What to Do First When Identity Theft Hits Your Credit Report

You checked your credit report and there's an account you never opened. Maybe it's a credit card, maybe it's a $4,200 personal loan, maybe it's a collection notice for a phone plan in a city you've never lived in. Your first instinct is panic. Your second instinct is to call the credit bureau. Neither one is the right first move.

Here's the actual first step: get a copy of your credit report from all three bureaus and write down every account that isn't yours, with the account number, the creditor name, and the date opened. Then go to IdentityTheft.gov and file a report. That report generates an FTC Identity Theft Affidavit, and that document is what unlocks everything else. Without it, you're just a person making a claim. With it, you're a person with a federal record, and creditors and bureaus treat those very differently.

I've seen this play out with investors and tenants both, people whose deals stalled because a fraudulent account tanked their score right before closing. The pattern is always the same. The people who fix it fast document first and dispute second. The people who stay stuck call and complain first, then try to prove it after the fact.

Why the order matters

A dispute without documentation is a request. A dispute with an FTC affidavit is closer to a demand, because federal law backs it.

Under the Fair Credit Reporting Act, once you submit an identity theft report, the bureaus have to block the fraudulent information from showing on your report, usually within four business days, while they investigate. That's different from a normal dispute, which just gets "investigated" over 30 days with no guarantee of a block in the meantime.

Say your report shows a $6,800 credit card opened in your name that you never touched. If you dispute it as a regular error, it can sit open for weeks while your utilization looks like you're carrying that balance, and your score stays depressed the whole time. If you dispute it as identity theft with the affidavit attached, the bureau is required to block it within days, and your score can recover before your next mortgage or auto rate lock.

What people get wrong

The biggest mistake is calling the creditor first. People phone the credit card company, explain the situation, and expect a fix on the spot. Creditors aren't set up to resolve this over the phone. They'll open an internal fraud case, which can take 60 to 90 days, and in the meantime the account keeps reporting to the bureaus as delinquent.

The second mistake is disputing only with the bureau that shows the account, and assuming the other two are fine. Fraud rarely stays contained. If someone opened a card using your name and old address, there's a decent chance they tried at more than one lender. Pull all three reports, Equifax, Experian, TransUnion, because a stale address on file is often the actual reason the fraud got approved in the first place. An old address makes it harder for a lender's identity check to flag a mismatch, and it makes it harder for you to catch the account before it ages.

The third mistake is not freezing your credit while you sort out the fraud. A freeze doesn't fix the existing accounts, but it stops new ones from opening while you're mid-dispute. It's a two minute step on each bureau's website and it costs nothing.

The actual sequence

1. Pull your reports from all three bureaus.
2. Flag every account you don't recognize, with account number and open date.
3. File at IdentityTheft.gov and download the affidavit. This takes about 20 minutes.
4. Freeze your credit at Equifax, Experian, and TransUnion.
5. Send the affidavit to each bureau with a dispute for the specific fraudulent accounts, not a general complaint.
6. Send a copy of the affidavit to each creditor listed, by certified mail if the account is large or already in collections.
7. Set a calendar reminder for 30 days out to check that the accounts are actually removed, not just "under review."

That last step matters more than people think. A block is temporary. If the bureau's investigation doesn't result in a permanent deletion, the account can come back onto your report after the block period ends. Check it. Don't assume silence means it's fixed.

A worked example

Someone I know found a collections account for $1,150 from a wireless carrier, opened in a state she'd never lived in. Her score had dropped from 712 to 649, a 63 point hit, almost entirely from that one derogatory mark plus the utilization shift from a second fraudulent card sitting at $2,300.

She filed the FTC report on a Tuesday. By Friday, both accounts were blocked pending investigation, not yet deleted, but no longer counting against her utilization or payment history. Her score came back to 698 within about three weeks, before the accounts were even fully resolved, because the block itself stopped the damage. Full deletion took another 45 days after that. The score recovery happened well before the paperwork was finished, because the block is what actually protects the number.

Without the affidavit, she'd have been stuck disputing two separate accounts at two separate creditors with no negotiating power and no deadline forcing anyone's hand.

The honest limitation

None of this makes the fraud disappear instantly, and it doesn't undo damage that already happened, like a mortgage rate lock you missed or a lease application that got denied last month. The block protects your score going forward. It doesn't retroactively fix decisions other lenders already made based on the report they saw before you filed. If you're mid-transaction when you discover the fraud, you may still need to explain the situation directly to that specific lender, affidavit in hand, and ask if they'll re-run the file. Some will. Some won't. That part isn't guaranteed, and I'm not going to pretend otherwise.

If your credit picture has other issues layered on top of the fraud, old collections, high utilization on real accounts, thin file problems, fixing the theft is the first domino, not the whole structure. That's the part most people underestimate. Once the fraudulent stuff is off, you still have to build what's left into something a lender actually wants to approve.

That's the work we walk through inside Foundation at readmoneydecoded.com/foundation. Come find it once the fraud is documented and the blocks are in place. That's when the real rebuilding starts.

← All articles