The letter arrives on a Tuesday. A credit card you never applied for. A welcome packet for an account you didn’t open. A collection notice for a debt you don’t owe.
Your first thought is: How is this possible? Your second thought is: What do I do now?
I spent 17 years inside bank fraud investigations. I have seen hundreds of these cases — and I can tell you that the victims who recovered fastest were not the ones who panicked. They were the ones who understood one thing: an account opened in your name is not just a piece of paper. It is a trail of evidence. And if you follow that trail in the right order, you can shut it down.
“An account opened in your name is not a debt. It is a crime. Treat it like one.”
— Rebecca Harlow
Key Takeaways
A fraudulent account does not automatically become your debt. Under the Fair Credit Reporting Act (FCRA), you have the right to dispute the account and have it removed from your credit report.
File a report at IdentityTheft.gov first. The FTC’s system generates a personalized recovery plan and an FTC Identity Theft Report — a legally recognized document you can use to dispute the account.
The FCRA’s fraud victim block under Section 605B requires credit bureaus to block fraudulent information from your report, generally within four business days of receiving your identity theft report and proof of identity.
Contact the creditor directly, not just the credit bureau. The credit bureau can remove the account from your report, but the creditor is the one that opened it — and the one that can close it and stop collections.
If the account is a collection account, dispute it with both the collection agency and the credit bureau. Collection agencies are subject to the FCRA and the Fair Debt Collection Practices Act.
Place a fraud alert or credit freeze immediately. It stops the thief from opening more accounts while you clean up the mess from the ones they already opened.
What Actually Happens When Someone Opens an Account in Your Name
Before you can fix this, you need to understand what the thief did. The mechanics matter because they determine which legal protections apply.
Here is the sequence:
The thief obtains your personal information. Your Social Security number, date of birth, name, and address. These come from data breaches, phishing, mail theft, or purchased “sucker lists” from previous scams.
They apply for credit using your identity. The application may be online, by phone, or by mail. They use your information but often a different address — their own — so the credit card or welcome packet goes to them, not you.
The creditor approves the application. This is where the system fails. If the thief’s application looks legitimate — correct SSN, plausible income, a clean credit file — the creditor may approve it without ever speaking to you.
The account appears on your credit report. Even though you didn’t open it, the account is reported under your name and SSN. Your credit score drops. Collection calls may begin.
You discover it. Maybe you check your credit report. Maybe you get a collection notice. Maybe you receive a denial letter for credit you actually applied for, because the fraudulent account damaged your score.
This is why the FTC’s IdentityTheft.gov process starts with reporting the theft. The FTC Identity Theft Report becomes the legal foundation for everything that follows — disputes with creditors, credit bureaus, and debt collectors.
The Two Types of Fraudulent Accounts
Not every fraudulent account is the same. The two main categories require different responses.
Type 1: True-Name Identity Theft
The thief uses your actual name, your actual SSN, and your actual date of birth. They may use a different address, but the core identity is yours.
What this looks like:
A credit card or loan appears on your credit report that you didn’t open
A collection notice arrives for an account you don’t recognize
A creditor calls about a debt you don’t owe
Why it matters: This is the most common type, and it is the most straightforward to resolve. The creditor can look at the application, see that you didn’t authorize it, and close the account. The credit bureau can remove it from your report.
Type 2: Synthetic Identity Fraud
The thief combines real information — often your SSN, sometimes belonging to a child or someone with limited credit history — with fake details like a made-up name, birthdate, or address. They build a new identity that partially overlaps with yours.
What this looks like:
An account appears on your credit report under a name that is similar to yours but not identical
A credit inquiry you don’t recognize
Your SSN is associated with a different name or address
Why it matters: Synthetic identity fraud is harder to detect because the fabricated identity doesn’t fully match any real person. Credit bureaus may accept it as legitimate. The fraudster builds credit slowly over months or years, then “busts out” — maxing out credit lines and disappearing.
If you suspect synthetic identity fraud, the standard dispute process still applies, but you may need to work more closely with the credit bureaus and the creditor to prove that the account is not yours. The FTC’s Identity Theft Report is essential here.
The Recovery Sequence: Step by Step
Here is the order that works. Do not skip steps. Do not improvise.
Step 1: Report at IdentityTheft.gov
Go to IdentityTheft.gov and tell the system what happened. It will ask questions about your situation and generate a personalized recovery plan with step-by-step instructions.
If you create an account, the system will walk you through each recovery step, update your plan as needed, track your progress, and pre-fill forms and letters for you.
You will receive an FTC Identity Theft Report — a legally recognized document that proves to businesses that someone stole your identity. You can use it to dispute fraudulent accounts with credit bureaus and ask businesses to close accounts opened in your name.
If you prefer to report in Spanish, visit RobodeIdentidad.gov. To report in another language, call 877-438-4338 and press 3. Interpreters are available from 9:00am to 5:00pm ET.
Do this first. Everything else depends on having this report.
Step 2: Contact the Creditor Directly
Call the fraud department of the company that opened the account. Not the general customer service line — the fraud department.
Say this: “An account was opened in my name without my authorization. I have filed an FTC Identity Theft Report. I need the account closed and removed from my credit report.”
Ask for:
Written confirmation that the account will be closed
A reference number for your call
The name of the person you spoke to
If the creditor is a collection agency, tell them you dispute the debt and that it resulted from identity theft. Send a written dispute with your FTC Identity Theft Report and request written confirmation that the account will be removed.
Important: The creditor is the source of the fraudulent account. The credit bureau reports what the creditor tells it. If the creditor doesn’t close the account, the credit bureau may keep it on your report. Fix the source first.
Step 3: Dispute with the Credit Bureaus
You must dispute the fraudulent account with each of the three credit bureaus separately — Equifax, Experian, and TransUnion.
Under the FCRA’s fraud victim block, Section 605B, a consumer reporting agency must block the reporting of any information in your file that resulted from identity theft. This is not a dispute that takes months to resolve. It is a block that requires the bureau to remove the information, generally within four business days of receiving:
Appropriate proof of your identity
A copy of your identity theft report
Identification of the information resulting from the identity theft
A statement by you that the information is not information relating to any transaction by you
When you file a dispute, the credit reporting company generally must investigate within 30 days of receiving it. The investigation period can be extended by 15 additional days if you submit additional information during the 30-day period.
Send your dispute in writing, certified mail, return receipt requested. Include:
Your FTC Identity Theft Report
A copy of your government-issued photo ID
A copy of a utility bill or bank statement showing your current address
A signed statement that the account is not yours
A clear description of the fraudulent account (account number, creditor name, date it appeared)
Keep copies of everything you send.
Step 4: Place a Fraud Alert or Credit Freeze
Contact one of the three credit bureaus and place a free, one-year fraud alert. That bureau must notify the other two.
A fraud alert requires creditors to verify your identity before opening a new account in your name. An extended fraud alert — which lasts seven years — requires an identity theft report and provides stronger protection.
A credit freeze goes further. It prevents creditors from accessing your credit file at all until you lift the freeze. If the thief tries to open another account, the creditor cannot pull your report — and the account generally won’t be opened.
Use both. The freeze blocks access. The alert flags the file for anyone who does get access.
Step 5: File a Police Report
File a report with your local police department. Many creditors and credit bureaus require a police report before removing a fraudulent account. The report number itself has value, even if local police cannot investigate directly.
Bring:
Your FTC Identity Theft Report
Photo ID
Financial statements showing the fraudulent account
Your written timeline of what happened
Ask for the report number and add it to your evidence folder.
Step 6: Monitor Everything
Check your credit reports from all three bureaus. You can get free reports at AnnualCreditReport.com. Review each report for accounts, inquiries, or addresses you don’t recognize.
Set up fraud alerts on your existing accounts. Review your bank and credit card statements weekly for at least 90 days.
If you find another fraudulent account, repeat the process: creditor first, then credit bureaus, then police report if necessary.
What If the Creditor Refuses to Remove the Account?
This happens. Some creditors — especially smaller ones or those with poor fraud controls — will deny that the account is fraudulent. They may say the application matched your information, or that they have no record of fraud.
If the creditor refuses:
Request the application. Under the FCRA, you have the right to request information from the creditor about the fraudulent account, including the application and any documents the thief submitted. The signature, the address, the phone number — these will not match yours.
Escalate within the creditor’s organization. Ask for a supervisor in the fraud department. Send a written dispute with your FTC Identity Theft Report and a copy of your police report. State clearly: “This account is the result of identity theft. I am requesting that it be closed and removed from my credit report.”
File a complaint with the CFPB. Go to consumerfinance.gov/complaint. The CFPB forwards complaints to the company and requires a response, generally within 15 days. The complaint goes to the creditor’s compliance team — not the front-line call center.
File a complaint with your state attorney general. Many state AGs have consumer protection divisions that handle identity theft complaints.
The Credit Bureau Complaint Process
If the credit bureau fails to block the fraudulent information after you provide your identity theft report, you can escalate.
The CFPB requires consumers to first dispute the information directly with the credit reporting agency. You must attest that at least 45 days have passed since you submitted the dispute to the credit bureau, or that the dispute is no longer pending.
Once that requirement is met, file at consumerfinance.gov/complaint. Include:
Your FTC Identity Theft Report
The documents you sent to the credit bureau
The bureau’s response (or lack of response)
A clear statement of what you are asking for
Protecting Yourself Going Forward
A fraudulent account is a warning sign. Your information is out there. Here is how to make sure it doesn’t happen again.
Freeze your credit with all three bureaus. A freeze is stronger than an alert. It stays in place indefinitely until you lift it. When you need to apply for credit, you can lift it temporarily — often in as little as one hour online.
Use multi-factor authentication on every account. Especially on your email, which is the recovery key for everything else.
Check your credit reports regularly. Free weekly reports are available at AnnualCreditReport.com. Look for accounts, inquiries, and addresses you don’t recognize.
Consider a trusted contact for your accounts. Many banks and credit unions offer free alert services that send text or email notifications about suspicious activity or key account changes. A trusted family member can help monitor transactions and be alerted about unusual activity.
If you are 60 or older, call the National Elder Fraud Hotline. This free resource from the U.S. Department of Justice’s Office for Victims of Crime is available at 1-833-372-8311 (1-833-FRAUD-11). Trained professionals can help you report the fraud and connect you with resources.
No comments yet.