If someone took out a loan in your name, treat the next few hours as time-sensitive: freeze your credit with all three bureaus, file an identity theft report with the FTC and a report with your local police, then use those two documents to force the lender to close the account and the bureaus to block it from your file. Federal law requires credit bureaus to block fraudulent information within four business days of receiving the right paperwork, but that clock only starts once you’ve filed the reports in the right order.
Lock Down Your Credit First
Before contacting the lender, stop any additional accounts from being opened. Call one of the three major credit bureaus (Equifax, Experian, or TransUnion) and place a fraud alert. That bureau is legally required to notify the other two. An initial alert lasts one year and tells lenders to verify your identity before approving new credit. Once you’ve filed an identity theft report with law enforcement, you can upgrade to an extended fraud alert that lasts seven years.1Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Then place a credit freeze with each bureau separately. Freezes are free, stay in place until you lift them, and physically prevent lenders from pulling your file. You can thaw a freeze temporarily when you need to apply for legitimate credit.2Federal Trade Commission. Credit Freezes and Fraud Alerts
Use both. The alert asks lenders to be cautious; the freeze stops them from seeing your file at all.
Find Out What Else Was Opened
If someone had enough information to take out a loan, assume they tried other things. Pull all three credit reports from AnnualCreditReport.com, which now offers free weekly reports permanently.3Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports
Write down every account you don’t recognize and every hard inquiry from a lender you never contacted: creditor name, account number, date opened. This list drives every dispute that follows. Keep pulling your reports weekly for the next several months, because new fraudulent accounts can surface after your initial review.
File Both an FTC Report and a Police Report
Two reports unlock your strongest legal protections. You need both.
The FTC Report
Go to IdentityTheft.gov. You’ll enter your information, describe the fraudulent loan, and note any contact you’ve had with the lender. The site generates an FTC Identity Theft Report and a personalized recovery plan. Save and print it right away, because you’ll attach copies to almost everything else you send.4Federal Trade Commission. IdentityTheft.gov
The Police Report
Take your FTC report, a government-issued photo ID, proof of address, and any evidence of the fraud (statements, collection letters) to your local police department. Ask for a copy of the report before you leave. Some departments resist taking identity theft reports, particularly when the crime crossed jurisdictions online. If that happens, explain that creditors and credit bureaus require a police report to resolve the fraud and that without one the fraudulent accounts stay on your file.5IdentityTheft.gov. Recovery Steps
Under federal regulations, the “identity theft report” that triggers your blocking and extended-alert rights has to be filed with a federal, state, or local law enforcement agency, because filing a false one carries criminal penalties. The FTC report by itself does not qualify.6Consumer Financial Protection Bureau. Regulation V – 1022.3 Definitions
Dispute the Loan With the Lender
Call the lender’s fraud department. Tell them your identity was stolen and the account was opened without your consent. Write down the name of the person you speak with, get a case or reference number, and ask what documentation they need. Some lenders have their own identity theft affidavit forms.
Follow the call with a certified letter, return receipt requested. State that the account is fraudulent, ask that it be closed and removed from your name, and enclose copies (never originals) of your FTC and police reports.7Federal Trade Commission. Sample Letter Disputing Errors on Credit Reports to the Business That Supplied the Information
Keep a log of every call and letter. These disputes can stretch across weeks or months, and you may need to prove later exactly when the lender was notified and what they said.
Get the Loan Off Your Credit Reports
You have two separate paths, and the faster one is often overlooked.
The Four-Day Identity Theft Block
Under the Fair Credit Reporting Act, once you give a bureau proof of your identity, a copy of your identity theft report, a description of the fraudulent information, and a statement that you didn’t authorize the account, the bureau must block that information within four business days.8Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
Send a blocking request to each bureau separately. Identify the specific accounts and inquiries by account number, and include your reports.
The Standard Dispute
File a formal dispute with each bureau as well, covering both the fraudulent loan and the hard inquiry from the application. The bureau has 30 days to investigate and must notify you of the results in writing. If fraud is confirmed, the bureau must correct your file and send you a free updated report.9Federal Trade Commission. Disputing Errors on Your Credit Reports
Run both processes at once. The block should be faster; the dispute builds a paper trail if you have to escalate.
What You Actually Owe
You owe nothing on a loan you didn’t apply for. A valid contract requires your actual consent, and an identity thief can’t provide it. Once the lender or bureau confirms the fraud, the debt should come off your name entirely.
But “no liability” only holds if you follow through on the paperwork. A fraudulent loan you never dispute can sit on your credit report indefinitely, drop your score, and eventually produce collection lawsuits and default judgments that are much harder to unwind after the fact.
One boundary: if the fraud involved unauthorized electronic transfers from your bank account (a stolen debit card, or automatic withdrawals the thief set up), a different rule applies. Your liability is capped at $50 if you notify the bank within two business days of discovering the problem, at $500 if you report between two business days and 60 days of your statement date, and can reach the full amount of subsequent unauthorized transfers after 60 days.10eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
If a Debt Collector Contacts You
If the loan goes unpaid, the lender may hand it off to a collection agency. Within five days of first contacting you, the collector must send a written notice with the amount of the debt, the creditor’s name, and a statement of your right to dispute. You have 30 days from receiving that notice to dispute in writing. Once you do, the collector must stop all collection activity until they mail you verification of the debt.11Office of the Law Revision Counsel. 15 USC 1692g – Validation of Debts
Send your dispute by certified mail with return receipt. Include copies of your FTC and police reports and state clearly that the debt resulted from identity theft. You can also send a separate written notice demanding the collector cease all communication; after receiving it, they can only contact you to confirm they’re stopping or to notify you of specific legal action.12Federal Trade Commission. Fair Debt Collection Practices Act
Do not ignore collection calls. An undisputed fraudulent debt can turn into a lawsuit, a default judgment, and wage garnishment, all of which are far harder to reverse than to prevent. The 30-day window is your leverage.
When the Lender or Bureau Won’t Cooperate
Most disputes resolve within 30 to 45 days. Sometimes a lender stalls, a bureau labels your dispute “frivolous,” or the fraudulent account reappears after you thought it was gone. You have recourse.
The FCRA lets you sue a credit bureau or information furnisher that fails to meet its obligations. For a willful violation, you can recover either your actual damages or statutory damages between $100 and $1,000, plus punitive damages and attorney’s fees.13Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance For a negligent violation, you can still recover actual damages and attorney’s fees.14Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
Before filing suit, submit a complaint to the Consumer Financial Protection Bureau at consumerfinance.gov. Companies respond faster with a federal regulator watching. A complaint to your state attorney general’s office is another option. Consumer rights attorneys who handle FCRA cases will often take them on contingency, since the statute awards attorney’s fees to successful plaintiffs.
When You Know Who Did It
A painful share of identity theft cases involve someone the victim knows: a parent, spouse, partner, roommate, or adult child. The legal steps are the same, but the choice to file a police report against family is harder.
Here is the trade-off. Without a police report, you cannot get an extended fraud alert, you cannot trigger the four-business-day blocking right, and many lenders will refuse to close the account. If you skip the police report to protect the person who stole from you, the fraudulent debt stays on your record.
Some victims try to resolve things privately by having the person pay off the loan. That can work financially, but it doesn’t remove the account from your credit history and doesn’t stop it from happening again. If you decide not to pursue criminal charges, at minimum place a fraud alert and freeze, check your reports for other accounts, and think hard about whether the person still has access to your personal information.
Watch for a Surprise Tax Bill
If the lender writes off the fraudulent debt, they may report the cancellation to the IRS on a Form 1099-C, which the IRS may treat as taxable income to you. Backward as that is, it happens, and ignoring the form can trigger an IRS notice.
If you receive a 1099-C for a debt you never owed, contact the creditor and demand they correct or withdraw the form. The IRS says your responsibility is to report the correct taxable amount of canceled debt, and for a fraudulent debt that amount is zero.15Internal Revenue Service. Topic No. 431, Canceled Debt – Is It Taxable or Not?
For a fraudulent loan (as opposed to someone filing a fake tax return in your name), the IRS says you generally do not need to file Form 14039, the Identity Theft Affidavit. That form is for tax-related identity theft. For non-tax identity theft, the IRS points you back to the FTC, credit bureaus, and law enforcement, which you’ll have already contacted.16Internal Revenue Service. When to File an Identity Theft Affidavit
One proactive step: request an Identity Protection PIN from the IRS. An IP PIN is a six-digit number that must appear on your return before the IRS will process it, which prevents anyone from filing a fraudulent return with your Social Security number. Confirmed identity theft victims are enrolled automatically, but anyone can opt in through their IRS online account.17Taxpayer Advocate Service. Protect Yourself From Tax-Related Identity Theft: Get an Identity Protection PIN
A New Social Security Number as Last Resort
If you’ve done everything above and someone is still actively misusing your Social Security number, the Social Security Administration can issue a new one. You’ll need evidence of ongoing problems despite your efforts. The SSA will not issue a new number just because a card was lost or stolen without evidence of actual misuse, or to help you escape bankruptcy or other legal obligations.18Social Security Administration. Identity Theft and Your Social Security Number
A new SSN brings its own problems. Your credit history doesn’t transfer, so you’re essentially starting from scratch with lenders. Most victims never need this step, but if fraud keeps recurring despite freezes and alerts, it’s worth raising with the SSA.