeze-report-block sequence handles your credit file, but if you know how the thief got in, close that door first or in parallel. The leak is often the more urgent wound. If a specific account was compromised — a bank login, an email, a card — secure it immediately: change the password, add extra verification, and call the institution to flag the fraud and reverse unauthorized charges. If your email was breached, that’s especially urgent, because email is the master key to resetting everything else. Securing the source of the breach keeps the thief from simply re-opening accounts as fast as you close them, and it makes the credit-file cleanup actually stick.
When the fraud reaches the IRS or your taxes
Tax-related identity theft has its own track that the credit bureaus can’t fix for you. If someone files a tax return using your information to grab a refund, you may discover it when your own return is rejected as a duplicate. The response runs through the IRS rather than the credit bureaus: there are specific procedures for reporting tax identity theft and for obtaining protections that make it harder for someone to file falsely in your name going forward. Keep your FTC Identity Theft Report — it’s useful across agencies — but understand that the tax piece is resolved through the tax system. The same is true for medical identity theft, which runs through your providers and insurers to correct both the bills and any inaccurate records.
If you’re caught in a data breach
Sometimes you learn your information was exposed before any fraud appears — a company you did business with announces a breach. Treat that notice as a reason to act, not to wait. The most effective single step is the same free security freeze at all three bureaus, which blocks new-account fraud whether or not the thief ever tries. Add a fraud alert, watch your statements and reports closely for a while, and keep the breach notice itself. If fraud does surface later, you’ll already have the strongest barrier in place and a record of when you were exposed. A freeze you set up after a breach but before any misuse is the cheapest insurance in this entire area.
Not all identity theft looks the same
“Identity theft” covers several distinct problems, and knowing which one you’re facing helps you respond. The credit-report recovery steps overlap, but the details differ.
- New-account fraud. The thief opens new credit cards, loans, or utilities in your name. This is the classic case the freeze-report-block sequence is built for.
- Account takeover. The thief gains control of an account you already have — changing the address, adding themselves as a user, draining it. Contact that institution directly and fast.
- Synthetic identity. The thief blends real information (often a Social Security number) with fabricated details to create a new “person.” These can be stubborn because the fraudulent identity doesn’t cleanly match you.
- Medical identity theft. Someone uses your identity to get care or prescriptions, leaving bills — and sometimes incorrect medical records — in your name.
- Criminal identity theft. Someone gives your name when arrested or cited, attaching a record to you.
- Tax-related identity theft. Someone files a tax return using your details to claim a refund.
- Child identity theft. A child’s clean Social Security number is used, often going undetected for years until the child applies for credit.
The credit-report damage from several of these — new accounts, medical bills sent to collections, fraudulent loans — is addressed through the same FCRA tools. But each variety may also need its own channel: the IRS for tax fraud, providers and insurers for medical fraud, the courts for criminal misuse. The credit freeze and identity theft report remain the foundation in nearly every case.
A recovery scenario
Walk through how this looks in practice. James gets a call from a collector about a credit card he never opened. His stomach drops — but he doesn’t pay, and he doesn’t admit the account is his. That night he places a free security freeze at all three bureaus, stopping the thief from opening anything new. The next morning he files a report at IdentityTheft.gov and gets his FTC Identity Theft Report and a recovery plan.
James then pulls all three credit reports and finds two fraudulent accounts and a collection. He writes to each bureau, encloses a copy of his identity theft report, identifies the fraudulent items, and demands they be blocked and the errors deleted. He keeps a copy of every letter and sends them certified. He also contacts the businesses where the fraudulent accounts were opened, asks for copies of the fraudulent applications, and tells them in writing that the accounts are the product of identity theft. Within weeks the fraudulent accounts are blocked and removed. James keeps his entire file — because if any of it had come back, or a bureau had ignored his report, that documentation would be the backbone of an FCRA claim.
Working with each business directly
The bureaus aren’t your only stop. The businesses that opened the fraudulent accounts — the “furnishers” — have obligations too, and contacting them directly can speed things up. Notify each one in writing that the account resulted from identity theft, enclose your identity theft report, and ask them to stop reporting it and to close the fraudulent account. You also have the right to request copies of the application and transaction records connected to the fraud, which can reveal how the thief operated and support the rest of your recovery. Keep these requests and responses in your file alongside everything else.
Protecting yourself going forward
Once the immediate damage is contained, a few habits make a repeat far less likely. None of these is complicated, and together they form a durable defense.
- Keep the freeze on. A freeze is free to lift temporarily when you actually need new credit, then re-freeze. Leaving it in place is the single most effective barrier to new-account fraud.
- Monitor your reports. Federal law entitles you to free reports; check them regularly and act on anything unfamiliar early.
- Watch your statements. Small, odd charges are sometimes a thief testing a stolen number before a larger run.
- Guard the Social Security number. It’s the master key. Share it only when truly necessary.
- Use strong, unique passwords and added verification on financial accounts, so an account takeover is harder to pull off.
When the system fails — and you have a claim
Most of the time, this playbook works. You freeze, report, block, dispute, and the fraudulent accounts come off. But the FCRA exists precisely because sometimes the bureaus and furnishers don’t do their jobs — they keep reporting accounts you’ve proven are fraudulent, ignore a valid identity theft report, or run a sham investigation. When that happens, you may be entitled to:
- Actual damages — the real harm from the continued false reporting, including denied credit, lost housing or jobs, and the toll of the ordeal.
- Statutory damages — for willful violations, set by the law itself.
- Punitive damages — in cases of willful misconduct.
- Attorney’s fees and costs — which let you enforce your rights without paying a lawyer by the hour out of pocket.
That fee-shifting is what makes this real. An identity theft victim shouldn’t have to choose between fixing their credit and affording a lawyer — and under the FCRA, they usually don’t.
Frequently asked questions
Does freezing my credit hurt my score?
No. A freeze simply blocks new creditors from pulling your report; it doesn’t affect your score, and you can lift it temporarily whenever you need to apply for credit. It’s free to place and lift.
Do I have to pay debts that an identity thief ran up?
You are not responsible for debts a thief incurred in your name. The whole point of the identity theft report and the FCRA block is to get those accounts off your file and out of your life. If a collector keeps pursuing you after you’ve provided proof, that may itself be a violation — see what a debt collector cannot legally do.
Should I file a police report?
The FTC Identity Theft Report is the central document, but a police report can still help, especially when a specific creditor or institution requires one. Keep copies of both.
How long does recovery take?
It varies. A freeze is immediate; blocking fraudulent accounts often happens within days of a proper request; full cleanup can take longer if accounts are stubborn or keep reappearing. Persistence and documentation are what get you to the finish line.
What if the fraudulent accounts keep coming back?
That recurrence is exactly the kind of failure the FCRA addresses. If a bureau or furnisher keeps reporting accounts you’ve proven are fraudulent, you may have a claim. Keep every record and talk to a consumer lawyer.
Is there a deadline to bring an FCRA claim over identity theft?
Yes. FCRA claims carry time limits, generally measured from when the violation occurred or when you discovered it. So if you’ve done everything right and a bureau or furnisher still won’t fix a fraudulent account that’s costing you, don’t let it drag on indefinitely — get advice while the claim is still timely.
The bottom line
Identity theft turns you into a victim and then, cruelly, treats you like a debtor — chased for accounts you never opened, judged by a credit file that isn’t really yours. The law refuses to leave it there. It gives you a free freeze to stop the bleeding, an official report that unlocks your strongest rights, a powerful block that forces fraudulent accounts off your file, and — when a bureau or furnisher won’t do its job — a path to hold them accountable without paying a lawyer out of pocket. Move in order: contain the breach, freeze, report, block, dispute, and document everything along the way. Most victims who follow that sequence get their names back. And for the cases where the system still fails, the same file of careful records that guided your recovery becomes the foundation of your claim. You did not choose this — but you can take back control of it.
KCLS represents Virginia residents. If you’ve been hit by identity theft and the fraudulent accounts won’t come off your credit report — or a collector is chasing you for a debt that isn’t yours — contact us for a free case review. Bring your identity theft report and your dispute records. Outside Virginia? The National Association of Consumer Advocates can help you find a lawyer near you.
Escalating: regulators and complaints
If a bureau, furnisher, or collector won’t cooperate, you have more than your own letters to rely on. Complaints to consumer-protection regulators — including the federal Consumer Financial Protection Bureau and the state attorney general’s office — create an additional record and sometimes prompt a response that a direct dispute didn’t. These complaints don’t replace your legal rights, and they aren’t a substitute for the FCRA dispute and block process, but they add pressure and another dated entry to your file. Keep copies of anything you submit and any reply you receive, and fold them into the same organized record you’re already building. If the failures continue after you’ve done everything right, that pattern — documented across letters, disputes, and complaints — is exactly what a consumer lawyer uses to evaluate a claim.
Setting realistic expectations
It helps to know what a normal recovery feels like, so you neither panic nor give up too early. The freeze is instant. The identity theft report takes an afternoon. Blocking clearly fraudulent accounts often happens within days of a proper, documented request. But the full cleanup — especially when accounts are stubborn, when a debt has already gone to a collector, or when a mixed file keeps re-merging — can stretch over weeks or longer, and may take more than one round of disputes. That doesn’t mean the process is failing; it means persistence is part of the job. The people who come out the other side cleanest are the ones who kept at it, kept their records, and escalated when a bureau or furnisher didn’t do its part. You are not powerless in that wait — each documented step strengthens your position, whether the fraud comes off quietly or you ultimately need to enforce your rights.
This article is general information, not legal advice, and identity theft situations are fact-specific. For advice about your situation, talk to a lawyer.