If you spot a credit-card or loan account on your credit report that you never opened, that is identity theft. Federal law gives you the right to have it removed within 30 days, and the bureaus must block it permanently if you give them the right paperwork. The catch is that a regular dispute is not enough. You have to use the identity-theft track that the Fair Credit Reporting Act spells out.
Here is the 2026 process, from filing the FTC report to getting the fraudulent tradeline deleted from Experian, Equifax, and TransUnion.
The Difference Between a Normal Dispute and an Identity Theft Block
A standard dispute is for errors on legitimate accounts, like a wrong balance or a misreported late payment. The bureau investigates, asks the creditor, and either updates or removes the line.
An identity-theft block is different. Under FCRA Section 605B, if you give the bureau a valid identity-theft report, the bureau must block the disputed information from your file within 4 business days and notify the creditor. The creditor cannot keep reporting it. That is a much faster, more permanent fix than the 30-day dispute clock.
Step 1: File a Report at IdentityTheft.gov
Go to identitytheft.gov and select "Someone has my information or has used it," then "There is an account opened in my name." Answer every question, including names of the creditors, dates, and any contact info you have. The site generates a personalized recovery plan and an FTC Identity Theft Report. That report is your golden ticket.
Download and save the PDF. You will need it for every step that follows.
Step 2: Place a Fraud Alert and Consider a Freeze
A fraud alert tells lenders to take extra steps to verify your identity before opening new credit. It is free and lasts one year, or seven years if you upload the FTC report. Place an alert at any one bureau and the law requires that bureau to share it with the other two.
A credit freeze is stronger. It blocks new applications entirely until you lift it. Freezes are free and apply to each bureau separately. If you are still cleaning up active fraud, freeze all three. Free credit-monitoring tools like Dovly can flag new attempts in near real time so you can react quickly.
Step 3: File a Police Report
A local police report is sometimes optional, but having one strengthens your case. Bring the FTC report, a list of fraudulent accounts, and a photo ID. Ask for a copy of the police report with the report number. Some creditors will only delete an account if a police report is on file.
Step 4: Send a Section 605B Block Letter to Each Bureau
This is the step most people skip. Mail a written block request, certified mail with return receipt, to each of the three bureaus. Include:
- A copy of the FTC Identity Theft Report
- A copy of the police report, if you have one
- A copy of one government photo ID
- Proof of your current address, like a utility bill
- A list of the disputed accounts with creditor name, account number, and date opened
- A signed statement that says the accounts are the result of identity theft
Mailing addresses for the bureau identity-theft units are on each bureau's website. Use the addresses listed for FCRA 605B requests, not the regular dispute addresses.
Step 5: Notify the Creditors Directly
Send the same packet to each creditor that reported a fraudulent account. Use the address listed on the bill or your credit report, not the customer-service line. By law, the creditor must stop reporting the account once it receives a valid identity-theft report and may not transfer the debt to a collection agency.
If the account is already in collections, send the packet to the collection agency too. Collection agencies must close the account and recall it from any sub-collectors.
Related: How to Send a Cease and Desist Letter to Debt Collectors
Step 6: Track Removal and Recheck All Three Bureaus
Within 4 business days, the bureau is required to block the disputed account from your report. Pull a fresh copy from AnnualCreditReport.com after about two weeks. If the account is still there, send a follow-up letter and reference your prior certified-mail tracking number.
If the bureau ignores your block request, you can sue under the FCRA. Lawyers like Lexington Law Firm and Credit Saint handle these disputes for a monthly fee, and many cases recover statutory damages of $100 to $1,000 per violation.
Step 7: Watch for Re-aging or New Attempts
Fraud rings sometimes try again 6 to 12 months later. Keep your fraud alert or freeze active. Pull a free Experian, Equifax, and TransUnion report every four months on a rotating schedule. Tools like Dovly and Creditship offer free credit monitoring with text alerts whenever a new account is opened in your name.
While you wait for clean reports, do not skip your real credit life. If your healthy accounts have suffered collateral damage, a small builder account like the Self Visa® Credit Card or other credit-building bank accounts can keep positive history flowing in while the fraud cleanup finishes.
Rebuilding your overall score profile? Our 12-month roadmap shows how to get good credit step by step.
Common Mistakes That Slow Down the Removal
- Filing a regular dispute instead of a 605B block. The bureau may close it as "verified" if the creditor responds first.
- Skipping the FTC report. Without it, the bureau is not legally required to block.
- Sending the packet by regular mail. Use certified mail with return receipt so you have proof.
- Forgetting to send the same packet to the creditor. The bureau can block, but if the creditor keeps reporting, the account can come back.
Done correctly, the entire fraud cleanup wraps in 30 to 60 days. Done sloppily, it drags on for a year.
Frequently Asked Questions
Does disputing identity theft hurt my credit score?
No. Removing a fraudulent account usually helps your score because the negative payment history and balance disappear from the calculation. Only legitimate accounts can hurt your score.
Do I need a police report to remove fraudulent accounts?
Not always. The FTC Identity Theft Report is the legal minimum under FCRA 605B. A police report is helpful and some creditors require one, but the bureau cannot reject a valid 605B request just because you do not have a police report.
How long does the bureau have to remove the account?
Four business days from receipt of a valid 605B block request, plus reasonable mail time. Standard disputes take 30 days, but the identity-theft block is much faster.
Can the creditor send the fraudulent debt to collections after I block it?
No. Once the creditor has a valid identity-theft report, FCRA Section 605B prohibits any continued collection or reporting on that account. If a collection agency contacts you anyway, send them the same FTC report and ask in writing for the account to be recalled.
Lexington Law Firm
Lexington Law Firm
Lexington Law helps clients reach their credit score goals through lawyer-guided credit repair, working to challenge inaccurate and unfair items like late payments or collections on their credit reports.
Monthly Price
From $139.95/mo
Setup Fee
$0
Money Back Guarantee
No
Year of Founded
2004
