Step one: place a fraud alert and freeze
The moment you suspect fraud, contact one of the three bureaus and place a fraud alert. By law, that bureau must tell the other two, so one call covers all three. An initial alert lasts one year and is free.
A fraud alert tells lenders to take extra steps to verify identity before opening credit. For stronger protection, follow it with a security freeze at each bureau, which blocks new credit pulls entirely and is also free.
Victims of identity theft also qualify for an extended fraud alert that lasts seven years once you file an identity theft report. Start with the initial alert today and upgrade once your report is filed.
Step two: report it officially
File a report at the Federal Trade Commission's identity theft site. It walks you through the details and generates an official FTC Identity Theft Report, which is the key document that unlocks your rights with creditors and bureaus.
Consider also filing a report with your local police, especially if you know the thief or a creditor requires it. Bring your FTC report and any evidence you have gathered.
Keep both reports, along with a log of every call and letter. This documentation is what lets you demand that fraudulent accounts be blocked and removed, so treat it as the foundation of your whole recovery.
Step three: contact the fraudulent accounts
Reach out to the fraud department of every company where an account was opened or misused in your name. Tell them it is identity theft, ask them to close or freeze the account, and request that they stop collection on it.
Follow up in writing and include a copy of your FTC Identity Theft Report. Ask each company to send you confirmation that the account was fraudulent and to provide copies of the application and transaction records.
You are not responsible for debts that resulted from identity theft. Businesses must stop reporting and collecting on accounts you show were opened by a thief, so keep every confirmation they send you.
Step four: dispute the fraudulent items
Pull your reports from all three bureaus and identify every account, inquiry, and address you do not recognize. With your FTC Identity Theft Report, you have the right to have information resulting from the theft blocked from your report.
File these disputes yourself, directly with each bureau, for free. This is your right under the Fair Credit Reporting Act, and it applies squarely here because the information is inaccurate: these are not your accounts.
The bureaus investigate and, when the information is confirmed to stem from identity theft, remove it. Removal is always the bureau's decision based on the evidence, so your clear documentation is what moves it forward.
Step five: monitor and rebuild
Once the immediate fires are out, keep watching. Check all three reports regularly in the following months to confirm fraudulent items stay gone and no new ones appear. Keep your freeze on and thaw it only when you apply for credit yourself.
Update passwords on your financial and email accounts, turn on two-factor authentication, and consider changing account numbers the thief accessed. Closing the door the thief came through is as important as cleaning up the damage.
Recovery takes patience, and that is normal. Your legal protections are strong, your documentation is your leverage, and step by step you can restore an accurate report and get back to building.
Identity theft is a violation, but a clear, documented response puts the power back in your hands. Subefy helps you monitor all three bureaus so you catch trouble early, and it supports the free self-serve disputes that clear inaccurate items as you rebuild toward being mortgage-ready. Estimates are educational, results vary, and no specific result is guaranteed.