Published July 6, 2026 · Educational information — not legal, tax, lending, or financial advice.
Quick answer
Move in this order: (1) call the company’s fraud department, report the account as fraudulent, and get closure confirmed in writing; (2) freeze your credit at all three bureaus and place a fraud alert so nothing else opens; (3) file an identity theft report at IdentityTheft.gov; (4) dispute the account with each bureau reporting it, attaching the report and requesting a block of the fraudulent information; (5) follow up in writing and keep dated copies of everything. Don’t pay a collector on a fraud debt — paying can imply it’s yours. The law generally protects victims from fraudulently incurred debt, but the protection activates through documentation, not assumption.
Confirm it’s really fraud
Before launching the machinery, spend twenty minutes ruling out the boring explanations: an old account reporting under a new servicer’s name after a transfer, a store card listed under the issuing bank, an account a spouse or household member legitimately opened as a joint account or added you to as an authorized user. If a sudden score change is what brought you here, our guide on why a credit score drops overnight helps you separate routine movement from a fraud signal. Pull all three credit reports — the bureaus keep separate files, so the account may appear on one and not the others — and inventory everything you can’t explain: the account itself, any hard inquiries around its opening date, and any address or employer entries that aren’t yours. The full field guide to that inspection is in how to spot identity theft. What survives investigation is what you escalate — and from here on, the assumption is that it did.
Step 1: Close it at the source
Call the company where the account was opened — ask specifically for the fraud department, not general customer service — and report the account as fraudulently opened. Ask them to close or freeze the account immediately, stop treating you as the responsible party, and send written confirmation that the account was reported as fraud and closed. Note the representative’s name, the date, and any reference number; this is the first entry in your fraud file. Two things not to do on this call: don’t make a payment “to stop the calls,” and don’t agree the debt is yours in any form — payment or acknowledgment can muddy the fraud claim you’re about to document.
Step 2: Lock the file
Someone demonstrably has enough of your information to pass a credit application, so assume the first account won’t be the last attempt. Freeze your credit at all three bureaus — the full process is in how to freeze your credit — and place a fraud alert, which takes one request at one bureau and propagates to the other three files. Once you have the identity theft report from the next step, you qualify for the seven-year extended alert; how the two tools divide the work, and why confirmed victims typically run both, is covered in fraud alert vs. credit freeze. Round out the containment by changing passwords on financial logins and email, since the same data that opened an account can often reset one. Keep monitoring running through all of this, too, so credit alerts flag the next attempt within days rather than at your next application.
Step 3: The identity theft report
IdentityTheft.gov is the federal government’s intake point for identity theft, and filing there produces the document the rest of the process runs on: an identity theft report, plus a personalized recovery plan and pre-filled letters. The report is what converts your claim from “I say this isn’t mine” into a sworn statement with legal weight — it’s what unlocks the bureau block in the next step, what qualifies you for the extended fraud alert, and what stops most collectors. A police report is a supplement, not a substitute: worth adding if you know who did it, if a creditor or bureau specifically asks for one, or if the amounts are large. File the FTC report first; it’s free, online, and immediate.
Step 4: Bureau disputes and the block
Now take the fight to the credit reports. Dispute the fraudulent account with each bureau reporting it — not just one, since the bureaus don’t share dispute outcomes — and attach the identity theft report, proof of identity, and a statement that the information resulted from identity theft. That combination triggers a stronger mechanism than an ordinary dispute: with a qualifying identity theft report, you can request that the bureau block the fraudulent information, and bureaus are generally required to block it from your file within four business days of receiving a complete request. The block covers the account and the downstream debris — related collections and, where applicable, inquiries tied to the fraud (the inquiry-specific removal path is in how to remove unauthorized hard inquiries from your credit report). Ordinary disputes investigate; blocks remove. Use the stronger tool, and confirm afterward on fresh copies of all three reports that the items are actually gone. For the mechanics of the underlying process, see how to dispute an error on your credit report.
If a collector comes calling
Fraudulent accounts age into collections like real ones do, so a collector call may be how you learned about the account in the first place. The rules of engagement: don’t pay, don’t promise to pay, and don’t acknowledge the debt as yours — state that it results from identity theft. Request written validation of the debt, then respond with a copy of your identity theft report and a letter stating the account is fraudulent; a collector who receives an identity theft report generally must suspend collection until the debt is verified, and legitimate verification of a fraud debt fails. If the collection has already landed on your credit reports, it gets swept into the Step 4 block along with its parent account. The general mechanics of collection tradelines — and why paying one doesn’t erase it — are in how long do collections stay on your credit report; the fraud path is the exception where full removal is the designed outcome.
The paper trail that wins
Identity theft recovery is a documentation contest, and the winner is the side with the better file. Keep one folder — physical or digital — containing: the identity theft report; every dispute letter, dated, with delivery confirmation; every written closure confirmation from companies; and a running call log with names, dates, and reference numbers for every phone contact. Follow up each significant phone call with a short written confirmation of what was agreed. The discipline pays twice: it makes each dispute stronger while it’s pending, and if anything resurfaces months later — a blocked account reappearing, a collector reselling the debt — you re-send the file instead of restarting the process. Recovered doesn’t mean finished: keep the freeze on, keep reading your reports, and let monitoring watch the space between reads.
Two real-world examples
The fast catch. Priya’s monitoring alert flags a new card account she didn’t open, two days old, zero balance. She calls the issuer’s fraud department the same morning — account closed, confirmation letter promised. That afternoon she freezes all three bureaus, places a fraud alert, and files at IdentityTheft.gov. The account had only reported to one bureau; her blocking request with the report attached removes it within the week, and the two application inquiries go with it. Total footprint: one folder, four phone calls, no lasting tradeline. The two-day detection did most of the work.
The eighteen-month-old account. Marcus discovers the fraud the hard way — a collector calling about a $4,300 charged-off account opened a year and a half ago. He doesn’t pay; he requests validation, pulls all three reports, and finds the original account on two bureaus and the collection on all three. He works the sequence: fraud department at the original creditor, freeze and extended alert, identity theft report, then block requests at each bureau covering both the account and the collection, plus the report mailed to the collector with a fraud statement. It takes three rounds of follow-up letters over two months, and his fraud file — every call logged, every letter dated — is what keeps each round short. Everything comes off. Same outcome as Priya’s case; twenty times the correspondence, because the account had eighteen months to grow roots.
Key takeaways
- The sequence: close at the source, lock the file, file the identity theft report, dispute-and-block at each bureau, follow up in writing.
- The identity theft report from IdentityTheft.gov is the key document — it unlocks the bureau block, the extended alert, and collector protections.
- A qualifying block request generally requires bureaus to remove fraudulent information within four business days — stronger than an ordinary dispute.
- Never pay or acknowledge a fraud debt to a collector — send the identity theft report with a fraud statement instead.
- Documentation wins: dated letters, delivery confirmations, closure letters, and a call log — and the freeze stays on after recovery.