To report fraud to the credit bureaus, pull your credit reports from Equifax, Experian, and TransUnion, file an Identity Theft Report at IdentityTheft.gov, place a fraud alert with one bureau, add a security freeze at each of the three separately, and then dispute or block every account and inquiry you did not authorize. Each step has its own timeline under the Fair Credit Reporting Act, and doing them in this order gives you the strongest protection with the least duplicated effort.
Start by Pulling Your Credit Reports
You cannot report what you have not seen. Request free weekly reports from all three bureaus at AnnualCreditReport.com, the only site federally authorized for this purpose.1Federal Trade Commission. Free Credit Reports You can also order by phone at 1-877-322-8228 or by mail.
Read each report line by line. Flag every account you did not open, every hard inquiry you did not authorize, and every address or employer you do not recognize. For each suspicious item, write down the creditor name, account number, date opened, and balance. That list is what you will feed into every alert, freeze, dispute, and block that follows.
File an Identity Theft Report
The Identity Theft Report is the document that unlocks your strongest rights. With it, you qualify for a seven-year extended fraud alert, and you can force the bureaus to block fraudulent information within four business days rather than wait through a standard 30-day dispute investigation.2Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft
Create one at IdentityTheft.gov. The site walks you through what happened, generates the report, and produces a personalized recovery plan with pre-filled letters.3IdentityTheft.gov. What To Do Right Away Create an account if you want to come back and update the plan; if you don’t, print and save the report immediately, because you won’t be able to retrieve it later.
A police report is optional. It isn’t required when you have an FTC Identity Theft Report, but some creditors respond faster when they see one.
What Documents to Have Ready
Every bureau will verify your identity before acting on anything you send. Have these on hand before you start:
- Full legal name, Social Security number, date of birth, and every address from the past two years.
- A government-issued photo ID (driver’s license, state ID, passport, or military ID).
- Proof of current address, such as a utility bill, bank statement, or insurance statement.
- Your Identity Theft Report, a police report, or both.
- The list of fraudulent items you built from your credit reports.
If you mail anything, send copies. Bureaus don’t return submitted materials.
Place a Fraud Alert with One Bureau
A fraud alert tells any lender pulling your file to take extra steps to verify your identity before opening a new account. You only need to contact one of the three bureaus; the law requires that bureau to notify the other two.4Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
An initial fraud alert lasts one year and requires nothing more than a good-faith belief that you are, or may become, a victim. No police report or Identity Theft Report is needed. If you already have an Identity Theft Report, ask for an extended fraud alert instead. It lasts seven years and also removes you from prescreened credit offer lists for five years unless you opt back in.4Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Active duty service members can place a separate active duty alert covering the length of deployment.
Freeze Your File at Each Bureau
A security freeze goes further than an alert. It blocks the bureau from releasing your credit report to any new creditor at all, which stops most fraudulent applications from being approved. Placing, lifting, and removing a freeze is free under federal law.5Federal Trade Commission. Free Credit Freezes and Year-Long Fraud Alerts Are Here
Freezes do not propagate the way alerts do. You must contact Equifax, Experian, and TransUnion separately. Online and phone requests must be processed within one business day; mailed requests within three.6Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – National Security Freeze Within five business days, each bureau sends confirmation and instructions for lifting the freeze later. Some issue a PIN; others use online authentication. Save whatever credentials you receive, because you will need them any time a legitimate lender needs access to your file.
Consider Freezing Specialty Reports Too
The three major bureaus aren’t the only agencies with a file on you. ChexSystems tracks banking history that most banks check before approving new accounts, and LexisNexis Risk Solutions and its subsidiary SageStream maintain files used by insurers and other businesses.7Consumer Financial Protection Bureau. SageStream, LLC Each will freeze your report on request, and freezing them closes gaps that a bureau-only freeze leaves open.
Dispute or Block the Fraudulent Entries
Alerts and freezes prevent new damage. To remove accounts already on your report, you need to file a dispute or, if you have an Identity Theft Report, request a block.
Standard disputes go through each bureau’s online portal or by mail. For each entry, identify the account and creditor, explain that it resulted from identity theft, and attach your Identity Theft Report or police report along with proof of identity and address. The bureau must send confirmation that starts the investigation clock.8Office of the Law Revision Counsel. 15 U.S.C. 1681i – Procedure in Case of Disputed Accuracy
A block is faster and more definitive. Available only to identity theft victims with an Identity Theft Report, it forces the bureau to stop reporting the fraudulent information within four business days.2Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft Send four things: proof of identity, a copy of your Identity Theft Report, a clear identification of which items are fraudulent, and a statement that those items did not result from any transaction you made. Use the block whenever you have an Identity Theft Report; use a standard dispute when you don’t.
Dispute Directly with the Creditor
You are not limited to going through the bureaus. Federal regulations let you file a “direct dispute” with the creditor or company that reported the information, and creditors must investigate fraud-related direct disputes within the same window that applies to bureau investigations.9eCFR. 12 CFR 1022.43 – Direct Disputes
Send your notice to the dispute address the creditor lists on your credit report. If none is listed, use any business address. Include enough information to identify the account, an explanation of why it’s wrong, and supporting documents such as your Identity Theft Report. If the creditor concludes the information is inaccurate, it must notify every bureau it reported to and provide corrections. Sending your Identity Theft Report directly to the creditor has an extra effect: once received, the creditor is prohibited from continuing to report the disputed account to any bureau.
What to Expect After You File
Once a bureau receives your dispute, it has 30 days to investigate. That window extends to 45 days if you submit additional information during the initial 30-day period.8Office of the Law Revision Counsel. 15 U.S.C. 1681i – Procedure in Case of Disputed Accuracy The bureau contacts the creditor that furnished the information, reviews the evidence, and closes with one of three results: the entry is deleted, corrected, or left in place because the bureau concluded it was accurate.
Within five business days of finishing, the bureau must send you written notice of the outcome and a free updated copy of your report. You can request a description of how the investigation was conducted, including the name and contact information of any creditor the bureau contacted, and you can add a statement to your file if you disagree with the result. If a bureau later reinserts information it previously deleted, it must notify you in writing within five business days and identify the creditor behind the reinsertion.10Office of the Law Revision Counsel. 15 U.S. Code 1681i – Procedure in Case of Disputed Accuracy
If a Bureau Won’t Fix It, File with the CFPB
If a bureau refuses to remove fraudulent information or doesn’t respond within the required timeframe, escalate to the Consumer Financial Protection Bureau. You must have already disputed the information with the bureau, and either 45 days must have passed since you filed or the bureau must have already closed its investigation.11Consumer Financial Protection Bureau. Credit and Consumer Reporting Complaint Notice
File at consumerfinance.gov/complaint. The CFPB forwards your complaint to the company, which generally responds within 15 days, and up to 60 days in more complex cases.12Consumer Financial Protection Bureau. Submit a Complaint About a Financial Product or Service You then have 60 days to review the response and provide feedback. The CFPB also shares complaint data with state and federal agencies that may take enforcement action.
Reporting Fraud on Behalf of a Child or Incapacitated Adult
The steps above assume you are reporting fraud on your own file. If the victim is a minor child or an incapacitated adult, the process is different: freezes on their behalf are free, but each bureau must be contacted separately and usually by mail, and you’ll need to send the victim’s identifying documents along with proof of your legal authority to act, such as a birth certificate, a power of attorney, or a guardianship order.5Federal Trade Commission. Free Credit Freezes and Year-Long Fraud Alerts Are Here If the child has no credit file yet, the bureau will create one and freeze it immediately.