The first 48 hours after detecting identity theft determine how much damage occurs. This course covers the immediate-action playbook, freezes vs locks vs monitoring, the federal IdentityTheft.gov process, and how to dispute fraudulent debts on your credit report — including the crucial step where you can use these protections to challenge debts you actually owe but the collector cannot validate.
If you've just discovered that someone has used your identity — an unfamiliar credit card account on your credit report, charges you didn't make, an account opened in your name — the first 48 hours are when you can stop the most damage. The actions below should happen in this order and as fast as possible.
Hour 0-1: Stop the bleeding.
Hour 1-24: Document and report.
Hour 24-48: Begin disputes.
Companies are legally required to notify you if your data was exposed in their breach. The standard "free 12 months of credit monitoring" they offer is the minimum response. Take additional steps immediately: freeze credit at all three bureaus regardless of monitoring offer, change passwords on accounts where you reused the breached one, monitor accounts more frequently for the first 90 days, and consider it likely your information will be misused at some point even if monitoring shows nothing immediately.
First 48 hours after identity theft: place fraud alert and freeze credit at all three bureaus, contact affected banks, change passwords, file at IdentityTheft.gov to generate the federal Identity Theft Report, dispute fraudulent accounts with bureaus and creditors. The FTC report is the document that makes creditors block fraudulent debts under FCRA section 605B.
The credit-protection landscape has three main tools that get conflated in marketing: credit freezes, credit locks, and credit monitoring. They do different things and cost differently.
Credit Freeze (security freeze). The strongest protection. When frozen, no new credit can be opened in your name — potential lenders cannot pull your credit report at all without you first temporarily lifting the freeze. Required by federal law (since 2018) to be FREE at all three bureaus. Stays in place until you lift it.
Credit Lock. Marketed by bureaus as a "consumer-friendly" version of a freeze. Functionally similar but legally different — locks are contractual, not statutory. Many bureaus charge for lock services as part of subscription products.
Credit locks are largely a marketing product. The free freeze is functionally equivalent or better. Most consumer advocates recommend the free freeze and skipping paid lock services entirely.
Credit Monitoring. Alerts you when changes occur on your credit report — new accounts, hard inquiries, address changes, etc. Doesn't prevent fraud but tells you faster when it happens.
The optimal protection stack:
This stack costs $0 and provides better protection than most paid services.
When you actually need to lift the freeze:
Each lift can be temporary (specific timeframe) or specific-creditor (only allow one specific lender to pull). Plan in advance — processing a lift takes minutes to a few hours, not days.
Credit freeze is the strongest protection and is free at all three bureaus by federal law. Credit locks are paid marketing products that provide less protection — skip them. Credit monitoring (free options) tells you when changes occur but doesn't prevent them. The optimal $0 protection stack: freeze + free monitoring + bank alerts + 2FA + annual report review.
The Federal Trade Commission's IdentityTheft.gov is the official federal portal for identity theft recovery. Filing there generates an FTC Identity Theft Report — the legally recognized document that triggers protections under federal law. This is the most important single step in the recovery process.
What the FTC Identity Theft Report does:
The IdentityTheft.gov process:
The portal is genuinely useful, not bureaucratic theater. The pre-filled letters specifically reference your FTC report number and cite the relevant federal protections, making them more effective than generic dispute letters.
The FCRA section 605B "block" right. When you submit an FTC Identity Theft Report to a credit bureau, the bureau is required to block the fraudulent information within 4 business days. Block means it doesn't appear on your credit report at all. This is different from "dispute" (which the bureau investigates) — block is automatic upon receipt of the FTC report and identification information.
For block to apply, the report must:
Police reports vs FTC reports. The FTC Identity Theft Report is sufficient for most purposes. A police report adds value when:
For most identity theft cases, the FTC report is sufficient. Don't let the lack of a police report stop you from filing at IdentityTheft.gov first.
If your tax-related information was stolen (someone filed a return in your name to claim a refund), file IRS Form 14039 in addition to the FTC report. If your Social Security number was used for fraud, also file at the Social Security Administration. If your medical identity was stolen, contact the relevant insurer and the Department of Health and Human Services. The FTC IdentityTheft.gov system will guide you through these additional reports based on your specific situation.
The FTC Identity Theft Report from IdentityTheft.gov is the legally recognized document for identity theft recovery. It triggers FCRA section 605B "block" rights — bureaus must remove fraudulent information within 4 business days. The portal generates personalized recovery plans with pre-filled letters citing specific federal protections. Use it as the foundation of any identity theft response.
Once you've filed the FTC report, the work shifts to actually clearing the fraudulent items off your credit report. This is a multi-channel process: bureaus AND creditors AND collectors.
Channel 1: The credit bureaus. Submit disputes to all three bureaus (Equifax, Experian, TransUnion) for each fraudulent item. Include:
The bureau must respond within 30 days (some states require 15). They will investigate — contact the furnisher (the original creditor or collector), verify whether the account is yours, and either remove or retain the item.
For block requests with proper FTC documentation, the bureau must remove the item within 4 business days — faster than the dispute process.
Channel 2: The original creditors. Send written notification to each creditor whose name appears on a fraudulent account:
Under federal law, the creditor must investigate and block fraudulent information from being reported. Once they confirm the fraud, they typically:
Channel 3: Debt collectors. If a fraudulent debt has been sold to or assigned to a debt collector, separate disputes are needed. Collectors are subject to FDCPA in addition to FCRA. Send a written dispute and request validation.
If a collector continues to collect on a debt you've identified as fraudulent (especially after they receive the FTC report), they're potentially violating both FDCPA and FCRA. Document everything and consider an attorney.
If items don't get removed. If after 30-60 days the items are still on your credit report:
Dispute fraudulent items through three channels: credit bureaus (with FTC report and "block" request under FCRA 605B), original creditors (with FTC report and request to close account), and debt collectors (with FTC report and FDCPA validation request). All by Certified Mail. If items aren't removed in 30-60 days, escalate to CFPB and state AG; consider FCRA attorney for ongoing violations.
Beyond direct fraud, two related problems affect millions of consumers: mistaken identity (information from someone else with a similar name appearing on your credit report) and mixed files (the bureaus combining your information with someone else's). Both are addressable through the same dispute process but require some specific framing.
Mistaken identity scenarios:
Mixed file scenarios:
How to address mistaken identity / mixed files:
Mixed files have been the subject of significant FCRA litigation, and the bureaus have been forced to pay damages in many cases. If you have a clearly mixed file that isn't getting separated through normal dispute, an attorney is often the right path.
Family-based identity confusion. Particularly common with:
The most effective fix: each family member should establish a clear "credit identity" with consistent name format (always use middle initial or full middle name, always use the same address format, always include suffix like Jr./Sr. when applicable). The bureaus' merging algorithms get confused when information comes in with inconsistent formatting.
A growing pattern: criminals create completely fictitious identities by combining real Social Security numbers (often children's, since they have no credit history) with fake names and addresses. The fraud typically goes undetected for years. If you discover credit accounts in your child's name (especially before they could have legitimately opened any), this is likely synthetic identity fraud. File at IdentityTheft.gov on behalf of the child, freeze their credit at all three bureaus, and contact the FTC. Children's credit can and should be frozen even though they have no current credit activity.
Mistaken identity (similar names) and mixed files (bureau merging two consumers) are addressable through the same dispute process but require demonstrating you're a different person from the one whose information appears. Family-based confusion (Sr./Jr., similar names) is reduced by consistent name format on all credit applications. Synthetic identity fraud against children is increasingly common — freeze children's credit even though they have no activity.
Once the immediate fraud is resolved, identity theft has a long tail. Stolen information often gets reused months or years later. The recovery process isn't over when the original accounts are cleared — it continues for as long as your information is in criminal hands.
The "dark web" reality. Most stolen identity information eventually ends up on dark web markets where it's bought, sold, and reused multiple times over years. Once your data is exposed, expect periodic reuse:
Long-term protection practices:
What to do if you discover new fraud later. If years after the initial incident you discover new fraudulent activity:
The ScoreGuardians connection. Identity theft and credit damage often go hand in hand — the fraudulent accounts damage credit while you're trying to clean up. ScoreGuardians and similar credit-rebuild services help by managing the dispute process, monitoring for new activity, and providing resources during the multi-year recovery. For severe identity theft cases, a dedicated service can be worth the cost; for simpler cases, the free tools described above are usually sufficient.
Identity theft has a long tail — stolen information can be reused for years on dark web markets. Long-term protection: keep credit frozen permanently, monitor reports quarterly, use password manager + unique passwords, prefer authenticator apps over SMS for 2FA, set bank alerts for all transactions, file taxes early. New fraud discovered later requires a new FTC report and fresh disputes. For severe cases, consider dedicated credit-rebuild services like ScoreGuardians.