Identity Theft on Your Credit Report: A Step-by-Step Cleanup Using IdentityTheft.gov
You don't need a paid service. Federal law gives identity theft victims a faster tool than a normal dispute, and the FTC's site builds most of the paperwork for you.
⚡ Quick Answer
Report the theft at IdentityTheft.gov to get an FTC Identity Theft Report. Place a fraud alert and freeze your credit. Then send each bureau a section 605B block request with that report and proof of ID. Under the FCRA, a bureau must block the fraudulent information within 4 business days of receiving everything it needs.
Seeing an account, collection or inquiry you don't recognize is alarming. The good news: identity theft victims get a stronger tool than an ordinary dispute. FCRA section 605B lets you require the bureaus to block fraudulent information, on a short legal deadline, once you give them an identity theft report. Here's the order to do things in.
Step 1: Pull all three reports and list everything that isn't yours
Get your Equifax, Experian and TransUnion reports free at AnnualCreditReport.com. The bureaus have made weekly free reports there permanent. Go line by line and write down every item that isn't yours:
- Accounts you didn't open (cards, loans, phone or utility accounts)
- Collections for debts you never had
- Hard inquiries from lenders you never applied with
- Addresses, name variations or employers you don't recognize
Note which bureau shows each item. Fraud often appears on only one or two reports.
Step 2: Stop the bleeding with a fraud alert and a freeze
Place an initial fraud alert by contacting any one bureau, which must notify the other two. Then freeze your credit at each bureau separately. A freeze is free and stops most new accounts from being opened. If you're unsure which tool does what, see our guide to freezes, fraud alerts and locks. After you have an Identity Theft Report (Step 4), you can upgrade to a 7-year extended fraud alert.
Step 3: Call the companies where fraud happened
Contact the fraud department of each company where an account was opened or misused. Ask them to close the account, note that it's fraud, and send you written confirmation. Keep a log of every call: the date, the person's name and what they said.
Step 4: File at IdentityTheft.gov
The FTC's IdentityTheft.gov walks you through a report and produces two things you'll use repeatedly:
- An FTC Identity Theft Report. This is the document that triggers your 605B blocking rights and qualifies you for an extended fraud alert.
- A personal recovery plan with pre-filled letters for bureaus, businesses and collectors.
Some businesses also ask for a police report. If one asks, file with your local police and bring your FTC report with you.
Step 5: Send a 605B block request to each bureau
This is the step most people miss. Under 15 U.S.C. 1681c-2 (FCRA 605B), a bureau must block identity-theft information when you provide:
| You must send | Why |
|---|---|
| Proof of your identity | So the bureau knows the request is really from you |
| A copy of your identity theft report | Your FTC Identity Theft Report qualifies |
| Identification of the specific information | List each account, collection or inquiry by name and number |
| A statement that it doesn't relate to any transaction you made | The core of the request |
Once the bureau has those, it must block the information no later than 4 business days after receiving them, and it must notify the company that furnished the information. The law lets a bureau decline or rescind a block only in limited situations: if the block was requested in error, if it was based on a material misrepresentation, or if you actually received goods, services or money from the transaction. If the bureau declines or rescinds a block, it has to tell you promptly.
Send requests by certified mail with return receipt, or use the bureau's online identity-theft channel if it accepts the same documents. Our free dispute letter generator can help you format the letter; attach the FTC report and your ID copy.
✓ 605B block vs regular dispute
A regular dispute asks the bureau to investigate, and furnishers generally have 30 days to respond, according to the CFPB. A 605B block applies when you have an identity theft report, and the bureau must act within 4 business days. Use the block for fraud and the regular dispute process for ordinary errors.
Step 6: Write to the furnishers too
The CFPB recommends disputing with both the bureau and the company that supplied the information, in writing, by certified mail. Send each furnisher a copy of your FTC report and ask it to stop reporting the fraudulent account. The pre-filled letters from IdentityTheft.gov cover this.
Step 7: Handle collectors chasing fraudulent debts
If a collector contacts you about a debt that isn't yours, dispute it in writing. The CFPB explains that you have 30 days from the validation notice to dispute, and that once you dispute, the collector can't contact you to collect until it responds with verification. Tell the collector the debt resulted from identity theft and include your FTC report. Our debt validation letter guide explains the process.
Step 8: Clean up inquiries and personal information
Fraudulent hard inquiries and unfamiliar addresses can go in the same 605B request. List them specifically. Hard inquiries from applications you actually made are a different matter, covered in our guide to hard vs soft inquiries.
Step 9: Verify, then keep watching
- About two weeks after sending your requests, pull fresh reports and confirm each item is gone.
- If something remains, send a follow-up with copies of your original request and the certified mail receipt.
- If a bureau or company won't fix it, file a complaint with the CFPB. Companies generally respond through that portal.
- Keep the freeze in place and keep checking your reports.
⚠️ You don't need to pay anyone for this
The FTC notes that credit repair companies can't legally do anything you can't do yourself for free. Be especially wary of anyone who asks for payment before doing any work. See our credit repair scams guide.
Keep a recovery log
Identity theft cleanup can take weeks, and you may have to prove what you sent and when. Keep one document or notebook with:
- Every contact: date, company, department, the name of the person you spoke with, and what they agreed to do
- Every letter sent: a copy, the date mailed, and the certified mail tracking number
- Every response: letters, emails and updated reports, filed by bureau
- Deadlines: the 4-business-day block window for each bureau, and 30-day dispute windows for collectors
- Costs: postage, copies and time off work, in case you later pursue reimbursement
When it's more than your credit report
Fraud on your credit report sometimes comes with other misuse of your information, such as tax returns filed in your name, medical services billed to you, or benefits claimed using your Social Security number. IdentityTheft.gov asks what happened and tailors the recovery plan to the types of theft you report, so answer its questions fully rather than just listing the credit accounts.
For ordinary errors you find along the way, such as a wrong balance or a late mark that isn't fraud, use the regular process in our DIY dispute guide.
Cleanup checklist
- All three reports pulled, fraudulent items listed by bureau
- Initial fraud alert placed (one bureau notifies the others)
- Freezes placed at Equifax, Experian and TransUnion
- Fraud departments called; accounts closed; confirmations saved
- FTC Identity Theft Report filed at IdentityTheft.gov
- 605B block requests sent to each bureau (proof of ID, report copy, item list, statement)
- Letters sent to furnishers and collectors
- Extended fraud alert placed (optional, 7 years)
- Follow-up reports checked; CFPB complaint filed if needed
Frequently Asked Questions
How long do credit bureaus have to remove identity theft from my report?
Under FCRA section 605B, a bureau must block identity-theft information no later than 4 business days after it receives your proof of identity, a copy of your identity theft report, the specific items, and your statement that they are not your transactions.
Do I need a police report for identity theft?
An FTC Identity Theft Report from IdentityTheft.gov qualifies as an identity theft report for blocking and extended fraud alerts. Some businesses still ask for a police report, so file one if a company requires it.
Can a bureau refuse to block fraudulent accounts?
Only in limited cases: if the block was requested in error, was based on a material misrepresentation, or you received goods, services or money from the transaction. The bureau must notify you promptly if it declines or rescinds a block.
Should I pay a company to fix identity theft on my credit?
No. The FTC says credit repair companies cannot legally do anything you cannot do yourself for free, and IdentityTheft.gov provides free pre-filled letters.
The Bottom Line
Identity theft cleanup is paperwork, not magic, and you can do all of it yourself for free. File at IdentityTheft.gov, freeze your credit, then send 605B block requests to each bureau with your FTC report. The bureau has 4 business days once it has everything. Follow up in writing and escalate to the CFPB if anyone drags their feet.
Sources
- FTC: IdentityTheft.gov recovery steps
- 15 U.S.C. 1681c-2 (FCRA 605B: blocking identity-theft information)
- 15 U.S.C. 1681c-1 (FCRA 605A: fraud alerts and security freezes)
- FTC: What to know about credit freezes and fraud alerts
- CFPB: How do I dispute an error on my credit report?
- CFPB: What if I don't owe the debt or want more information about it?
- CDIA: Equifax, Experian and TransUnion make free weekly credit reports permanent (Sept 2023)
- CFPB: Submit a complaint
- FTC: Fixing your credit FAQs