Identity theft hits your credit harder than almost any other event because it creates negative items you had no control over and never consented to. A thief who opens a credit card in your name, runs it up, and stops paying can add a charge-off, a collection, multiple hard inquiries, and a new derogatory account — all in one incident. The good news: the FCRA gives identity theft victims stronger dispute rights than ordinary consumers, and the recovery roadmap is well-defined.

This guide covers the full process: immediate actions to stop the bleeding, how to dispute fraudulent accounts, how to use an Identity Theft Report to fast-track removals, and a realistic timeline for getting your score back to where it was before the theft.

Step 1: Contain the Damage Immediately

The first 48 hours after discovering identity theft are critical. Every action you take now limits how much additional damage the thief can do and establishes the paper trail you will need to dispute fraudulent items.

Place a Fraud Alert

Contact any one of the three major credit bureaus — Experian, Equifax, or TransUnion — and request a fraud alert. Under the FCRA, when you place a fraud alert at one bureau, they are required to notify the other two. A fraud alert requires lenders to verify your identity before opening new credit in your name.

• An initial fraud alert lasts one year and is free.
• An extended fraud alert lasts seven years and requires a copy of an Identity Theft Report (see Step 2 below). It also entitles you to two free credit report copies from each bureau within 12 months.

Consider a Credit Freeze

A credit freeze (also called a security freeze) is stronger than a fraud alert — it blocks new creditors from pulling your credit at all, making it impossible for a thief to open new accounts in your name. Freezes are free at all three bureaus and can be placed and lifted online. Unlike a fraud alert, you have to contact each bureau separately.

• Experian: experian.com/freeze
• Equifax: equifax.com/personal/credit-report-services
• TransUnion: transunion.com/credit-freeze

A credit freeze does not affect your existing credit — it only prevents new inquiries and new account openings. If you need to apply for credit, you temporarily lift the freeze, apply, then re-freeze. The process takes minutes online.

Change Passwords and Secure Your Accounts

Identity theft often involves compromised passwords, data breaches, or physical documents. Change the passwords on financial accounts, email, and any account connected to your Social Security number. Enable two-factor authentication on financial accounts. Shred documents containing sensitive information going forward.

Step 2: File an Identity Theft Report

An Identity Theft Report is the most powerful document you can have in a credit dispute after identity theft. It gives you accelerated removal rights under the FCRA that ordinary consumers don't have. Create yours at IdentityTheft.gov — the FTC's official identity theft reporting portal.

The IdentityTheft.gov process walks you through documenting what happened, generates a personalized recovery plan, and produces an official FTC Identity Theft Report that you can use in disputes with credit bureaus and creditors.

You can also file a police report with your local law enforcement. While not legally required, a police report adds another layer of official documentation. Some creditors and bureaus respond more quickly when a police report accompanies your dispute.

Step 3: Pull All Three Credit Reports and Audit Every Item

Get your free reports from AnnualCreditReport.com (all three bureaus are available weekly). Print or save each one. Then go through every item methodically:

• Accounts you don't recognize — any account you didn't open is potentially fraudulent
• Hard inquiries from lenders you didn't apply with — each application for credit generates an inquiry; ones you don't recognize indicate the thief tried (or succeeded) in applying for credit in your name
• Addresses or employers you don't recognize — thieves often add their own address to your file
• Negative items on accounts you do recognize — sometimes thieves take over existing accounts (account takeover fraud) rather than opening new ones

Create a complete list of every fraudulent or suspicious item on each bureau. You will need this for the dispute process.

Step 4: Dispute Fraudulent Accounts at the Bureaus (Expedited Block)

With an Identity Theft Report in hand, you can invoke FCRA Section 605B to request an expedited block of fraudulent information. This is different from and faster than a standard dispute.

Send a written request to each bureau that shows the fraudulent information. Your request must include:

1. Your full name, address, and SSN (for identity verification)
2. A copy of your FTC Identity Theft Report
3. A copy of your government-issued ID
4. A specific list of the items you want blocked (account name, account number or partial number, and why you believe it is fraudulent)
5. A statement that the information resulted from identity theft

Under Section 605B, the bureau must block the fraudulent information within 4 business days of receiving this request and must notify the furnisher (the creditor) of the block. The bureau can decline the block if they believe the request itself is fraudulent, but if you are a genuine victim with proper documentation, blocking should proceed quickly.

Send all dispute packages via USPS Certified Mail with Return Receipt. Bureau addresses: Experian, P.O. Box 9554, Allen, TX 75013 | Equifax, P.O. Box 740256, Atlanta, GA 30374 | TransUnion, P.O. Box 2000, Chester, PA 19016.

Step 5: Dispute Directly with the Creditors

Simultaneously with your bureau disputes, contact each creditor that has a fraudulent account directly. Under FCRA Section 623, furnishers must investigate disputes sent directly to them. For identity theft victims, creditors also have specific obligations under Section 605B and the Fair Debt Collection Practices Act.

When contacting creditors:

• Call the fraud department (not general customer service) and follow up in writing
• Provide your FTC Identity Theft Report, a copy of your ID, and the account numbers in question
• Request that the account be closed and flagged as fraudulent in their system
• Request a written confirmation that you are not responsible for the debt
• Document every contact — date, time, representative name, reference number

Most creditors will close fraudulent accounts and zero the balance once you have a documented Identity Theft Report. The harder cases are older debts that have already been sold to collection agencies — in those cases, the collection agency dispute (below) is the key step.

Step 6: Handle Fraudulent Collections

If a fraudulent account was charged off and sold to a collection agency, the collection will appear as a separate negative item on your report even after the original creditor removes their entry. Collections are disputable under the same identity theft framework.

Send the collection agency a debt validation letter (requiring them to prove the debt is valid and that you owe it) combined with your Identity Theft Report. Under the FDCPA and FCRA, collectors cannot continue to report a debt or attempt collection if they cannot validate it — and a properly documented identity theft claim significantly reduces their ability to validate.

After sending the validation letter, file a separate dispute with each bureau referencing the same collection account as fraudulent. Provide the FTC Identity Theft Report. The bureau's Section 605B block obligation applies to collection tradelines as well as original creditor accounts.

You can access our dispute letter templates including the debt validation and identity theft-specific versions through the Credit Fix Kit.

Step 7: Dispute Unauthorized Hard Inquiries

Hard inquiries from lenders you never applied to are a byproduct of the thief shopping for new credit in your name. These inquiries affect your credit score — under FICO 8, each hard inquiry costs approximately 5 points, with the impact fading over 12 months. But they still appear on your report for two years.

Dispute unauthorized inquiries directly with the bureau that shows them. Use a simple dispute letter stating you did not authorize the inquiry and attaching your Identity Theft Report. Unauthorized inquiries are among the easiest items to get removed because the creditor who pulled your credit often cannot verify that you consented to the inquiry.

For more detail on this process, see our guide on removing negative items from your credit report.

Realistic Recovery Timeline

Identity theft credit recovery follows a predictable sequence, but the timeline depends on how many fraudulent accounts were opened and how quickly the bureaus and creditors respond:

For consumers who had clean credit before the theft, full score recovery within 3–6 months is realistic if the dispute process is executed quickly and thoroughly. If the theft is discovered years later (the worst case), recovery takes longer because fraudulent accounts have more history and are harder to remove.

What to Do When Disputes Are Denied

If the bureau or creditor verifies a fraudulent item despite your documentation, escalate:

1. File a CFPB complaint at consumerfinance.gov/complaint. The CFPB notifies the bureau and requires a response within 15 days. Compliance rates improve significantly when the CFPB is involved.
2. File an FTC complaint and update your Identity Theft Report with the new information.
3. Request the method of verification. Under the FCRA, you can ask how the bureau verified the item. If they used an automated system (e-OSCAR) without reviewing actual documentation, that is grounds for re-dispute with more specific information.
4. Consult an FCRA attorney. Identity theft victims who are systematically denied legitimate disputes often have FCRA violations they can sue over. FCRA allows statutory damages of $100–$1,000 per violation, plus attorney fees. Many FCRA attorneys take these cases on contingency.

Rebuilding After Identity Theft

Once fraudulent items are removed, your credit doesn't automatically snap back — especially if the process took time and your score stayed depressed while disputes were pending. Active rebuilding accelerates the recovery:

• Verify your existing positive accounts are still reporting correctly. Sometimes account takeover fraud damages existing accounts rather than just opening new ones. Make sure your long-standing positive accounts are still showing correctly.
• Keep credit utilization below 10%. Under FICO 8, credit utilization is 30% of your score. Low balances relative to limits produce fast score gains.
• Consider an authorized user addition from a family member with a long, clean credit card — this adds positive account history to your report.
• Monitor all three bureaus monthly for at least 12 months after the theft. New fraudulent items can surface weeks or months after the initial theft if the thief sold your information to other criminals.

The DIY credit repair kit includes dispute letter templates for every stage of this process — identity theft-specific dispute letters, Section 623 direct creditor disputes, debt validation for fraudulent collections, and CFPB complaint templates.

Identity Theft Credit Repair FAQ

How long does it take to fix credit after identity theft?

With an FTC Identity Theft Report and a properly executed dispute process, most fraudulent accounts should be removed within 30–60 days. FICO 8 scores typically start recovering within two to three billing cycles after fraudulent accounts disappear. Full recovery to pre-theft levels takes 3–6 months for consumers who had clean credit before the theft.

Do I have to pay debts from identity theft?

No. Debts incurred by a thief using your identity are not legally your obligation. You are protected under the FCRA and the Fair Debt Collection Practices Act. A properly documented Identity Theft Report establishes that you did not incur the debt. Never pay a fraudulent debt — payment could be interpreted as admission of liability.

What is the difference between a fraud alert and a credit freeze?

A fraud alert asks lenders to verify your identity before opening new credit — it doesn't block them. A credit freeze blocks all new credit inquiries, making it impossible for a thief to open new accounts. Freezes are more protective but require you to temporarily lift them when you want to apply for credit yourself.

Should I hire a credit repair company after identity theft?

No. Credit repair companies use the same FCRA dispute rights you have for free, and identity theft victims have especially strong FCRA rights (Section 605B) that companies don't give you access to more quickly than you can access them yourself. The process is document-intensive but entirely doable without paying anyone. The Credit Fix Kit gives you every letter template you need.

Can identity theft reappear after I remove it?

Yes — this is called re-insertion, and it is regulated by the FCRA. If a deleted item is re-inserted, the bureau must notify you within 5 business days before re-inserting it. Keep your Identity Theft Report and all dispute correspondence indefinitely so you can challenge any re-insertion quickly. Monitor your reports monthly for at least 12 months after the initial theft.