Identity Theft and Your Credit Report: Complete Recovery Guide (2026)

Discovering that someone has opened accounts in your name is overwhelming. Fraudulent accounts tank your credit score, trigger collection calls for debts you never incurred, and can take months to resolve if you do not know the right steps. But federal law is firmly on your side — the Fair and Accurate Credit Transactions Act (FACTA) gives identity theft victims powerful tools to block fraudulent information from credit reports within days, not months.

This guide walks you through the complete recovery process, from initial discovery through full credit restoration.

Step 1: Document Everything

Before you contact anyone, gather your evidence. You will need documentation throughout this process, and having it organized from the start saves significant time.

What to Collect

• Credit reports from all three bureaus — pull them from AnnualCreditReport.com. Highlight every account you do not recognize.
• Bank and credit card statements — showing your legitimate activity during the period when fraudulent accounts were opened
• Any correspondence — collection letters, credit denial notices, or other mail related to accounts you did not open
• A timeline — when you first noticed the fraud, what accounts are affected, approximate dates the fraudulent accounts were opened

Step 2: File an FTC Identity Theft Report

The Federal Trade Commission (FTC) operates IdentityTheft.gov, the official portal for reporting identity theft. Filing here generates an Identity Theft Affidavit — a standardized document that creditors and credit bureaus are legally required to accept.

How to File

1. Go to IdentityTheft.gov
2. Answer the questions about what happened
3. The system generates your Identity Theft Report and a personalized recovery plan
4. Print and save your report — you will include copies with every dispute letter

Your FTC Identity Theft Report serves as your primary documentation. Under FACTA, credit bureaus and creditors must accept this as sufficient proof to initiate blocking and investigation procedures.

Step 3: File a Police Report

While the FTC report is the primary legal document, a police report adds weight to your case and is required by some creditors. Many local police departments now accept identity theft reports online.

Tips for Filing

• Bring your FTC Identity Theft Affidavit and credit reports showing the fraudulent accounts
• List every fraudulent account with creditor names, account numbers, and approximate amounts
• Get a copy of the filed report with the case number — you will reference this in your dispute letters
• If local police are uncooperative (it happens), try filing with your state's Attorney General office instead

Step 4: Place Fraud Alerts and Credit Freezes

Initial Fraud Alert (Free, 1 Year)

Contact any one of the three major credit bureaus to place an initial fraud alert. They are required to notify the other two bureaus automatically.

• Equifax: 1-800-525-6285
• Experian: 1-888-397-3742
• TransUnion: 1-800-680-7289

An initial fraud alert lasts one year and requires creditors to take reasonable steps to verify your identity before opening new accounts.

Extended Fraud Alert (Free, 7 Years)

Identity theft victims with an FTC Identity Theft Report can place an extended fraud alert lasting seven years. This requires submitting your Identity Theft Report to the bureau.

Credit Freeze (Free, Indefinite)

A credit freeze is stronger than a fraud alert. It prevents anyone (including you) from opening new credit accounts until you temporarily lift the freeze. Under federal law (Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018), placing and lifting credit freezes is free at all three bureaus.

Step 5: FACTA Section 152 Block Requests

This is the most powerful tool available to identity theft victims. Under FACTA Section 152 (codified as 15 U.S.C. Section 1681c-2), you can demand that credit bureaus block fraudulent information from your credit report within four business days.

What the Bureau Must Do

Upon receiving your block request with supporting documentation, the bureau must:

1. Block the fraudulent information within four business days
2. Notify the furnisher (the company that reported the fraudulent account) that the information has been blocked
3. Notify the furnisher that the information resulted from identity theft
4. Ensure the blocked information is not re-reported

What to Include in Your Block Request

Your FACTA block request letter should include:

• Your full legal name, current address, and date of birth
• A copy of your FTC Identity Theft Report
• A copy of your police report (if available)
• A copy of your government-issued photo ID
• Proof of your current address (utility bill or bank statement)
• A list of every fraudulent item you want blocked, with account numbers
• A statement that the identified items did not result from any transaction by you or anyone authorized to act on your behalf

The Four-Day Requirement

Four business days. Not four weeks, not 30 days — four business days. If the bureau fails to block the information within this timeframe, they are in violation of FACTA. This gives you grounds for:

• A follow-up demand letter citing the violation
• A CFPB complaint
• A state Attorney General complaint
• Potential litigation for willful noncompliance (statutory damages of $100 to $1,000 per violation under 15 U.S.C. Section 1681n)

Step 6: Notify Creditors Directly

For each fraudulent account, send a separate letter to the creditor or debt collector. Under FCRA Section 1681g(e), creditors must provide you with copies of applications, transaction records, and other documents related to the identity theft within 30 days of receiving your request.

What to Demand from Each Creditor

1. Immediate account closure
2. Cessation of all collection activity
3. Removal of the account from all credit bureau reports
4. Copies of the original application and all transaction records (FCRA Section 1681g(e))
5. Written confirmation of all actions taken

If the Account Is with a Debt Collector

If the fraudulent account has been sold to a debt collector, you have additional protections under the FDCPA:

• Section 1692g — Demand debt validation. The collector must prove the debt is yours.
• Section 1692c(c) — Send a cease-communication letter. The collector must stop contacting you.
• Continued collection or reporting of a known fraudulent account violates FCRA Section 1681s-2 and may constitute willful noncompliance.

Step 7: Follow Up and Escalate

Identity theft resolution rarely happens in a single round of letters. Here is your escalation path:

Week 1-2: Initial Filing

• FTC report filed
• Police report filed
• Fraud alerts and freezes placed
• FACTA block requests sent to all three bureaus (certified mail, return receipt requested)
• Creditor notification letters sent

Week 3: Follow-Up

• Check if bureaus have processed the blocks (they should within 4 business days)
• Check if creditors have acknowledged receipt
• Pull updated credit reports to verify blocks are in place

Week 4+: Escalation (if needed)

• Send follow-up demand letters to any non-compliant bureau citing the FACTA violation
• File CFPB complaints against non-responsive bureaus or creditors
• File state Attorney General complaints
• Consider consulting a consumer rights attorney if violations are willful

Preventing Future Identity Theft

After resolving the immediate crisis, take these steps to prevent recurrence:

• Keep your credit freeze in place — only lift it temporarily when you need to apply for credit
• Monitor your credit reports regularly — you are entitled to free weekly reports from all three bureaus through AnnualCreditReport.com
• Set up transaction alerts on all financial accounts
• Use unique, strong passwords for every financial account
• Consider an identity monitoring service that scans the dark web for your personal information
• File IRS Form 14039 (Identity Theft Affidavit) with the IRS if your Social Security number was compromised, to prevent tax fraud

How CreditShield Helps

CreditShield's identity theft workflow generates your complete dispute packet automatically — FACTA block request letters for each bureau, creditor notification letters for each fraudulent account, and follow-up demand templates for non-compliant parties. Every letter is custom-written to your specific situation, citing the exact legal provisions and fraudulent account details that apply.

Start your identity theft recovery and let CreditShield generate your complete dispute packet.