If someone took out a loan in your name, you are not on the hook for the debt, but you have to prove the loan is fraudulent through a specific paper trail before it will come off your record. The fastest path is to freeze your credit today, file both an FTC identity theft report and a police report, and then use those reports to force the lender to close the account and the credit bureaus to block it from your file within four business days. The steps below are in the order that protects you fastest.
Freeze Your Credit Before Doing Anything Else
Start by calling one of the three major credit bureaus (Equifax, Experian, or TransUnion) and placing a fraud alert. That bureau is legally required to notify the other two. An initial fraud alert lasts one year and tells lenders to verify your identity before approving new credit. Once you have filed an identity theft report with law enforcement, you can upgrade to an extended fraud alert that lasts seven years.1Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Then place a credit freeze with each of the three bureaus individually. A freeze physically blocks lenders from pulling your credit file, which stops anyone from opening more accounts. Freezes are free, stay in place until you lift them, and can be temporarily thawed when you need to apply for legitimate credit.2Federal Trade Commission. Credit Freezes and Fraud Alerts
Use both. The alert warns lenders; the freeze prevents them from seeing your file at all.
Pull All Three Credit Reports and List Everything You Don’t Recognize
Someone who had enough of your information to take out one loan probably tried other things too. Get your reports from all three bureaus through AnnualCreditReport.com, which now offers free weekly reports on a permanent basis.3Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports
Write down every unfamiliar account and every hard inquiry from a lender you never contacted. Note the creditor name, the account number, and the date the account was opened. You will need this list for every dispute and report that follows. Keep checking your reports weekly for at least a few months, because fraudulent accounts can surface after your first review.
File the Two Reports That Unlock Your Rights
Two documents form the backbone of everything after this: an FTC identity theft report and a police report. Together they trigger your strongest legal protections, including the right to have fraudulent information blocked from your credit file and the right to an extended seven-year fraud alert.
FTC Identity Theft Report
Go to IdentityTheft.gov, the federal government’s identity theft reporting portal. You will enter your personal information, details about the fraudulent loan, and any contact you have had with the lender. The site generates an FTC Identity Theft Report and a personalized recovery plan. Save and print the report immediately; you will need copies for nearly every step ahead.4Federal Trade Commission. IdentityTheft.gov
Police Report
File a report with your local police department. Bring your FTC report, a government-issued photo ID, proof of address, and any evidence you have (account statements, collection letters, loan documents). Ask for a copy before you leave. Some departments are reluctant to take identity theft reports, especially when the crime happened online. If you meet resistance, explain that creditors and credit bureaus require a police report to resolve the fraud and that without one the fraudulent accounts will stay on your file.5IdentityTheft.gov. Recovery Steps
Under federal regulations, the “identity theft report” that triggers your blocking and extended-alert rights has to be one filed with a federal, state, or local law enforcement agency, because filing a false one carries criminal penalties. The FTC report by itself does not satisfy that requirement, which is why you need both.6Consumer Financial Protection Bureau. Regulation V – 1022.3 Definitions
Dispute the Loan With the Lender
Call the fraud department at the financial institution that issued the loan. Tell them your identity was stolen and the account was opened without your consent. Get the name of the person you speak with, a case or reference number, and a list of what they need from you. Some lenders have their own identity theft affidavit forms.
Follow the call with a written dispute sent by certified mail, return receipt requested. State clearly that the account is fraudulent, ask that it be closed and removed from your name, and include copies (not originals) of your FTC Identity Theft Report and your police report.7Federal Trade Commission. Sample Letter Disputing Errors on Credit Reports to the Business That Supplied the Information
Keep a log of every call and letter. These disputes can run for weeks or months, and you may need to prove later exactly when you notified the lender and what they said.
Get the Loan Off Your Credit Reports
You have two separate tools for cleaning up your credit file, and the stronger one is often overlooked.
The Four-Business-Day Block
Under the Fair Credit Reporting Act, once you send a credit bureau proof of your identity, a copy of your identity theft report, a description of the fraudulent information, and a statement that you did not authorize the account, the bureau has to block that information from your file within four business days.8Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
Send a blocking request to each of the three bureaus separately. Identify the specific fraudulent accounts and inquiries by account number, and include copies of your identity theft report.
Standard Dispute as Backup
File a formal dispute with each bureau at the same time, covering both the fraudulent loan and the hard inquiry from the application. The bureau has 30 days to investigate and must notify you of the results in writing. If the investigation confirms fraud, the bureau has to correct your file and send you a free updated report.9Federal Trade Commission. Disputing Errors on Your Credit Reports
Run both in parallel. The blocking request should resolve things faster, and the standard dispute creates a second paper trail if you have to escalate later.
If a Debt Collector Contacts You About the Loan
If the fraudulent loan goes unpaid long enough, the lender may send it to a collection agency. When a collector first contacts you, they have to send a written notice within five days that includes the amount of the debt, the name of the creditor, and a statement of your right to dispute. You have 30 days from receiving that notice to dispute the debt in writing. Once you do, the collector has to stop all collection activity until they obtain and mail you verification of the debt.10Office of the Law Revision Counsel. 15 USC 1692g – Validation of Debts
Send your dispute by certified mail, return receipt requested. Include copies of your FTC and police reports and state plainly that the debt resulted from identity theft.11Federal Trade Commission. Fair Debt Collection Practices Act
Do not ignore collection calls hoping they will stop. An undisputed fraudulent debt can turn into a lawsuit, a default judgment, and wage garnishment, all of which are much harder to unwind after the fact. That 30-day dispute window is your strongest leverage.
What You Actually Owe
You owe nothing on a loan you did not apply for. A valid contract requires your consent, and an identity thief cannot give it for you. Once you have reported the fraud and the lender or the bureau confirms it, the debt should come off your name entirely. There is no dollar cap on your liability the way there is for credit card fraud, because the liability never existed to begin with.
The catch is that “no liability” only helps you if you follow through on the reporting and disputing. A fraudulent loan you never dispute can sit on your credit report indefinitely, wreck your score, and end in a collection lawsuit where a court enters a default judgment against you simply because you did not respond.
One boundary worth flagging: if the thief also drained money from your bank account through unauthorized electronic transfers (debit card use, ACH withdrawals), a different rule applies. Your liability there depends on how fast you tell your bank: no more than $50 if you report within two business days of discovering the problem, no more than $500 if you report after that but within 60 days of your statement date, and potentially the full amount for unauthorized transfers after 60 days.12eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Watch for a Surprise 1099-C at Tax Time
If the lender eventually writes off the fraudulent loan and reports the cancellation to the IRS on Form 1099-C, the IRS may treat that canceled amount as taxable income to you. This is backwards from reality, but it happens.
If you receive a 1099-C for a debt you never owed, contact the creditor and demand they correct or withdraw the form. The IRS says your responsibility is to report the correct amount of canceled debt on your return, and if the debt was fraudulent, the correct amount is zero.13Internal Revenue Service. Topic No. 431, Canceled Debt – Is It Taxable or Not?
For a fraudulent loan (as opposed to someone filing a fake tax return in your name), the IRS says you generally do not need to file Form 14039, the Identity Theft Affidavit. Form 14039 is meant for tax-related identity theft. Non-tax identity theft goes to the FTC, credit bureaus, and law enforcement, which you will already have done.14Internal Revenue Service. When to File an Identity Theft Affidavit
When the Lender or Bureau Won’t Cooperate
Most disputes resolve within 30 to 45 days. Sometimes a lender stalls, a bureau marks your dispute “frivolous,” or the fraudulent account keeps reappearing on your file after it was supposedly removed. You have real recourse.
The Fair Credit Reporting Act lets you sue a credit bureau or a lender that fails to meet its obligations. If the violation was willful, you can recover actual damages or statutory damages between $100 and $1,000, plus punitive damages and attorney’s fees.15Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance If the violation was merely negligent, you can still recover actual damages and attorney’s fees.16Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
Before you sue, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. Companies tend to answer faster when a federal regulator is watching. You can also complain to your state attorney general. If nothing moves, a consumer rights attorney who handles FCRA cases will usually take them on contingency, because the statute awards attorney’s fees to successful plaintiffs.
When the Person Who Did It Is Someone You Know
A painful share of identity theft cases involve a parent, spouse, partner, roommate, or adult child. The legal steps are the same, but the decisions are harder. Many victims hesitate to file a police report against a family member.
The tradeoff is direct: without a police report, you cannot get an extended fraud alert, you cannot trigger the four-business-day blocking right on your credit reports, and many lenders will refuse to close the fraudulent account. The FTC report alone does not do it. If you skip the police report to protect the person who took the loan, the fraudulent debt stays on your record and the damage to your credit keeps growing.
Some victims try to handle it privately by having the person pay off the loan. That can work as a matter of money, but it does not remove the account from your credit history and does not stop the person from doing it again. If you decide against pursuing criminal charges, at a minimum place the fraud alert and freeze, pull your reports to check for anything else, and think hard about whether the person still has access to your personal information.