Identity Theft: When Your Credit Gets Stolen
Spot it early, then run the playbook that shuts it down
In this lesson you will learn to
- Spot the warning signs of identity theft on your report and in your mail
- Run the six-step response in the right order, starting with IdentityTheft.gov
- Choose between a fraud alert and a credit freeze
- Explain why a 605B block beats a regular dispute
Identity theft turns your credit report into a record of someone else's spending. It is scary, but federal law gives you strong, specific tools, and most of them run on a fixed clock. This lesson covers how to spot the theft and the exact order to respond.
Warning Signs Worth Acting On
- Bills or statements for accounts you never opened
- Collection calls about debts you do not recognize
- Hard inquiries from companies you never applied to
- A sudden, unexplained score drop
- A denial for credit you expected to get
- Mail that stops arriving (a thief may have changed your address)
- An IRS notice that someone already filed a tax return in your name
The Response Playbook, in Order
Six Steps, in This Order
- 1. File a report at IdentityTheft.gov. The FTC report is the key that opens most doors after this.
- 2. File a police report if a creditor or collector requires one, or if you know who did it.
- 3. Place a fraud alert or, better, freeze your credit at all three bureaus.
- 4. Mail identity theft block letters to the bureaus under FCRA 605B.
- 5. Contact the fraud department of each creditor where an account was opened.
- 6. Monitor all three reports until every trace is gone.
Try it: check the six steps off in order. Tap a locked step to see why it waits.
0 of 6 done
The FTC identity theft report is free and takes about 20 minutes. It is the key that opens most doors after this.
First, because the extended fraud alert and the 605B block both depend on it.
Notice that the FTC report comes first. The extended fraud alert and the 605B block both depend on it.
A fraud alert tells lenders to take extra steps to verify identity before opening credit in your name. An initial alert lasts one year, costs nothing, and you only need to contact one bureau, which must notify the other two. An extended alert lasts seven years and requires an identity theft report (your FTC report). A freeze is stronger: it blocks lenders from pulling your file for new credit at all, it is free at all three bureaus, and it stays until you lift it. The trade-off is friction. You must place it at each bureau separately and thaw it whenever you apply for credit.
- • Free; initial alert lasts 1 year, extended lasts 7
- • Place it with one bureau and it notifies the other two
- • Lenders must take reasonable steps to verify your identity
- • New credit is still possible, so some fraud can slip through
- • Free at all three bureaus under federal law
- • Blocks new-credit pulls of your file entirely
- • You must place it with each bureau separately
- • Thaw it (online, often within minutes) before you apply for credit
Quick check
What is the main difference between a fraud alert and a credit freeze?
Why a 605B Block Beats a Regular Dispute
A regular dispute under FCRA 611 gives the bureau up to 30 days (45 with added information) to investigate, and the furnisher gets a chance to "verify" the account. FCRA 605B is a different tool built for theft. You send the bureau four things: your FTC identity theft report, proof of your identity, a list of the fraudulent items, and your statement that those items are not yours. Once it receives them, it must block the items within 4 business days. The bureau also notifies the furnisher, which may not simply re-report the blocked account. For confirmed identity theft, 605B is faster and much harder to brush off.
605B block vs. a regular dispute
| At a glance | FCRA 605B block | FCRA 611 dispute |
|---|---|---|
| Built for | Confirmed identity theft | Any error on your report |
| You send | Your FTC identity theft report, proof of identity, a list of the fraudulent items, and your signed statement | A letter describing the error, with any proof you have |
| Bureau deadline | 4 business days after your package arrives | 30 days to investigate, 45 if you send more information during the review |
| The furnisher | Notified of the block; may not simply re-report the account | Gets a chance to verify the account |
Quick check
What must you send a bureau to get a 605B block, and how fast must it act?
CreditPath's Tools section includes an Identity Theft Block (FCRA 605B) template that builds the letter for you. If you are not sure the account is theft, the Account Not Mine template is the general dispute version. You print it, sign it, attach copies of your FTC report and your ID, and mail one to each bureau reporting the fraud, certified mail with return receipt. You always send your own letters. Keep every receipt and response in one folder. If a collector calls about the blocked debt later, that paper trail is your answer.
The FTC Report Is Not Optional
Skipping IdentityTheft.gov weakens everything downstream. Without an identity theft report you cannot get an extended fraud alert, and bureaus can refuse a 605B block. The report is free and takes about 20 minutes. Also skip the paid "identity recovery" services pitching this exact work. Every step in this playbook is free to do yourself.
Quick check
Why is the FTC report at IdentityTheft.gov the first step?
Real-World Examples
Real-World Example
Priya, 29: two cards she never opened
The Situation
A car loan pre-qualification came back denied, which made no sense. Priya pulled all three reports and found two credit cards she never opened, $9,100 in combined balances, one of them 90 days past due.
What Happened
That evening she filed at IdentityTheft.gov and froze her credit at all three bureaus. The next day she mailed 605B block letters with her FTC report, a copy of her license, and a signed statement that the accounts were not hers. The bureaus blocked both accounts within days of receiving the letters, and she sent the FTC report to both card issuers' fraud departments. Her next report pull showed the accounts and the late payment gone.
Key Takeaway
Speed and paperwork are the whole game. The freeze stopped new damage while the 605B letters cleared the old, and none of it required paying anyone.
Deadline for a 605B block after proper documents arrive
Length of an initial fraud alert
Length of an extended fraud alert
Cost to freeze your credit at all three bureaus
Protecting Your Family
Children are prime targets because the theft can run unnoticed for years, sometimes until a first job or student loan application. Each bureau lets a parent or guardian request a freeze for a child under 16. If no file exists, the bureau creates one and freezes it, free. The same move protects elderly relatives who are not applying for new credit. If pre-approved card offers start arriving addressed to a minor, treat it as a warning sign and check whether the child has a file.
Nia's file started when she was twelve
Nia, 18, applied for a small student loan with her dad as co-signer, expecting a thin file or none at all. The lender's letter said something else: her file already had a car loan, opened six years earlier and sent to collections. Someone had used her Social Security number when she was twelve.
Her dad felt sick about it, then got to work. That night they filed a report at IdentityTheft.gov and froze her credit at all three bureaus. Over the next two days they mailed 605B block letters with the FTC report, a copy of her ID, a list of the fraudulent items, and her signed statement. They also froze her ten-year-old brother's credit. He had no file yet, so each bureau created one and froze it, free.
The block cleared the car loan from Nia's file. What stuck with her dad was the other move: a child's credit can be locked before anyone ever touches it.
After the Cleanup
Keep the freeze on as your default state and thaw it only when you apply for something. Check all three reports a month after the block, then quarterly for a year. Fraudulent accounts sometimes reappear when a debt gets sold. The 605B paperwork you saved makes the fix fast.
What to remember
- Watch for accounts, inquiries, bills, or collection calls you do not recognize, and for mail that stops arriving.
- Six steps in order: IdentityTheft.gov report, police report if a creditor needs one, fraud alert or freeze, 605B block letters, and each creditor's fraud department. Then watch all three reports until every trace is gone. The FTC report comes first because the extended alert and the 605B block depend on it.
- A fraud alert asks lenders to verify you. A freeze blocks new-credit pulls entirely. Both are free, and the freeze is stronger.
- With your FTC report, ID, a list of the fraudulent items, and your statement, a bureau must block them within 4 business days under FCRA 605B.
- You can freeze a child under 16 for free, and you should keep your own freeze on as the default.
Do this today
Freeze your credit at all three bureaus, unless you are in the middle of a credit application. It is free, you can do it online at each bureau, and you can thaw it whenever you apply. Save the login or PIN for each bureau in one safe place so the thaw is painless later.
Nice work
You now hold the whole identity theft playbook: spot it, report it at IdentityTheft.gov, freeze, block under 605B, and follow up. Most people only learn this in the middle of a crisis, and you have it ready now. That wraps up Module 8, so take the module quiz and see how much of it stuck.
Write the single step you will take from this lesson. It saves to My plan on your dashboard.