If someone put a bill in your name, federal law treats it as identity theft, and you have concrete tools to get the account off your credit report and avoid paying a debt you never agreed to. The essentials are an FTC Identity Theft Report, a dispute filed with the credit bureaus, and a direct challenge to the creditor. Speed matters. The faster you move, the less damage sticks.
Report the Fraud First
Before you argue with anyone about who owes what, create an official record. Three reports do most of the work.
Start at IdentityTheft.gov, the FTC’s recovery portal. You answer questions about what happened, and the site produces an FTC Identity Theft Report along with a personalized plan that includes pre-filled letters for creditors and credit bureaus.1Federal Trade Commission. IdentityTheft.gov Recovery Steps That report is not just paperwork. It unlocks specific legal rights, including the power to force credit bureaus to block fraudulent accounts entirely.
Next, file a police report with your local law enforcement agency. Not every department will investigate, but the report itself carries weight. Many creditors and credit bureaus want to see one before they’ll act, and it strengthens your position if the fight escalates. Ask for a copy or a case number before you leave.
Then contact the company that sent the bill. Ask for the fraud department, tell them you never opened the account, and request that they freeze or close it while they investigate. Put the same information in writing and send it by certified mail so you can prove it arrived. Financial institutions are required under federal regulation to maintain identity theft prevention programs, so a process should already exist for handling your report.2eCFR. 16 CFR Part 681 – Identity Theft Rules
If your Social Security number was used, report the misuse to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov or 1-800-269-0271.3Social Security Administration. Fraud Prevention and Reporting
Get the Account Off Your Credit Report
Reporting the fraud is step one. Getting the account off your credit report is step two, and the Fair Credit Reporting Act gives you two ways to do it.
Standard Dispute
You can dispute inaccurate information directly with Equifax, Experian, and TransUnion. Each bureau has 30 days to investigate once it receives your dispute, and if the information cannot be verified, the bureau must delete it.4Federal Trade Commission. Fair Credit Reporting Act Section 611 The bureau can extend the window by 15 days if you send additional information mid-investigation. Within five business days after finishing, the bureau must notify you of the results in writing.
The company that reported the account (the “furnisher”) also has to investigate when the bureau forwards your dispute. If it cannot verify the information, the bureau must delete it.5Federal Trade Commission. Consumer Reports – What Information Furnishers Need to Know This is where most fraudulent accounts die: the company that opened the account cannot verify a transaction you never authorized.
Identity Theft Block
With an FTC Identity Theft Report or police report in hand, you have access to something stronger. Under FCRA Section 605B, a credit bureau must block information you identify as resulting from identity theft within four business days of receiving your identity theft report, proof of identity, a list of the fraudulent items, and your statement that the information does not relate to any transaction you made.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft A block is more permanent than a standard dispute. Once information is blocked, it should not reappear.
Submit your block request to all three bureaus separately. Include copies (never originals) of your identity theft report, a government-issued ID, and a clear list of which accounts are fraudulent.
Fight the Charges With the Creditor
Cleaning your credit report does not, by itself, make the bill go away. You also have to deal with the creditor so you are not held responsible for the money. The rules depend on the kind of account.
Credit Card Accounts
The Fair Credit Billing Act covers unauthorized charges on credit cards and other open-end credit. You have 60 days after the creditor mails the first statement showing the error to send a written dispute to the creditor’s billing-error address, which is not the same as the payment address. Include your name, account number, the date and amount of the disputed charge, and why you believe it is wrong.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
The creditor must acknowledge your dispute within 30 days and resolve it within two billing cycles, and no more than 90 days total. While the dispute is pending, the creditor cannot try to collect the amount or report it as delinquent.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Send everything by certified mail with a return receipt.
Debit Cards and Bank Accounts
If the fraud involves a debit card or bank account, the Electronic Fund Transfer Act applies instead, and the deadlines are much tighter. Report unauthorized transfers within two business days of learning about them and your maximum liability is $50. Wait longer than two days but less than 60 days after your statement is sent, and your exposure jumps to $500. Miss the 60-day window entirely, and you can be on the hook for the full amount of any transfers that happened after that deadline.8Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability If a debit card or bank account is involved, report it the same day.
If a Debt Collector Is Already Calling
Fraudulent accounts sometimes reach a collection agency before you know they exist. If a collector contacts you about a debt you never incurred, the Fair Debt Collection Practices Act gives you a path to shut it down.
Send the collector a written dispute within 30 days of their first contact. The collector must stop all collection activity until it verifies the debt and mails that verification to you.9Federal Trade Commission. Fair Debt Collection Practices Act For identity theft specifically, you can also send a written request at any time telling the collector to stop contacting you.
Collectors are also prohibited from selling or transferring a debt they know resulted from identity theft. Once you have submitted an identity theft report and notified the collector, that collector cannot place the fraudulent debt for further collection.10eCFR. 12 CFR Part 1006 – Debt Collection Practices (Regulation F) Keep copies of every letter. If a collector keeps pursuing a debt you have already reported as fraudulent, that is a violation you can sue over.
Lock Down Your Credit
Once the immediate fraud is being handled, close the door on the next attempt. Two tools work differently and can be used together.
Credit Freeze
A credit freeze blocks anyone from pulling your credit report to open a new account. Freezes have been free for every consumer under federal law since September 2018, including for children under 16 and dependents under guardianship.11Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts Contact each bureau individually to place one. When you need to apply for credit yourself, bureaus must lift the freeze within one hour for online or phone requests, or within three business days for mailed requests.12USAGov. How to Place or Lift a Security Freeze on Your Credit Report
A freeze is the single most effective protection against new fraudulent accounts. It does not affect your credit score and does not touch existing accounts.
Fraud Alert
A fraud alert tells creditors to verify your identity before extending new credit, without blocking access to your report. An initial alert lasts one year and can be renewed. Confirmed identity theft victims with an FTC report or police report can place an extended alert that lasts seven years.13Federal Trade Commission. Credit Freezes and Fraud Alerts You only contact one bureau, and that bureau notifies the other two.
Medical Bills and Utility Accounts
Not every fraudulent bill comes from a credit card issuer or bank. Identity thieves also open utility accounts, receive medical treatment under someone else’s name, and rack up charges with providers that do not run credit checks.
For fraudulent medical bills, HIPAA’s privacy rule lets you request copies of your medical and billing records from each provider, and then dispute inaccurate information in writing. The provider must correct inaccurate records and notify anyone else who received the wrong information. Once a provider or insurer has a copy of your identity theft report, it cannot report the fraudulent debt to credit bureaus.14Federal Trade Commission. Medical Identity Theft – FAQs for Health Care Providers and Health Plans Wrong medical records can also lead to wrong treatment, so dispute these even when the dollar amounts look small.
For utility accounts and other non-credit bills, the process mirrors what you would do with a bank: contact the company’s fraud department, send a written dispute with a copy of your police report or FTC Identity Theft Report, and ask for the account to be closed. If the bill has already been sent to collections, follow the collector steps above.
When the Person Who Did It Is Family
A stranger stealing your identity through a data breach is one scenario. A parent, spouse, roommate, or adult child opening accounts in your name is another, and it happens more often than most people expect. The legal steps do not change. The emotional calculus does.
The FTC report and the credit bureau disputes work the same way regardless of who committed the fraud. Filing a police report against a family member is where victims often hesitate. The reality is this: without a police report, your ability to block fraudulent information and stop creditors from pursuing you is significantly weaker. The Section 605B block requires an identity theft report, and many creditors will not close a fraudulent account without one.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft
Filing a report is not the same as pressing charges. In many jurisdictions, the decision to prosecute belongs to the district attorney, not to you. What the report does is create the documentation you need to protect yourself financially. Skipping it to spare someone’s feelings can leave you legally responsible for debts they created in your name.