Most identity theft credit advice hands you a list of seven things to do and leaves out the part that decides how long you spend cleaning up: the order, and which single document does the heavy lifting.
Six of the seven steps are useful. One, the FTC identity theft report, changes your legal standing. Without it you are a person complaining. With it you hold a four-business-day block right, a seven-year fraud alert, and the power to demand records from the business that got fooled. The Federal Trade Commission puts it third in its own recovery sequence.
DollarVisor takes no money for placement, so this identity theft credit guide gives you the legal deadlines, the real report volumes, and the math on what delay costs.
1. The 7 Steps, in the Order That Matters
Quick Answer: Work in this order: call the companies, freeze all three bureaus, add a fraud alert, file your FTC identity theft report, use that report to block the fake accounts, demand the transaction records, then watch your file. Steps one to four take an evening. You can place the freezes online in about 15 minutes.
Doing these out of order is the most common way people lose a month. Disputing before you have the FTC report puts you on the slow track.
- Call the companies where fraud already happened. Ask the fraud department to close or freeze the account and flag it as fraud. Change every login and PIN.
- Freeze your credit at Equifax, Experian and TransUnion. Three separate freezes, free, no expiry.
- Add a one-year fraud alert. One bureau must tell the other two, forcing identity checks on new applications.
- File your FTC identity theft report at IdentityTheft.gov. This is the legal key to everything below.
- Send the report to the bureaus and demand a block. Not a dispute. A block, under FCRA section 605B.
- Ask the business for the thief’s transaction records. You have a written right to them, free.
- Pull your reports and keep checking. Fraud rarely arrives alone, and blocked items can reappear.
Rebuilding after the mess is cleared?
Once the fake accounts are gone, the next decision is which card to reopen your file with. Compare credit cards with no paid placements →
2. What Thieves Actually Opened in Your Name
Quick Answer: Credit cards are the number one target, with 449,076 reports to the FTC in 2024. The important detail is the split: most of that is a brand-new account, not a charge on a card you hold. That is why an identity theft credit response has to start at the bureaus, where new accounts get approved.
Knowing your bucket tells you which steps apply. Here is 2024 by type.
| Type of theft | Volume | Reports | Hits your credit file? |
|---|---|---|---|
| Credit card fraud | 449,076 | Yes, if new | |
| Loan or lease fraud | 176,409 | Yes | |
| Bank account fraud | 114,626 | Rarely | |
| Government benefits | 70,332 | No |
Source: Federal Trade Commission, Consumer Sentinel Network Data Book 2024. Bars scaled to the largest category.
Inside that credit card number sits the split that matters. More than 406,000 reports involved a brand-new card opened in someone’s name, against 52,428 tied to a card the victim already held, per the FTC’s 2024 data book. New-account fraud is the norm, and new accounts are exactly what a freeze stops.
Where you live changes the odds. Florida logged 528 identity theft reports per 100,000 residents in 2024 and Ohio 236, more than a two-to-one gap under the same federal rules, per the same FTC data book.
3. Steps 1 and 2: Call the Companies, Then Lock the Bureaus
Quick Answer: Call the fraud department of every company where you know fraud happened and ask them to close or freeze the account and flag it as fraud. Then freeze all three bureaus. A freeze is free, has no expiry, and does not touch your score, which keeps updating on its normal cycle.
These two steps stop new damage. Neither fixes what is already on your report, and that is fine, because you cannot repair an identity theft credit file while the thief is still working.
- Ask for the fraud department by name. General customer service offers you a form. The fraud team can freeze the account on the call.
- Get a reference number for every call. Date, time, name, reference. You will repeat this story to four organizations.
- Change logins and PINs, not just passwords. If a thief has your email, a new bank password changes nothing.
- Freeze all three bureaus. Each holds a separate file, and a lender who pulls the one you skipped sees an open report.
Freeze after you call the companies, because some fraud departments pull your file while they investigate.
4. Steps 3 and 4: Fraud Alert, Then Your FTC Report
Quick Answer: A one-year fraud alert is free and one bureau must tell the other two. Then file at IdentityTheft.gov to get your FTC identity theft report and a personal recovery plan. That report upgrades your alert to seven years and gives you the block right that ends most identity theft credit disputes early.
People treat the FTC filing as optional admin. It is the opposite: it turns polite requests into legal obligations.
The FTC’s IdentityTheft.gov filing takes about 20 minutes and produces a signed identity theft report plus prewritten letters. Keep the PDF, because every organization below will ask for it.
- Initial fraud alert. One year, free, renewable. Businesses must take reasonable steps to verify identity before opening credit.
- Extended fraud alert. Seven years, but only if you have the FTC identity theft report to back it.
- Recovery plan. Step-by-step, covering tax, medical and utility fraud too.
A police report helps but is not the gatekeeper most people assume. The FTC report alone satisfies the federal definition in most cases, and you can file it at midnight.
5. The Deadline Clock the Law Puts on Everyone Else
Quick Answer: Once you hold an FTC identity theft report, the clock runs against the bureaus and the lender, not you. Blocks are due in four business days. Business records are due in 30 days. A plain credit report dispute gets 30 days, which is why the block route beats it.
Most victims never learn these numbers, so they accept whatever timeline the agent quotes. Here is what the law requires.
| Request | Who must act | Deadline | Cost |
|---|---|---|---|
| Block fraud items (605B) | Credit bureau | 4 business days | $0 |
| Hand over records (609(e)) | The business | 30 days from written request | $0 |
| Place a freeze (online or phone) | Credit bureau | 1 business day | $0 |
| Lift a freeze (online or phone) | Credit bureau | 1 hour | $0 |
| Investigate a standard dispute | Credit bureau | 30 days, 45 with new evidence | $0 |
| Extended fraud alert | Credit bureau | 7 years, free, with the FTC report | |
Source: FCRA sections 605A, 605B and 609(e), and FTC consumer guidance.
Two get quoted wrongly all the time. The four-business-day block gets called a 30-day dispute, and the records rule gets called subpoena-only. Neither is true.
6. Step 5: Block the Fake Accounts, Do Not Just Dispute Them
Quick Answer: A dispute asks the bureau to check whether an account is accurate. A block tells the bureau the account is not yours at all, and it must come off in four business days. Blocks need the FTC identity theft report attached, which is why a generic 609 letter template gets you nowhere here.
This is the most valuable thing on this page. Under FCRA section 605B, a bureau that gets a valid identity theft report and proof of identity must block the listed items within four business days and tell the furnisher, which must then stop reporting and cannot sell the debt to collections.
Your block request needs four things in one envelope. Missing one is the usual reason a block gets bounced back as an ordinary dispute.
- Your FTC identity theft report. The signed PDF from IdentityTheft.gov, not a screenshot of the confirmation page.
- Proof of identity. Government ID plus something showing your current address.
- A line-by-line list of what is fraudulent. Creditor name, account number, date, amount. Vague requests get vague answers.
- A clear statement that the account is not yours. Say the information resulted from identity theft, in those words.
Send it to all three bureaus, because a block at one does not travel.
Being sold a fast fix while you are stressed?
Paid services cannot do anything here that the FTC report does not already give you free. See what credit repair companies can and cannot do →
7. Steps 6 and 7: Get the Records, Then Watch the File
Quick Answer: Write to the business that opened the fake account and demand the application and transaction records under FCRA 609(e). They must send them within 30 days, free, without a subpoena. Then pull all three reports weekly, because blocked items and new collection accounts can reappear.
Step six is the one almost nobody uses. The FTC is explicit that a business which accepted the thief’s application must turn those records over to the victim on written request. They show which address, phone and email the thief used, which is how people find the accounts they did not know about.
Step seven is boring and unavoidable. Pull free weekly reports from all three bureaus at AnnualCreditReport.com and read every section. Check addresses, employers and inquiries, because a strange address is how the next fake account gets mailed somewhere you never see it.
8. What Each Step Covers, and What It Misses
Quick Answer: No single step does everything. Freezes stop new accounts but remove nothing. Blocks remove accounts but stop nothing new. Fraud alerts slow thieves down without blocking them. Together they cover the whole surface, which is why shortcuts sold as a clean new file are always a scam.
| Step | Blocks new accounts | Removes existing fraud | How long it lasts | Time to do |
|---|---|---|---|---|
| 1. Call the companies | That account only | Charges only | Permanent | 1–2 hours |
| 2. Freeze all three bureaus | Yes | No | Until you lift it | 15 min |
| 3. Fraud alert | Slows, not blocks | No | 1 year, 7 with FTC report | 10 min |
| 4. FTC identity theft report | No | Enables it | Permanent record | 20 min |
| 5. Block under 605B | No | Yes | Permanent | 1 hr, clears in 4 days |
| 6. Records request | No | Evidence only | One-off | 30 min, 30-day reply |
| 7. Watch the file | No | Catches repeats | Ongoing | 10 min weekly |
Source: DollarVisor analysis of FCRA sections 605A, 605B and 609(e) and FTC consumer guidance, 2026.
9. What Waiting Costs You, Month by Month
Quick Answer: A fake account is cheap to remove in week one and expensive in month six. The damage curve follows normal reporting rules: a missed payment at day 30, a charge-off around day 120 to 180, then collections. Each stage adds a separate item to explain a falling score.
The model below shows how one unpaid fraudulent card ages if nobody blocks it. It is illustrative, built on standard furnisher reporting timelines, not a measured average.
| Days since opened | What posts to your file | Relative severity | Effort to remove |
|---|---|---|---|
| 0–29 | Hard inquiry, new tradeline | Low | |
| 30–59 | First 30-day late payment | Low | |
| 60–119 | 60 and 90-day lates stack | Medium | |
| 120–180 | Charge-off posted | High | |
| 180+ | Sold to collections | Highest |
Illustrative DollarVisor model based on standard furnisher reporting timelines. Severity bars are relative, not score points.
The lesson is narrow. Once a charge-off posts, you are removing a tradeline, a payment history, and often a separate collection entry for the same debt, each with its own furnisher.
Not sure which card the thief opened?
Comparing issuers side by side helps you recognise the product name on the tradeline. Browse our credit card comparisons →
10. Five Mistakes That Cost Victims Months
Quick Answer: The five costly mistakes are skipping the FTC report, filing a dispute instead of a block, freezing only one bureau, paying someone to do free work, and closing the fraud file too early. All five are avoidable in an evening, and removing an aged charge-off is far harder than preventing one.
- Treating the FTC filing as optional. Without it there is no block right and no seven-year alert.
- Using the online dispute button. It routes your fraud into a 30-day accuracy review instead of a four-day block.
- Freezing one bureau. Thieves apply repeatedly, and one open file is enough for the next account.
- Paying for identity theft credit repair. Nothing in this list costs money, and no company gets a faster deadline than you do.
- Stopping once the accounts come off. Stolen details keep circulating, so keep the freeze on.
There is a sixth, harder to name: waiting for someone to tell you it is serious. Nobody calls. The first sign is usually a denial letter, months in.
11. Our Verdict
Quick Answer: Do all seven steps, but do step four tonight. The FTC identity theft report is the only item that changes what other organizations are legally required to do for you, and every other step gets faster once you hold it.
Our read of the identity theft credit rules: the system is fairer than victims expect, and slower than it looks if you use the wrong words. Four business days is a real deadline. So is 30 days for records. Both exist only once you have filed.
If you do nothing else today, file at IdentityTheft.gov, then freeze all three bureaus. The rest can wait until the weekend.
12. Frequently Asked Questions
1. What is the first thing to do after identity theft?
Call the fraud department at every company where you know fraud happened and ask them to close or freeze those accounts. That stops new charges immediately. Then freeze all three bureaus so the thief cannot open anything else.
2. Do I need a police report for identity theft credit problems?
Usually not. The FTC identity theft report you get from IdentityTheft.gov satisfies the federal definition of an identity theft report on its own in most cases. A police report is still worth filing if a specific creditor demands one, or if you know the person who used your information.
3. How long does it take to remove fraudulent accounts from a credit report?
Four business days from when the bureau receives a valid identity theft report, proof of your identity, and a clear list of the fraudulent items. That is the block process under FCRA section 605B. An ordinary dispute takes up to 30 days and can be closed without removing anything.
4. Does identity theft hurt your credit score permanently?
No. Once fraudulent accounts are blocked and removed, the score effect goes with them, because the score is calculated from what is on the report. The lasting damage comes from waiting, since late payments and charge-offs added over months take longer to unwind.
5. Should I pay for identity theft protection after being a victim?
It is optional, and no substitute for the steps here. Freezes, fraud alerts, FTC reports, blocks and weekly reports are all free. Paid services mainly add alerts and admin help, so treat them as convenience, not protection.
Ready to plan your next credit move?
Tell us where you are in the recovery, and we will point you to the state-level numbers and the show-the-math comparisons that fit your situation. No paid placements, ever.