If someone put a bill in your name, treat it as identity theft and act this week: report the fraud to the FTC and police, dispute the account with the credit bureaus and the company that issued it, and use your federal rights to block the fraudulent information from your credit file. Federal law does not require you to pay a debt you never agreed to, but the protections only kick in once you create the paper trail.
File the Reports That Unlock Your Rights
Start at IdentityTheft.gov. The FTC’s site walks you through what happened and produces two documents: an official FTC Identity Theft Report and a personalized recovery plan with pre-filled letters to send to creditors and credit bureaus.1Federal Trade Commission. IdentityTheft.gov Recovery Steps The Identity Theft Report is the key that unlocks stronger tools later, including the right to force credit bureaus to block fraudulent accounts entirely.
Next, file a police report with your local department. Not every department will investigate, but many creditors and credit bureaus require a police report before they’ll act, and having a case number strengthens every dispute you file afterward. Ask for a copy before you leave.
Then contact the company that sent you the bill. Ask for the fraud department, tell them you never opened the account, and request that they freeze or close it while they investigate. Follow up in writing by certified mail so you have proof of what you sent and when. Creditors and financial institutions are required under federal regulation to maintain identity theft prevention programs, so a process should already be in place.2eCFR. 16 CFR Part 681 – Identity Theft Rules
If your Social Security number was used, report the misuse to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov or 1-800-269-0271.3Social Security Administration. Fraud Prevention and Reporting
Get the Fraudulent Account Off Your Credit Report
The Fair Credit Reporting Act gives you two ways to remove a fraudulent account from your file. One is available to anyone. The other is stronger, and it’s the reason you filed the FTC report.
Standard Dispute
You can dispute any inaccurate information directly with Equifax, Experian, and TransUnion. Once a bureau receives your dispute, it has 30 days to investigate, and if the information turns out to be inaccurate or can’t be verified, the bureau must delete it.4Federal Trade Commission. Fair Credit Reporting Act Section 611 The bureau notifies the company that reported the account, and that company has to investigate too. Most fraudulent accounts fail this check because no one can produce a signed application or verify a transaction you never made.5Federal Trade Commission. Consumer Reports – What Information Furnishers Need to Know
Identity Theft Block
With an FTC Identity Theft Report or police report in hand, you can demand a block instead of a dispute. Under FCRA Section 605B, credit bureaus must block information you identify as resulting from identity theft within four business days of receiving your identity theft report, proof of your identity, identification of the fraudulent items, and your statement that you did not authorize the transaction.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft A block is more permanent than a dispute; once blocked, the information should not reappear.
Send your block request to all three bureaus separately. Include copies (never originals) of your identity theft report, a government-issued ID, and a clear list of which accounts are fraudulent.
Don’t Pay the Debt: Your Rights With the Creditor
Fixing your credit report is one job. Making sure you’re not held liable for the bill is another, and the rules depend on the type of account.
Credit Card in Your Name
The Fair Credit Billing Act covers unauthorized charges on credit cards. You have 60 days after the creditor mails the first statement containing the fraudulent charge to send a written dispute to the creditor’s billing-error address, which is not the same as the payment address. Include your name, the account number, the date and amount of the disputed charge, and why it’s wrong.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
Once the creditor receives your notice, it must acknowledge the dispute within 30 days and resolve it within two billing cycles (no more than 90 days). During that window, the creditor cannot try to collect the disputed amount or report it as delinquent. Send everything certified mail, return receipt requested.
Debit Card or Bank Account in Your Name
If the fraud involves a debit card or bank account, the Electronic Fund Transfer Act applies, and its clock runs much faster. Report unauthorized transfers within two business days of learning about them and your maximum liability is $50. Wait longer than two days but less than 60 days after your statement is sent and your exposure jumps to $500. Miss the 60-day window and you could be on the hook for the full amount of any transfers that happened after that deadline.8Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability For debit and bank fraud, report it the same day you find out.
If a Collector Is Already Calling
Fraudulent accounts sometimes get sold to collection agencies before you know they exist. Under the Fair Debt Collection Practices Act, if you notify the collector in writing within 30 days of their first contact that you dispute the debt, the collector must stop all collection activity until it verifies the debt and mails the verification to you.9Federal Trade Commission. Fair Debt Collection Practices Act
Once you’ve submitted an identity theft report, a debt collector who has been notified cannot place the fraudulent debt for further collection or sell it to another collector.10eCFR. 12 CFR Part 1006 – Debt Collection Practices (Regulation F) Keep copies of every letter. If a collector keeps pursuing a debt you’ve already reported as fraudulent, that’s a violation you can sue over.
Lock Down Your Credit So It Doesn’t Happen Again
Two protections stop new accounts from being opened. You can use both.
Credit Freeze
A credit freeze blocks anyone from pulling your credit report to open a new account. Since September 2018, freezes have been free for every consumer under federal law, including children under 16 and dependents under guardianship.11Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts Contact each bureau to place the freeze. When you apply for credit yourself, you can lift it temporarily: bureaus must remove a freeze within one hour for online or phone requests, or within three business days for requests by mail.12USAGov. How to Place or Lift a Security Freeze on Your Credit Report
A freeze does not affect your credit score, and it does not stop you from using existing accounts. It is the single most effective protection against new fraudulent accounts.
Fraud Alert
A fraud alert tells creditors to verify your identity before extending new credit but doesn’t block access to your report. An initial alert lasts one year and can be renewed. If you’re a confirmed identity theft victim with an FTC report or police report, an extended fraud alert lasts seven years.13Federal Trade Commission. Credit Freezes and Fraud Alerts Only one bureau needs to hear from you; it’s required to notify the other two.
Keep Watching Your Credit
Identity theft rarely ends with one account. Someone with your personal information often tries again months later. All three major bureaus provide free weekly credit reports through AnnualCreditReport.com on a permanent basis, and Equifax is providing six additional free reports per year through 2026.14Federal Trade Commission. Free Credit Reports While you’re actively cleaning up fraud, check weekly. Look for accounts you don’t recognize, addresses where you’ve never lived, and inquiries from companies you never contacted. Dispute anything new right away using the same process.
Medical Bills and Utility Bills Work the Same Way
Not every fraudulent bill comes from a bank or credit card issuer. Someone can open utility accounts, get medical treatment, or run up service charges in your name too.
For medical bills, HIPAA’s privacy rule gives you the right to request copies of your medical and billing records from each provider and dispute inaccurate information in writing. The provider must correct the records and notify anyone else who received the wrong information. If a provider or insurer receives a copy of your identity theft report, it cannot report the fraudulent debt to credit bureaus.15Federal Trade Commission. Medical Identity Theft – FAQs for Health Care Providers and Health Plans Dispute medical fraud aggressively even when the dollar amount is small, because inaccurate medical records can lead to wrong treatment.
For utility accounts and other non-credit bills, contact the company’s fraud department, send a written dispute with a copy of your police report or FTC Identity Theft Report, and request that the account be closed. If it’s already gone to collections, use the collector steps above.
When the Person Who Did This Is Someone You Know
Sometimes the person who put the bill in your name is a parent, spouse, roommate, or adult child. It happens more often than most people expect. The legal steps are the same; the emotional part is not.
Filing a police report against a family member is where many victims stop. But without a police report or FTC Identity Theft Report, your access to the strongest protections shrinks. The identity theft block under FCRA Section 605B requires an identity theft report, and many creditors won’t close a fraudulent account without one.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft Filing a report is not the same as pressing charges; in many jurisdictions, the decision to prosecute belongs to the district attorney. But the report itself creates the documentation you need to avoid being held responsible for debts you didn’t create.