To remove fraudulent accounts from your credit report, file an identity theft report at IdentityTheft.gov, file a police report, and send both, along with proof of your identity and a list of the fraudulent accounts, to each of the three credit bureaus and to the company that reported the account. Federal law then requires the bureau to block the fraudulent information within four business days.
Pull All Three Reports Before You Dispute
You need to know exactly what to dispute before you write a single letter. All three nationwide bureaus (Equifax, Experian, and TransUnion) offer free weekly reports through AnnualCreditReport.com on a permanent basis.1Federal Trade Commission. Free Credit Reports Pull all three. A fraudulent account often shows up on one bureau’s file and not the others.
Look for accounts you didn’t open, addresses where you’ve never lived, inquiries from companies you never contacted, and balances you don’t recognize. Write down the account number, creditor name, date opened, and balance for every suspicious entry. That list is the backbone of your dispute.
Build the Identity Theft Package
Federal law defines an “identity theft report” as a report filed with a law enforcement agency that carries criminal penalties for false statements.2Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction In practice, that means two documents plus proof of who you are.
FTC Identity Theft Report
Start at IdentityTheft.gov. The site walks you through what happened and generates an official FTC Identity Theft Report along with a personalized recovery plan.3Federal Trade Commission. Identity Theft Resources and Recovery Steps That report serves as your affidavit and is accepted by the credit bureaus and most creditors.
Police Report
File a report with your local police describing the theft. Some departments take these online; others require you to come in. Get a copy of the filed report with the case number on it. Together with the FTC report, this is what gives your dispute the legal weight that triggers the strongest protections in the Fair Credit Reporting Act.
Proof of Identity
Include a government-issued photo ID (driver’s license or passport) and a document confirming your current address, such as a recent utility bill or bank statement. Some bureaus also ask for a copy of your Social Security card. Assemble all of this before you mail anything. An incomplete package gives the bureau grounds to reject your dispute.
The Four-Business-Day Block
This is where identity theft disputes are different from ordinary credit report errors. When your submission includes proof of your identity, the identity theft report, identification of the specific fraudulent items, and your statement that you did not authorize them, the bureau must block that information from appearing on your report within four business days of receiving the package.4Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
All four elements have to be there. Miss any one and the bureau can treat your submission as a standard dispute, which runs on a longer clock.
Send a Dispute Package to Each Bureau
Send a separate package to each of the three bureaus. Online submission is available, but certified mail with a return receipt gives you dated proof of delivery, which matters if a bureau misses its deadline and you need to escalate.
Current mailing addresses for fraud disputes:
- Equifax, P.O. Box 740256, Atlanta, GA 30374
- Experian, P.O. Box 4500, Allen, TX 75013
- TransUnion, P.O. Box 2000, Chester, PA 19022-2000
Each package should contain a cover letter listing every fraudulent account by creditor and account number, a copy of the FTC Identity Theft Report, a copy of the police report, copies of your identity documents, and a signed statement that you did not authorize the listed accounts. Keep the originals. Send copies. Save the certified mail receipts. The bureaus also run dedicated fraud lines: Equifax at 800-685-1111, Experian at 888-397-3742, and TransUnion at 888-909-8872.5IdentityTheft.gov. Credit Bureau Contacts
The bureaus do not share corrections with each other automatically. Removing an entry at Equifax does nothing at Experian or TransUnion. Each bureau requires its own dispute, which is why sending all three at once saves time.
Notify the Company That Reported the Account
The bureau is not the only entity you need to contact. The company that reported the fraudulent account, called the furnisher, has its own obligations once you put it on notice. After receiving your identity theft report, the furnisher is prohibited from continuing to report that information to any credit bureau.6Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies If you dispute directly with the furnisher, it must investigate and respond within the same window that applies to the bureaus.7eCFR. 16 CFR Part 660 – Duties of Furnishers of Information to Consumer Reporting Agencies
Send the same package (FTC report, police report, identity documents, statement) to the furnisher’s fraud department. The address is usually on the company’s website under fraud or disputes. Skipping this step is how fraudulent accounts come back. The bureau can delete the entry, but if the furnisher keeps reporting it, the account reappears on the next update.
If a Debt Collector Is Involved
If the fraudulent debt has already been sold or placed with a collector, federal law prohibits anyone from selling, transferring, or placing that debt for collection once they have been notified it resulted from identity theft.8Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports Separately, the Fair Debt Collection Practices Act gives you 30 days from a collector’s first written contact to dispute the debt in writing. Once you do, the collector must stop collection activity until it provides verification.9Federal Trade Commission. Fair Debt Collection Practices Act Text Send a dispute letter to the collector with a copy of your identity theft report attached. That combination usually ends the collection.
What Happens After You File
Once a bureau receives a dispute, it has 30 days to investigate.10Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy The bureau contacts the furnisher to verify the disputed information. If the furnisher can’t confirm the account belongs to you, or doesn’t respond in time, the bureau must delete the item. That deadline can stretch to 45 days if you submit additional supporting documents after your initial filing.
Within five business days of finishing the investigation, the bureau must send you written results and a free updated copy of your credit report.10Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy Review it carefully. If any fraudulent items remain, you can ask the bureau to send corrected information to anyone who pulled your report recently.
If Your Dispute Is Called Frivolous
A bureau can terminate an investigation if it decides your dispute is frivolous, which usually means you didn’t give it enough to work with. When a bureau makes that determination, it must notify you within five business days and explain what additional information it needs.11Federal Trade Commission. FCRA Section 611 – Procedure in Case of Disputed Accuracy That is not the end. Resubmit with the missing documents and the clock starts fresh. In identity theft cases, the most common trigger is a dispute filed without the identity theft report or without proof of identity.
Block New Fraud While You Clean Up the Old
Removing the accounts already on your report only fixes the past. To keep new ones from being opened, use a fraud alert, a security freeze, or both.
Fraud Alerts
A fraud alert tells lenders to verify your identity before opening new credit in your name. An initial alert lasts one year and is available to anyone who suspects fraud. Contact one bureau and it must notify the other two.12Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts If you’ve filed an identity theft report, you qualify for an extended alert that lasts seven years and removes you from prescreened credit offer lists for five.13Federal Trade Commission. Credit Freezes and Fraud Alerts
Security Freezes
A freeze goes further. It blocks new lenders from accessing your credit file entirely, which means nobody can open credit in your name (including you) until you lift or temporarily thaw it. Placing and lifting a freeze is free under federal law.13Federal Trade Commission. Credit Freezes and Fraud Alerts A freeze does not affect your existing accounts, your credit score, or your ability to pull your own reports. Companies you already do business with keep their access, and certain government agencies keep theirs as well.14Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report The tradeoff is that you’ll need to lift the freeze whenever you apply for new credit, a rental, or certain jobs. Each bureau assigns a PIN or password. Keep it somewhere safe.
A Note on Other Reports
The big three don’t cover everything. If the thief opened bank accounts, bounced checks, or took out payday loans in your name, that activity may show up on specialty consumer reports (ChexSystems for banking, Early Warning Services, Clarity Services, and others) rather than on your credit file. The CFPB publishes a full list of these agencies.15Consumer Financial Protection Bureau. List of Consumer Reporting Companies The dispute process is essentially the same: request the report, send the identity theft package, wait for the investigation.
When a Bureau Won’t Comply
Most disputes resolve inside the 30-day window. When a bureau refuses to remove confirmed fraudulent accounts, keeps reinserting them, or ignores the dispute altogether, the FCRA gives you the right to sue.
For willful violations, meaning the bureau knowingly or recklessly ignored the law, you can recover actual damages or statutory damages between $100 and $1,000 per violation, plus punitive damages with no cap, plus attorney’s fees.16Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance For negligent violations, you can recover actual damages and attorney’s fees.17Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance Actual damages cover financial losses such as a denied loan or lost job, and courts have awarded damages for emotional distress as well.
You must file suit within two years of discovering the violation or five years of the date it occurred, whichever comes first.18Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions Because the losing party pays the winner’s legal costs in FCRA cases, many consumer attorneys take these on contingency.
Before going to court, submit a complaint to the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards the complaint to the bureau and requires a response, which often produces results faster than litigation and builds an official paper trail if you do end up filing suit.