The damage to your credit report
When someone uses your personal information to open accounts, the fraudulent activity lands on your credit report in multiple ways:
- New accounts opened in your name (credit cards, loans, utilities, phones)
- Hard inquiries from lenders that never actually lent to you
- Addresses and phone numbers that aren't yours
- Collections from debts you never incurred
- Late payments on accounts you didn't open
In some cases, victims don't find out for months or years — when they apply for credit and get denied, or see an unfamiliar account during a routine report review.
Step 1: Place a fraud alert
A fraud alert is a free notice you place with one bureau — that bureau is required to notify the other two, so you only need to file with one. It tells lenders to take extra steps to verify your identity before issuing credit.
There are two types:
- Initial fraud alert — Lasts one year, renewable. Requires lenders to contact you before opening new credit.
- Extended fraud alert — Lasts 7 years. For confirmed identity theft victims. Requires lenders to contact you directly using contact information you specify.
To place a fraud alert:
- Equifax: equifax.com/personal/credit-report-services/credit-fraud-alerts/
- Experian: experian.com/fraud/center.do
- TransUnion: transunion.com/credit-disputes/fraud
You only need to contact one bureau. They must notify the other two.
Step 2: Place a credit freeze
A credit freeze (also called a security freeze) is stronger than a fraud alert. When your file is frozen, no one — including you — can open new credit in your name without lifting the freeze first. Lenders cannot access your file at all.
Freezes are free, can be placed and lifted online, and don't affect your existing accounts or score. You can lift a freeze temporarily when you need to apply for credit.
Unlike a fraud alert, you must place a credit freeze with each bureau separately:
- Equifax: equifax.com/personal/credit-report-services/credit-freeze/
- Experian: experian.com/security/credit-freeze.html
- TransUnion: transunion.com/credit-disputes/credit-security-freeze
If identity theft is confirmed or likely, place the freeze at all three. A fraud alert is a warning; a freeze is a lock.
Step 3: Get your credit reports
Pull your reports from all three bureaus at AnnualCreditReport.com. Go through each one line by line and identify:
- Any account you don't recognize
- Hard inquiries you didn't initiate
- Addresses or phone numbers that aren't yours
- Any collection or derogatory entry you don't recognize
Document every fraudulent item with the account number, bureau showing it, and the reported balance or date.
Step 4: File an identity theft report with the FTC
Go to identitytheft.gov. The FTC's identity theft reporting tool generates an official Identity Theft Report — this is a legal document that carries weight with bureaus and creditors. Filing through identitytheft.gov creates a formal complaint and produces a personalized recovery plan.
Download and save your Identity Theft Report. You'll use it repeatedly.
Step 5: Dispute fraudulent accounts with the bureaus
Each bureau has a dedicated fraud dispute process. Attach your Identity Theft Report to each dispute.
Under FCRA Section 605B, bureaus must block the reporting of information that resulted from identity theft within 4 business days of receiving:
- Proof of your identity
- A copy of your identity theft report
- The specific items you're identifying as resulting from identity theft
- A statement that the items are not related to any transaction you conducted
This "block" provision is stronger than a standard dispute. The information must be blocked, not just investigated.
Step 6: Dispute with the creditors directly
The fraudulent creditors — whoever opened the accounts — are obligated to investigate and resolve fraud claims. Contact each one's fraud department directly. Each will have a process for fraud affidavits.
Use the same Identity Theft Report. Send everything certified mail with return receipt.
Extended fraud alert: the longer-term protection
If you're filing an extended fraud alert (7 years), you're also entitled to two free credit reports from each bureau within 12 months of placing it, and to have your name removed from pre-screened credit offer lists for 5 years.
What to watch for after you clean up your file
Identity theft can be recurring, especially if the underlying breach (a data leak, a stolen wallet) hasn't been resolved. Monitor your reports regularly — a freeze plus regular monitoring is the strongest ongoing protection.