Recovering from Identity Theft and Fixing a Credit Report: A Practical Guide

Summary. Freeze first, document second, block rather than dispute where identity theft is involved, and keep the evidence of who saw the report.

For the statutory framework — the accuracy duty, the reinvestigation obligation, the liability provisions, and the standing rules — see Identity Theft and Credit Reporting. This guide is what to do, in order.

The two sentences that matter most:

Freeze your credit today. It is free, it takes fifteen minutes, and it stops the bleeding.
Dispute through the credit bureaus, not directly with the creditor — a direct dispute generally does not preserve your right to sue.

Hour 1: Freeze

Place a security freeze at all three nationwide bureaus. Free by federal law. Placed within one business day of an electronic request, lifted within one hour.

A freeze blocks new credit from being opened in your name. It does not affect your existing accounts, your score, or your ability to use the credit you have. You lift it temporarily when you apply for something.

Also freeze:

Your children's files, where the law provides for it. Child identity theft goes undetected for years.
The specialty agencies that permit it — check screening, tenant screening, and the databases used for new bank accounts.

A fraud alert is not a substitute. An alert asks users to verify identity; a freeze prevents access. Place an alert too — it is free and one bureau must notify the others — but the freeze is the protection.

Hour 2: Secure the accounts

Email first. Whoever controls your email can reset everything else. Change the password, enable multi-factor authentication using an authenticator app or hardware key rather than text messages, and check the account's forwarding rules and recovery addresses — attackers add a forwarding rule so they keep receiving your mail after you change the password.

Then financial accounts: new passwords, multi-factor authentication, and a review of recent activity and of any changed contact information.

Then your phone carrier. Add a port-out PIN or account passcode. A SIM swap defeats text-message-based verification and is the mechanism behind most large account takeovers.

Change security questions, especially if the perpetrator may know you. "Mother's maiden name" and "first pet" are not secrets from a family member.

Day 1: Document

Pull all three credit reports. They differ; an item on one may be absent from another.

Read every line, including the personal information section. A wrong address, a wrong middle initial, or an unfamiliar employer is often the first evidence of a mixed file or of an identity thief establishing an address.

Make a list of every account, inquiry, and item that is not yours, with the creditor name, account number as reported, date opened, and balance.

File an identity theft report. This is not paperwork for its own sake — it is the key to the strongest remedy in the statute. It generally consists of:

The federal identity theft report submitted to the Federal Trade Commission, which generates a sworn affidavit; and
A police report, which many creditors require and some jurisdictions resist writing. If police decline, say that federal law contemplates a report and that you need one for a credit bureau block. Persist politely.

Notify each creditor where a fraudulent account was opened, in writing, and ask them to close the account as fraudulent, stop reporting it, and confirm in writing.

Demand the transaction records. You have a right to obtain from the business the application and transaction records made in your name by the thief. Ask for them by name. They show what the thief did, what identifying information they used, and sometimes where they were — all of which matters for the police report and for stopping the next attempt.

Day 2–5: Block, don't just dispute

This is the step almost nobody takes, and it is the most valuable one.

For each fraudulent item, send the bureaus a request to block information resulting from identity theft, enclosing:

Appropriate proof of your identity;
A copy of your identity theft report;
Identification of the specific information to be blocked; and
A statement that the information does not relate to any transaction by you.

The agency must block within four business days and notify the furnisher.

Why a block beats a dispute. A dispute triggers an investigation that can end with "verified," and frequently does when the furnisher's own records show the account as valid — which they will, because the thief's application looked valid. A block is near-automatic on proper documentation. It does not ask the furnisher whether the account exists; it declares that it is not yours and requires it to be suppressed.

Send the same package to the furnishers and to any debt collector. On receipt, a furnisher generally may not continue reporting the information, and a collector must notify the creditor that the information may be fraudulent.

Week 1: Write disputes that cannot be brushed off

For errors that are not identity theft — wrong balances, wrong dates, accounts that are not yours because of a mixed file, discharged debts still reported as owing — the tool is the dispute, and it must go through the bureaus.

A dispute that works has six parts:

Identification — full name, addresses for two years, date of birth, Social Security number, and copies of a government ID and a utility bill. Insufficient identification is the most common reason disputes are rejected without review.
The item, precisely — creditor name exactly as it appears, account number as reported, the specific field disputed, the page of the report.
What is wrong, in one sentence. "This account was never opened by me." "The date of first delinquency is reported as 3/2021; it was 3/2018." "This balance was discharged in bankruptcy on 11/2019."
What the correct information is.
The evidence, attached. This is what makes a perfunctory investigation unlawful — a furnisher that receives contradicting documents and answers "verified" without examining them has not investigated reasonably. But the documents only reach the furnisher if you attach them to the dispute to the bureau, which must forward all relevant information.
The requests — deletion or correction; a free copy of the revised report; and that corrected reports be sent to everyone who received the report in the past six months, and two years for employment purposes. That last request is free, rarely made, and is how you undo harm rather than merely stop it.

Send it provably. Certified mail with return receipt, or the online portal with a screenshot and confirmation number. Online is faster; paper creates a cleaner record and permits attachments that portals sometimes truncate. Doing both is not paranoid.

Keep a dispute log: date sent, method, item, evidence attached, response date, outcome, and whether the item later returned.

Week 2–6: Track the clock and read the responses

The reinvestigation deadline is generally 30 days, extendable modestly if you supply additional information during the period.

When the results arrive, read them carefully. "Verified as accurate" is not the end. Ask:

What did they actually do? You may request a description of the reinvestigation procedure, including the business contacted. Ask for it.
Was my evidence forwarded? If the furnisher says it never received your documents, that is a violation by the agency.
Did the personal information get fixed? In a mixed file, deleting the tradeline without correcting the identifiers means it re-merges next quarter.

If an item was deleted and reappears: reinsertion requires the furnisher to certify completeness and accuracy, and the agency must notify you in writing within five business days. Ask, in writing, for the certification and the notice. Their absence is a discrete violation — and repetition after notice is the strongest available evidence of the reckless disregard that opens the door to statutory and punitive damages.

The mixed file problem, specifically

If someone else's accounts are on your report, deleting them one at a time will not hold. The matching logic that merged the files will merge them again.

Attack the identifiers:

Point out every incorrect address, name variant, employer, and partial Social Security number in the personal information section, and demand their removal.
State explicitly that you believe your file has been merged with that of another consumer, and name the differences — different middle name, different date of birth, different suffix.
Ask the agency to place a file separation or fragmenting review, using whatever term the bureau uses; the internal processes exist.
Re-pull your report every quarter for a year to confirm it has not re-merged.

Mixed files are among the most damaging errors and among the hardest to fix administratively. If two rounds of disputes do not hold, this is the fact pattern most likely to warrant a consumer lawyer.

The reports you did not know you had

If you were denied an apartment, a bank account, a job, or an insurance policy, the decision may have come from a specialty consumer reporting agency — tenant screening, employment screening, check and account screening, insurance claims history, medical information exchanges, utility and telecom histories, gig platform screening.

All of them are subject to the same rules.

The sequence:

Demand the adverse action notice from whoever denied you. It must identify the agency. Landlords and small employers routinely skip this, and the omission is itself a violation.
Request your file from that agency — free after an adverse action.
Dispute, with the same six-part structure.
Demand corrected reports be sent to everyone who received it.

The eviction-record trap: tenant screening reports frequently list eviction filings without the outcome, so a case that was dismissed or that you won appears as an eviction. Reporting a filing without its disposition is a strong "materially misleading" argument, and several states have sealing statutes aimed at exactly this. See Handling a Landlord-Tenant Dispute.

The employment trap: an employer must give a standalone disclosure, obtain written authorization, and provide a pre-adverse action notice with a copy of the report and a summary of rights before finalizing the decision, so the applicant can correct errors. Employers get this wrong constantly.

If a debt collector shows up

Fraudulent accounts frequently end up with collectors, and the tools compound.

Dispute in writing within 30 days of the collector's first communication and demand validation — collection must cease until it is provided.
Send the identity theft report and state that the debt is the product of identity theft. A collector who receives that documentation must notify the creditor.
Do not make a payment, even a small one, on a debt that is not yours. It can be characterized as an acknowledgment.
If sued, do not ignore it. A default judgment on a fraudulent debt is far harder to undo than a defended case. See Defending a Debt Collection Lawsuit.

When to call a lawyer

Call one if: the same error has survived two properly documented disputes; an item was reinserted without notice; a mixed file keeps re-merging; you lost a job, an apartment, a loan, or a rate because of the error; or the volume of fraudulent accounts is large.

Why it is affordable: the statute shifts fees to a prevailing consumer, so consumer lawyers routinely take these cases on contingency with no money up front. The consultation is usually free.

What to bring: your dispute log, all three reports pulled at intervals, every dispute and response, proof of mailing, the list of who received the report, and the denial letters.

The specific kinds of identity theft, and what each requires

"Identity theft" describes a dozen different crimes with different consequences and different fixes. Knowing which one you have saves weeks.

New account fraud

Someone opens credit cards, loans, or utility accounts in your name.

The signature symptom: unfamiliar accounts and inquiries on your report; collection calls for debts you never incurred.

The fix: freeze, identity theft report, block at all three bureaus, written fraud notice to each creditor, and a demand for the transaction records. This is the paradigm case for which the block remedy exists, and it resolves cleanly when the paperwork is right.

Account takeover

Someone gains control of an account you already have.

The signature symptom: a password reset you did not request, a changed address or phone number on an account, transactions you did not make, or a sudden inability to log in.

The fix is different and more urgent. This is not primarily a credit reporting problem; it is a security problem with a short window. Contact the institution's fraud department by phone immediately, freeze or close the account, change credentials everywhere the same password was used, and check the account for changed contact information and added authorized users. Then deal with any credit reporting fallout.

Report unauthorized electronic fund transfers fast. Consumer liability for debit card and electronic transfer fraud escalates sharply with delay — small if reported within a couple of days of learning of it, much larger after, and potentially unlimited for transfers appearing on a statement you did not report within sixty days. Credit cards carry stronger protections than debit cards, which is a genuine reason to use a credit card for online purchases.

Tax identity theft

Someone files a return using your Social Security number to claim a refund.

The signature symptom: your electronic return is rejected as a duplicate, or you receive a notice about a return you did not file or wages from an employer you never had.

The fix: file the identity theft affidavit with the tax authority, obtain an identity protection PIN for future filings, file your real return on paper if necessary, and expect the process to be slow. See IRS Tax Controversy.

Employment identity theft

Someone uses your Social Security number to work.

The signature symptom: a tax notice about unreported income from an employer you never had; a Social Security earnings record showing wages that are not yours.

The fix: correct the earnings record with the Social Security Administration — which matters for your eventual retirement benefit — and address the tax notice. See Claiming Social Security.

Medical identity theft

Someone obtains treatment in your name.

The signature symptom: an explanation of benefits for care you did not receive; a collection notice from a provider you never visited; a benefit limit exhausted.

This one is dangerous beyond credit, because the thief's medical information may be merged into your chart — blood type, allergies, diagnoses. Request your medical records from the provider, in writing, and demand correction of entries that are not yours. Notify your insurer's fraud unit. See Appealing a Health Insurance Denial.

Criminal identity theft

Someone gives your name when arrested.

The signature symptom: a background check showing charges you know nothing about; a warrant; a denied job.

The fix is court-based, not bureau-based: obtain the court records, compare fingerprints and identifiers, petition the court for a determination of factual innocence or an identity theft designation where the state provides one, and then correct the background reporting. This one usually needs a lawyer.

Child identity theft

Someone uses a minor's Social Security number, often for years.

The signature symptom: a child receives pre-approved credit offers, a collection notice, or a tax notice; or a credit report exists at all for someone under eighteen.

The fix: request a report on the child's behalf, freeze the child's file where the law provides, file an identity theft report, and block. Check before the child turns eighteen, not when they apply for a first student loan and discover a decade of debt.

Synthetic identity fraud

The hardest one: a fabricated identity combining your Social Security number with someone else's name and date of birth.

The signature symptom: accounts in your report under a name that is not yours; a mixed file that will not stay unmerged; inquiries from lenders in places you have never been.

The fix combines both playbooks: identity theft reports and blocks for the fraudulent tradelines, plus aggressive correction of the personal-information identifiers that let the synthetic identity attach to your file. This is the fact pattern most likely to require a consumer lawyer, because administrative fixes tend not to hold.

A realistic timeline

People ask how long this takes. The honest answer, for a straightforward case handled well:

When	What happens
Day 1	Freeze in place; accounts secured; reports pulled
Day 1–3	Identity theft report filed; creditors notified in writing
Day 2–7	Block requests sent; four business days for the bureaus to block
Week 2	Fraudulent tradelines start disappearing from reports
Week 2–6	Reinvestigation of any non-identity-theft disputes (30 days)
Week 6–8	Re-pull all three reports; verify deletions held
Month 3	Re-pull again; watch for reinsertion
Month 6	Re-pull; consider lifting fraud alert; keep the freeze
Ongoing	Annual report pulls; freeze stays on permanently

A complicated case — a mixed file, synthetic fraud, criminal identity theft, or a furnisher that keeps verifying — runs six months to two years, which is exactly when a consumer lawyer earns their contingency.

The thing that most shortens the timeline is the quality of the first package: complete identification, a real identity theft report, precise item identification, and the documents attached. A well-built first submission gets a four-day block. A vague one gets a "verified" and starts the cycle over.

Errors that are not identity theft, and how to fix each

Most credit report problems are not fraud. They are ordinary data failures, and each has a characteristic fix.

The account that was paid but still shows a balance. Attach the payoff letter, the cancelled check or bank record, and the settlement agreement if there was one. Dispute the balance field specifically, not the account.

The debt discharged in bankruptcy still reported as owing. Attach the discharge order and the schedule listing the debt. Reporting a discharged debt as an outstanding balance is one of the cleaner accuracy violations there is, and furnishers are supposed to update systematically after discharge — many do not. See Chapter 7 Liquidation and Creditors' Rights.

The re-aged debt. Compare the date of first delinquency across all three bureaus and against your own records. The seven-year reporting period runs from the first delinquency that led to the charge-off — not from when a debt buyer bought it, and not from the date of last payment. A debt buyer reporting a fresh date has restarted a clock that should have been running toward expiration, and that is a strong dispute with a clear factual basis.

The duplicate. The same debt reported by the original creditor and by one or more collectors, all showing a balance, so a single $3,000 debt looks like $9,000. The original creditor's tradeline should show a zero balance once the debt was sold or placed. Dispute the balances, not the existence.

The account that is not yours because you were an authorized user. Authorized user accounts appear on your report and can help or hurt. You can generally have them removed by asking the issuer to remove you as an authorized user, which is faster than a dispute.

The account that is not yours because of divorce. A decree assigning a debt to your former spouse does not bind the creditor. If your name is on the account, the late payments are yours to carry. The remedy is refinancing or removal by the creditor, not a dispute — the reporting is accurate. Build enforcement into the decree instead. See Divorce and Dissolution.

The inquiry you did not authorize. Hard inquiries require a permissible purpose. A pull by a company you never dealt with is worth a letter to both the company and the bureaus asking on what basis the report was obtained. It is a small violation with a real answer.

The wrong personal information. Addresses, employers, name variants. Not merely cosmetic — these are the fields that cause mixed files. Dispute them explicitly and separately.

The student loan reported wrong after rehabilitation. Successful rehabilitation removes the default notation (though not the individual late payments). Servicers sometimes fail to update. Attach the rehabilitation completion letter. See Student Loans.

What to do about scores, and what not to bother with

A credit score is not part of your credit report. It is a model applied to the report, and there are many models, so the number a lender sees differs from the one an app shows you. Fixing the report is what matters; the score follows.

What actually moves a score, in rough order:

Payment history. Nothing else comes close. One thirty-day late can cost more than a large balance.
Utilization — balances relative to limits, on revolving accounts. Paying a card down before the statement closes affects the reported balance and therefore the score, even if you pay in full every month anyway.
Age of accounts. Closing an old card shortens your history and can reduce available credit. Usually better to keep it open with a small recurring charge.
Mix and new inquiries — real but minor.

What does not work: paying someone to remove accurate information; opening several accounts to "build credit" quickly; closing cards to look responsible; disputing accurate items in the hope a furnisher fails to verify. That last one is a common credit-repair tactic, and it produces temporary deletions, later reinsertions, and a file full of disputes that a careful underwriter will notice.

One genuinely useful and underused move: if you have a single late payment on an otherwise good account, ask the creditor for a goodwill adjustment. There is no legal right to it, and creditors grant them anyway with some regularity for long-standing customers with a good explanation. A polite letter costs a stamp.

And a note on "pay for delete." Asking a collector to remove a tradeline in exchange for payment is common. Collectors sometimes agree. Whether they follow through is another matter, and the agreement must be in writing before you pay — after payment you have no leverage at all.

Building the file, in case you need it later

Everything above is also evidence. Keep it as though a lawyer will read it in a year, because one might.

The folder, in six sections:

Reports. All three, pulled at the start and then quarterly, saved as dated PDFs. The point is the sequence — the item present, disputed, deleted, and (if it happens) reinserted.
Disputes and blocks. What you sent, when, how, with what attached, and the confirmation number or certified mail receipt.
Responses. Every result letter. Note whether the response addresses the evidence you attached.
Dissemination. The inquiry list, plus the list of everyone who received the report in the past six months — which the agency must give you on request. Request it. After the Supreme Court's standing decisions, dissemination is what turns a violation into a case.
Harm. Denial letters, rate quotes before and after, the rescinded offer, the larger security deposit, the extra interest. Also a short contemporaneous note of what happened and how it affected you — written now, not reconstructed later.
The call log. Date, time, company, representative, reference number, what was said. Bureaus and furnishers both give reference numbers; ask every time.

Two habits that cost nothing and matter enormously:

Re-pull after every fix and again three months later. Deletions that do not hold are common and the reinsertion rules give you a discrete remedy — but only if you notice.
Write down the date you learned of each problem. Statutes of limitation in this area generally run from discovery, and the discovery date is a fact you should be able to state precisely.

When the file is complete and the problem is not fixed, it takes a consumer lawyer about twenty minutes to evaluate it — and because the statute shifts fees to a prevailing consumer, that evaluation is usually free and the representation is usually contingent.

Living with a freeze

A great many people avoid freezing their credit because they imagine it will be inconvenient. In practice it costs about ten minutes a year.

How it actually works: the freeze stays on permanently. When you apply for credit — a car loan, a mortgage, a new card, sometimes a utility or a mobile phone account — you ask the lender which bureau they pull, log in, and lift the freeze on that bureau for a few days. Federal law requires a lift within one hour of an electronic or telephone request.

What a freeze does not affect: your existing accounts, your score, your ability to use your cards, your ability to see your own report, or pre-existing creditors' account reviews.

What it does block: employment screening pulls and some insurance or utility applications, which is why the "which bureau do you use?" question matters. Ask before you apply, not after you are declined.

Keep the PINs somewhere you will find them. Some bureaus issue a PIN for lifting; losing it means an identity verification process at the worst moment. Store them where you keep your passwords, not in an email.

Freeze everyone in the household. Spouse, children where the law allows, and — if you have authority — an elderly parent whose file is a frequent target. Elder financial exploitation frequently begins with credit opened in a parent's name by someone with access to their documents. See Elder Law and Long-Term Care.

And do it before you need it. A freeze placed after the accounts are opened stops the next one; it does not undo the last one. The ten minutes is worth spending on an ordinary Tuesday.

Helping someone else through it

Identity theft lands hardest on people least equipped to fight it — an elderly parent, a young adult, someone in a crisis. Four notes for the helper.

You will need written authorization. Bureaus, creditors, and collectors will not discuss another adult's file with you. A signed authorization letter, or a power of attorney, has to come first. Prepare it before the first call rather than discovering the obstacle in the middle of one.

Do the freeze first, together, on the first visit. It is the step with the highest ratio of protection to effort, and it is the one that keeps the problem from growing while you work through everything else.

Take over the record-keeping, not the decisions. The most useful thing a helper does is build and maintain the folder — reports, disputes, responses, call log — because that is the part that fails when someone is overwhelmed. The decisions about whether to name a family member as the perpetrator, whether to press charges, and whether to sue belong to the person whose identity it is.

Watch for the shame reaction. Victims frequently blame themselves, particularly when the perpetrator was someone they trusted, and the response is often to stop opening mail. The useful frame is that this is a paperwork problem with defined procedures and statutory deadlines, most of the remedies are free, and none of it requires admitting anything to anyone.

For an elderly parent specifically, add three checks: is anyone new handling their mail or their finances; are there new authorized users on their accounts; and has anyone been added to a deed or a bank account. Financial exploitation of older adults usually begins with access rather than with theft of data. See Elder Law Toolkit.

Where to complain, and what each complaint accomplishes

Complaints are free and they work more often than people expect, largely because regulated entities are measured on response rates.

The Consumer Financial Protection Bureau. The most effective single channel for credit reporting and debt collection problems. Companies must respond within a short window, the response goes into a public database, and the complaint creates a record you can attach to a later demand or a lawsuit. Be specific: dates, account numbers, what you sent, what they did, and what you want.

The Federal Trade Commission. The source of the federal identity theft report and affidavit, and the aggregator of identity theft data. Filing here is not a substitute for a bureau dispute, but the affidavit it generates is the document the block remedy runs on.

Your state attorney general. Frequently effective against furnishers and collectors operating in the state, and some offices maintain active consumer mediation programs.

Your state financial regulator or banking department, for problems with a state-chartered institution.

The prudential regulator, for a national bank or federal credit union.

Local police, for the report that many creditors demand.

What complaints do not do: they do not toll a statute of limitations, they do not substitute for a dispute through the bureaus, and they do not produce damages. File them in addition to, not instead of, the steps in this guide — and keep the confirmation numbers, because a documented complaint that produced no correction is itself evidence.

Twelve mistakes

Not freezing. The single highest-value step, free, and skipped by most people.
Disputing directly with the creditor only. It generally does not preserve a private right of action.
Sending a one-line dispute with no evidence. It invites a thirty-second "verified."
Filing a dispute when a block was available. Blocks are near-automatic in four business days; disputes can end in "verified."
Skipping the identity theft report because it seems like paperwork. It is the key to the block.
Never requesting the transaction records from the businesses where fraudulent accounts were opened.
Forgetting to ask that corrected reports be sent to everyone who received the old one.
Not tracking dissemination. Without it, a violation may not be a case.
Fixing the tradeline but not the identifiers in a mixed file, so it re-merges.
Not re-pulling reports three months later to catch reinsertion.
Paying a credit repair company to send letters you can send yourself.
Making a small payment on a fraudulent debt to make a collector go away — it can be treated as an acknowledgment.

The one-page version

Freeze all three bureaus today. Free. Then children, then specialty agencies.
Secure email first, with an authenticator app, then financial accounts, then your phone carrier's port-out PIN.
Pull all three reports and read every line, including personal information.
File the identity theft report — federal affidavit plus police report.
Block, don't just dispute, for identity theft items. Four business days.
Dispute through the bureaus, never only the creditor, with the six-part structure and the documents attached.
Ask for corrected reports to be sent to everyone who received the report.
Demand the transaction records from the businesses involved.
Re-pull at six weeks, three months, and six months. Watch for reinsertion.
Keep the folder — reports, disputes, responses, dissemination, harm, call log.
Call a consumer lawyer if two documented disputes fail. Fees shift; consultations are free.

Frequently asked questions

What is the very first thing to do? Freeze all three bureaus. Today. It is free.

Dispute with the creditor or the bureau? The bureau. Direct disputes generally do not preserve a private right of action.

What is a "block" and why does it matter? For identity theft items, a block must occur within four business days on proper documentation — far stronger than a dispute, which can end in "verified."

How do I get an identity theft report? File with the Federal Trade Commission to generate the affidavit, and obtain a police report. Both together are what creditors and bureaus expect.

They keep putting the item back. Is that legal? Only with furnisher certification and written notice to you within five business days. Ask for both.

Do I need to pay a credit repair company? No. They send dispute letters you can send yourself, and they cannot lawfully remove accurate current information.