Recovering From Identity Theft: The Order Matters
Report, freeze, then dispute with the report in hand. What an identity theft report unlocks that an ordinary dispute does not.
Identity theft recovery is a sequence, and doing it out of order means repeating work. The rights that make recovery effective are attached to a document, and that document has to exist before the disputes that rely on it are filed.
The Order
| Step | Why it is here | What it unlocks |
|---|---|---|
| 1. Freeze the credit reports | Stops further accounts being opened while you work | Prevents the problem growing |
| 2. Create the identity theft report | It is the document later steps depend on | Rights under the Fair Credit Reporting Act |
| 3. Contact the institutions involved | Close fraudulent accounts, secure real ones | Account-level resolution |
| 4. Dispute with the credit reporting companies | With the report attached | Blocking, not just investigation |
| 5. Follow up and keep records | Cases run long | Evidence if it escalates |
The freeze comes first because everything else takes time and the damage compounds while you work.
Freezing
A security freeze blocks access to your credit report, and because a lender cannot obtain a report, a new account generally cannot be opened.
It must be placed with each of the nationwide credit reporting companies separately. Under federal law it is free to place and free to lift, and it can be lifted temporarily when you apply for credit yourself.
A fraud alert is the lighter option: it asks lenders to take reasonable steps to verify identity before extending credit. It is free, it is easier to manage, and it is weaker than a freeze because it relies on the lender acting on it.
Where theft has already occurred, the freeze is the appropriate response. See credit freeze against fraud alert.
Consider also freezing with the specialty reporting companies covering banking and telecommunications, since accounts in those categories are opened using their reports rather than the main three.
The Identity Theft Report
The Federal Trade Commission operates the official reporting process for identity theft. Completing it produces an identity theft report and a recovery plan.
That document matters because the Fair Credit Reporting Act attaches specific rights to it that an ordinary dispute does not carry:
Blocking. Information resulting from identity theft can be blocked from the credit report, which is different from being investigated and found inaccurate.
Access to records. You can require a business to provide records of an account opened in your name, which is how the fraudulent application itself becomes visible.
Stopping continued reporting. A furnisher notified of the theft is restricted from continuing to report the disputed information.
Create it before disputing anything, because a dispute filed without it gets the ordinary process.
Contacting the Institutions
For each fraudulent account, contact the fraud department of the institution directly rather than general customer service. Ask them to close the account, confirm it was fraudulent, and confirm in writing that you are not liable.
For your genuine accounts, change credentials, review recent activity, and check whether contact details on file were altered. Changed contact details are a common step in a takeover, because it redirects alerts away from you.
Assume the email account behind everything else is compromised until you have secured it. Its recovery path is what protects every other account.
Disputing With the Credit Reporting Companies
With the identity theft report in hand, dispute each fraudulent item with each credit reporting company that shows it, and request a block rather than only an investigation.
Do it in writing, attach the identity theft report, and keep proof of what was sent and when. The Fair Credit Reporting Act sets timeframes for the response.
Dispute with the furnisher as well as with the credit reporting company. Both routes exist and both create obligations. See disputing a credit report error.
Keeping Records
Cases that involve several institutions run for months, and details get lost.
Keep a dated log: who was contacted, when, by what method, what was said, and what was promised. Keep copies of everything sent and received. Note reference numbers.
If the case escalates, that log is the evidence. If it does not, it is what stops you repeating conversations.
Where to Escalate
The CFPB accepts complaints about credit reporting companies, furnishers and financial institutions, and forwards them for a response. Where a dispute is being handled improperly, this is the next step and it is free.
State attorney general offices handle identity theft complaints and some maintain their own victim assistance programmes.
What People Get Wrong About This
The first mistake is disputing before creating the identity theft report, which means using the ordinary process and losing the stronger rights.
The second is placing a fraud alert and believing it is the same as a freeze. It relies on lenders acting on a request rather than blocking access.
A third is freezing with one credit reporting company. There are several, and they operate independently.
A fourth is securing the financial accounts while leaving the email account behind them compromised.
And the last is keeping no log. In a case running months across several institutions, the log is the only reliable record of what has been done.
Afterwards
Keep the freeze in place. It costs nothing, it can be lifted temporarily when needed, and it prevents recurrence of the most common mechanism.
Check the reports periodically; free copies are available under the Fair Credit Reporting Act, and items sometimes surface long after the original theft. See free credit report. Nothing here is legal advice.
Common questions
What is the first thing to do after discovering identity theft?
Create the official report before disputing anything. The Federal Trade Commission operates a reporting site that produces an identity theft report, and that document unlocks rights under the Fair Credit Reporting Act that an ordinary dispute does not provide. Disputing first and reporting later means repeating the work.
What is the difference between a fraud alert and a credit freeze?
A fraud alert asks lenders to take extra steps to verify identity before extending credit, and it is free. A freeze blocks access to the report entirely, so a new account generally cannot be opened at all. A freeze is stronger, is also free under federal law, and must be lifted temporarily when you apply for credit yourself.
What does an identity theft report allow?
Under the Fair Credit Reporting Act it supports blocking fraudulent information from a credit report, obtaining documents relating to accounts opened in your name, and stopping a furnisher from continuing to report the disputed item. These are stronger than the rights available on an ordinary dispute.
Do I have to file a police report as well?
Sometimes. Certain creditors and some state processes ask for one, and the FTC identity theft report is accepted in many places on its own. Where a police report is needed, having the FTC report already prepared usually makes filing it straightforward.
How long does recovery take?
It varies enormously with how many accounts were involved and how quickly it was caught. Credit reporting disputes have statutory timeframes, but resolving accounts with individual creditors does not, and cases involving several institutions commonly run for months. Keeping a dated log of every contact is what makes a long case manageable.
Read next
- Adverse Action Notices: What a Denial Letter Must Say A creditor that denies credit must send an adverse action notice. Learn what ECOA and FCRA require it to state, and what the notice does not cover.
- Bankruptcy Basics: Chapter 7, Chapter 13, and Limits Liquidation against reorganisation, the means test as the gate between them, and the debts that generally survive either. Exemptions are state law.
- Cease and Desist Debt Collector: What a Stop-Contact Letter Does Learn how a written cease and desist letter stops debt collector calls under 15 U.S.C. 1692c(c), what it doesn't do, and when it's the wrong move.
- 50/30/20 Budget: How the Split Works and Where It Fails Learn the 50/30/20 budget rule: how the split works, what counts in each bucket, and why it fails for high-rent cities or irregular income. See alternatives.
- Being an Authorized User: What Actually Transfers What carries over and what does not, that the primary holder's behaviour now affects you, and that removal usually takes the history with it.