Identity Theft Response and Credit Dispute Checklist: A Practical Checklist

Summary. Nine sequences from the first hour through litigation preparation. Every step is free.

1. Hour one — freeze

Place a security freeze at all three nationwide bureaus. Free by law.
Place a fraud alert as well (one bureau must notify the others).
Freeze children's files where the law provides.
Freeze the specialty agencies that permit it (check screening, tenant screening).
Store the freeze PINs where you keep passwords — not in email.

Email first: new password, multi-factor authentication via authenticator app or hardware key, not text messages.
Check email forwarding rules and recovery addresses — attackers add them.
Financial accounts: new passwords, MFA, review recent activity and changed contact details.
Phone carrier: add a port-out PIN (a SIM swap defeats text-based codes).
Change security questions, especially if the perpetrator may know you.
Report unauthorized electronic transfers immediately — liability escalates sharply with delay.

Pull all three credit reports; they differ.
Read every line, including the personal information section (wrong addresses signal mixed files).
List every account, inquiry, and item that is not yours: creditor, account number as reported, date opened, balance.
File the federal identity theft report to generate the sworn affidavit.
File a police report; persist if police resist — it is needed for the block.
Notify each creditor in writing: close as fraudulent, stop reporting, confirm in writing.
Demand the transaction records — the application and transaction documents made in your name.

Send each bureau a block request enclosing: proof of identity; the identity theft report; identification of the specific items; and a statement that they do not relate to any transaction by you.
Note the deadline: the agency must block within four business days and notify the furnisher.
Send the same package to each furnisher and any debt collector.
Understand why: a block is near-automatic; a dispute can end in "verified."

Each dispute must contain:

Identification — name, two years of addresses, DOB, SSN, copies of government ID and a utility bill.
The item, precisely — creditor name as reported, account number as reported, the field disputed, page of the report.
What is wrong, in one sentence.
What the correct information is.
The evidence, attached — this is what makes a perfunctory investigation unlawful.
The requests — deletion or correction; free revised report; and corrected reports sent to everyone who received it in the past six months (two years for employment).
Send through the bureaus — a direct dispute to the furnisher generally does not preserve a private right of action.
Send provably: certified mail with return receipt, or portal with screenshot and confirmation number.
Start a dispute log: date, method, item, evidence, response, outcome, later reappearance.

Calendar the 30-day reinvestigation deadline.
Read the results: "verified" is not the end.
Request a description of the reinvestigation procedure, including the business contacted.
Confirm your evidence was forwarded to the furnisher.
Confirm the personal information errors were corrected, not just the tradeline.
If an item reappears: demand the furnisher's certification and the written notice within five business days. Absence is a discrete violation.

Identify and dispute every wrong address, name variant, employer, and identifier.
State expressly that you believe your file has been merged with another consumer's.
Name the differences: middle name, date of birth, suffix.
Ask for a file separation review.
Re-pull quarterly for a year to confirm it did not re-merge.

Demand the adverse action notice from whoever denied you — it must identify the agency.
Request your file from that agency (free after adverse action).
Dispute with the same six-part structure.
Tenant screening: check whether an eviction filing was reported without its outcome.
Employment screening: confirm the employer gave a standalone disclosure, obtained written authorization, and sent a pre-adverse action notice with the report before deciding.
Demand corrected reports be sent to all recipients.

Dispute in writing within 30 days of first contact and demand validation — collection must cease until provided.
Send the identity theft report and state the debt is the product of identity theft.
Do not make any payment, however small.
Never ignore a lawsuit — a default judgment is the worst outcome.

Tax identity theft: file the tax identity theft affidavit; request an identity protection PIN; file on paper if rejected.
Employment identity theft: correct the Social Security earnings record; address the tax notice.
Medical identity theft: request medical records; demand correction of entries that are not yours; notify the insurer's fraud unit.
Criminal identity theft: obtain court records; compare fingerprints; petition for a factual innocence or identity theft designation; then fix the background reporting.
Child identity theft: request the report, freeze, file the identity theft report, block — before the child turns eighteen.
Account takeover: call the institution's fraud line immediately; freeze or close; check for added authorized users and changed contact information.

All three reports, pulled at intervals, saved as dated PDFs.
Every dispute and block request, with proof of delivery and of contents.
Every response letter.
The dissemination list — request who received the report in the last six months (two years for employment).
Harm: denial letters, rate quotes before and after, lost housing or job, larger deposits, and a contemporaneous note of the effect.
Call log: date, time, company, representative, reference number, what was said.
Note the date you learned of each problem — limitations periods generally run from discovery.

Complain to the Consumer Financial Protection Bureau — specific dates, accounts, and requested relief.
Complain to the Federal Trade Commission, the state attorney general, and the relevant financial regulator.
Keep every confirmation number.
Call a consumer lawyer if: two documented disputes failed; an item was reinserted without notice; a mixed file keeps re-merging; or you lost a job, home, loan, or rate.
Note that fees shift to a prevailing consumer — consultations are usually free and representation contingent.

Keep the freeze on permanently; lift it for a few days when applying.
MFA on email first, then finances — authenticator app or hardware key.
Unique passwords in a password manager.
Read statements and pull reports at least annually.
When called or emailed about an account, hang up and call the number on your statement.