Identity Theft Recovery: Reports, Credit Freezes, Disputes, and Documentation

Identity theft recovery has an order, and the order matters more than the effort. The first steps stop new damage. The middle steps generate an official report, which is the document that turns polite requests into legal obligations. Only then do the disputes and blocks work, because the strongest of those rights are conditioned on producing that report.

People who skip ahead — calling every creditor first, disputing entries before there is a report to attach — usually end up repeating the whole sequence months later with worse records.

The first 72 hours

1. Contain the accounts you control

   Change passwords and add multi-factor authentication on email first, then on financial accounts. Email is the recovery channel for everything else, so a compromised inbox undoes every other step. Call the fraud department of any institution where money or credit has already moved and ask them to note the account as compromised.

2. Pull all three credit files

   Get reports from the three nationwide bureaus through AnnualCreditReport.com, the federally authorized source. Free weekly online access has been available in recent years and the bureaus have said it will continue — confirm the current frequency on the site itself. Read the inquiries section, not just the accounts; new-account fraud shows up there first.

3. Freeze, then alert

   Place a security freeze at each of the three bureaus. Freezes have been free for all consumers nationwide since the 2018 federal law, and the bureaus must generally place one within a business day of an online or telephone request and lift it within an hour when you ask through the same channel. Keep the PINs somewhere you will still have them in a year.

4. Report to the FTC

   Work through IdentityTheft.gov, which produces both a personal recovery plan and an FTC identity theft report with pre-filled dispute letters. Save the report as a PDF the moment it is generated.

5. Decide about a police report

   The FTC report satisfies the federal definition on its own, but many creditors and some state programs still ask for a local police report. File one where the theft involved a stolen wallet, a known suspect, criminal use of your identity, or a landlord, employer, or utility that requires it.

Deadline discipline: containment can wait a day; the money deadlines cannot. Electronic transfer and credit card claims run from statement dates, so open every statement now rather than after the credit repair work is done.

Why the identity theft report is the pivot

Federal law defines an identity theft report as a report alleging identity theft, filed with a federal, state, or local law enforcement agency, where making a false statement carries criminal penalties. The Federal Trade Commission is a federal agency, so the sworn report produced through its site qualifies. That single document is a precondition for the strongest consumer rights in the statute.

Blocking can be declined or rescinded if the information turns out to be yours or if the request contains a material misrepresentation, which is the reason the report is sworn. Get the item list right: identify the specific accounts, inquiries, and collection entries by furnisher name and account number, and do not sweep in a legitimate debt you would rather not pay.

Freeze, lock, or fraud alert

Freezing the three nationwide bureaus is necessary but not sufficient. Specialty consumer reporting agencies compile bank-account histories, telecommunications and utility records, insurance claims, and rental histories, and thieves route around a nationwide freeze by opening accounts that are screened elsewhere. The Consumer Financial Protection Bureau publishes a list of consumer reporting companies with contact details — start there, and freeze or request files from the ones relevant to how the fraud is occurring. It is also worth opting out of prescreened credit offers through the industry opt-out line authorized by federal law, which removes a supply of pre-approved mail.

Money that has already moved

Credit file repair and loss recovery are separate tracks with separate clocks. Losses from electronic transfers out of a consumer account — debit card, bank transfer, most peer-to-peer payment app activity — fall under Regulation E. Liability caps depend on how fast the consumer reports, and the outer limit is unforgiving: transfers appearing on a periodic statement that are not reported within sixty days of the statement being sent can leave the consumer bearing the full loss. Once notice is given, the institution investigates on a defined schedule and must issue provisional credit in defined circumstances when the investigation runs long. Our brief on Regulation E error resolution works through those windows in detail.

Unauthorized credit card charges are governed by different provisions. Cardholder liability for unauthorized use is capped at a low statutory figure and most issuers waive it entirely; billing error disputes must be sent in writing within sixty days of the statement containing the error, and the issuer then has defined periods to acknowledge and resolve. Send the letter even if the phone call worked, because the written dispute is what creates the legal obligations.

Two other categories need their own filings. Tax identity theft — someone filing a return using your Social Security number — is handled through the IRS identity theft affidavit and, once available to you, an identity protection PIN for future filings. Medical identity theft requires requesting records from each provider and insurer, correcting the file, and asking for an accounting of disclosures, because a wrong blood type or allergy in someone else's chart is a safety problem, not just a billing one.

Disputes, follow-through, and the file you keep

• A single PDF of the FTC identity theft report, plus any police report number and the officer's name.
• Copies of all three credit reports as they existed on discovery day, before anything was corrected.
• A dated log of every call: institution, department, representative, reference number, and what was promised.
• Copies of every dispute letter, sent so that delivery can be proved, with the specific items and the basis identified.
• Freeze confirmations and PINs for each bureau and each specialty agency.
• Business records obtained from creditors showing the applications the thief submitted, including addresses and phone numbers used.
• Calendar entries for follow-up: bureau reinvestigations generally run about thirty days, extendable when you supply more information mid-stream.
• A re-pull of all three reports sixty to ninety days out to confirm that blocked items stayed gone and did not reappear through a resold debt.

Two failure modes deserve attention. First, blocked or deleted entries can return when a debt is sold and the new owner re-reports it, which is why the later re-pull matters. Second, a fraudulent account that reaches collections can produce a lawsuit filed against you by a party that never saw your dispute; respond to any court papers on time rather than assuming the underlying fraud speaks for itself. Errors also propagate into employment screening, where a different set of procedures applies — see our brief on FCRA disclosure and adverse action in background checks.

Questions the desk gets

Will a freeze hurt my credit score or stop my existing cards?

No. A freeze restricts access to your credit file by most new creditors; it does not change your score, close accounts, or interrupt existing cards, loans, or utility service. Companies you already do business with can still access your file for account review. The real cost is friction — you must lift the freeze before applying for credit, renting, or sometimes opening a mobile phone line, which through online or phone requests is generally quick.

A collector says the debt is mine because it matched my Social Security number. Now what?

Dispute in writing, attach the identity theft report, and request the underlying documents — the application, signature, and transaction records — using the federal business-record right. A number match is not proof. Also dispute the entry with each credit bureau reporting it so the furnisher's investigation duties are triggered, and keep proof of delivery of everything you send.

Someone used my name when they were arrested. Does this process fix that?

Only partly. Credit remedies do not touch court and law enforcement records. Criminal identity theft is corrected through the arresting agency, the prosecutor, and the court where the case was filed, usually with fingerprint comparison, and several states run identity theft passport or verification programs for exactly this problem. Because the record can surface in background checks and in later criminal matters, our brief on collateral consequences beyond the sentence explains what is at stake if it is not corrected.

My data was in a company's breach notice. Do I do all of this now?

Not all of it. Exposure is not theft. Freeze the three bureaus, take any offered monitoring, and watch your statements and credit inquiries. Hold off on the FTC report until something actually happens, because that report is a sworn statement that identity theft occurred. What a company owes you after a breach is covered in our brief on breach response and notification deadlines.

What to do next

Run the sequence in order: secure email, pull the three reports, freeze, generate the FTC report, then dispute and block with the report attached. Handle the money deadlines in parallel with the credit work, not after it, because those windows are measured in days from statement dates rather than from the day you discovered the problem. Then set a reminder for sixty to ninety days out and verify that the corrections held.

Related consumer and criminal-procedure material sits on the Consumer & Criminal Procedure desk. This brief is general information about federal consumer rights as they stand in mid-2026, with state law adding protections that vary; it is not legal advice, and a large or contested loss is worth reviewing with a consumer attorney while the deadlines are still open.