How to Report Identity Theft to the Credit Bureaus

As soon as you find out that someone has stolen your identity, one of the first steps is reporting it to the credit bureaus so you can limit further damage and start clearing the fraudulent information from your reports.

When identity theft shows up on a credit report, the instinct is often to call everyone at once. You don’t need to tell the same story three times just to place a fraud alert. Starting with one bureau is enough for that first step.

To report identity theft to the credit bureaus, contact any one of the three nationwide bureaus – Experian, Equifax, and TransUnion – and place a free fraud alert. The bureau you report it to must notify the other two. This is known as the one-bureau rule.

Keep in mind that setting up an alert is merely the first step. While it prompts lenders to confirm your identity prior to extending new credit, it does not eliminate existing accounts, inquiries, addresses, or debts from your credit profile, and it certainly doesn’t resolve the issue entirely.

So you’ll also need to file an FTC Identity Theft Report and review all three credit reports from each credit agency on an ongoing basis for a few cycles. Look for any fraudulent items and request a block of identity theft related information if you find any. Blocks are allowed under Section 605B of the Fair Credit Reporting Act (FCRA).

Step by Step: Reporting Identity Theft to the Credit Bureaus

Once identity theft appears on your credit reports, there are two important goals that need to be accomplished: (1) make it harder for anyone to open more accounts in your name and, (2) clear the fraudulent information already being reported. By following these five steps you’ll be able to reach both goals.

1. Place a fraud alert through one credit bureau

Contact Experian, Equifax, or TransUnion to request an initial fraud alert. It is free, lasts for one year, and can be renewed. The notified credit reporting agency must inform the other two to place the alert as well, so there’s no need to contact all three separately at this stage.

This action serves to notify businesses checking your credit to take reasonable measures to confirm your identity before granting new credit. You can initiate an alert if you have confirmed identity theft or if you have solid reasons to suspect it.

2. Pull your reports from all three bureaus

Get your credit reports through AnnualCreditReport.com. Currently, free online credit reports are provided on a weekly basis by Experian, Equifax, and TransUnion.

Don’t assume the three reports tell the same story. For instance, a fraudulent card may show up on your Experian credit report but not on your report from TransUnion. Or an unfamiliar inquiry may appear only on the Equifax one.

Check every report for accounts, hard inquiries, balances, addresses, phone numbers, employers, and variations of your name that you don’t recognize. Identity theft may show up in several places, not only in the account section.

3. Compile a list of all unauthorized entries

Save or print each report and mark every fraudulent account or inquiry. For each item, write down:

• The credit bureau reporting it
• The creditor or company name
• The partial account number
• The date the account was opened or the inquiry was made
• The balance, if one appears
• A short explanation of why the item is not yours

Don’t worry - the list doesn’t need to sound legal. It just needs to be easy to follow. “I didn’t open the account ending in 1234 and received no money, goods, or services from it” is much clearer than one long paragraph covering five different accounts.

4. File an FTC Identity Theft Report

Go to IdentityTheft.gov and report what happened. The website will create an FTC Identity Theft Report and a recovery plan based on the details you provide.

Keep the full report. You will use it when you ask the bureaus to block fraudulent information, and companies may ask for it while reviewing identity theft claims.

For help completing the report, see our guide on how to file an FTC Identity Theft Report.

5. Ask the bureaus to block the fraudulent information

Send a separate Section 605B block request to every bureau reporting a fraudulent account, inquiry, or debt.

This is where the one-bureau rule ends. Although notifying a single bureau is sufficient to activate a fraud alert across all three of the credit agencies, it doesn’t compel the other bureaus to automatically block or remove specific fraudulent accounts. You must separately contact each bureau that is reporting the fraud.

Where to Report Identity Theft: Experian, Equifax, and TransUnion Contacts

Here is how to contact the credit bureaus for identity theft alerts and written block requests.

Use the official online portal when possible. When sending documents by mail – send copies, not originals. Keep a complete copy of the documents’ set and proof that it was delivered.

Bureau contact details can change, so check the official page before mailing documents containing sensitive personal information.

Experian

State clearly whether you are requesting a fraud alert, a block under 15 U.S.C. § 1681c-2, or both. For a block, identify each fraudulent entry and include the requested proof of identity and address.

Equifax

Tell Equifax which entries resulted from identity theft. Include copies of your identity documents, FTC Identity Theft Report, and the relevant pages of your Equifax report with the fraudulent items marked.

TransUnion

List each account or inquiry separately and include enough information for TransUnion to locate it on your report. Don’t send original identity documents.

Fraud Alert vs. Credit Freeze: Which One Should You Use After Identity Theft?

While a fraud alert and a credit freeze serve different purposes, many identity theft victims choose to use both. Here is a breakdown of how each option functions, their respective durations, and the necessary contact steps for each choice.

An initial alert makes sense when you suspect your information has been compromised but don’t yet know how it has been used.

An extended fraud alert is useful after confirmed identity theft, particularly when your Social Security number or other sensitive information may remain exposed. It lasts seven years and requires proof that you experienced identity theft. An FTC Identity Theft Report can provide that proof. A police report may also be useful, depending on what happened.

See our guide on how to file a police report after identity theft when law enforcement documentation is appropriate for your case.

A credit freeze provides stronger protection against new-account fraud because most new creditors cannot access your report until you lift the freeze. Although credit freezes are free of charge, you have to contact Equifax, Experian, and TransUnion individually to establish them.

If you later decide that you no longer need the alert, see how to remove a fraud alert from your credit reports.

The Section 605B Block: Requires the Bureaus to Block Fraud Within Four Business Days

A credit dispute and an identity theft block are different things. With an ordinary dispute, the bureau generally has 30 days to investigate whether the information is accurate. In some situations, that period can extend to 45 days.

Section 605B of the FCRA, gives identity theft victims a more direct remedy. Once a credit reporting agency receives a complete request, it generally must block the identity theft-related information within four business days.

Your request should include:

• Proof of your identity
• An identity theft report, usually your FTC Identity Theft Report
• A letter identifying every fraudulent account, debt, or inquiry
• A statement that the information doesn’t relate to a transaction made by you

Some bureau forms and older resources use the phrase identity theft affidavit for credit bureaus. Do not let the label confuse you. What matters is that the packet identifies you, documents the identity theft, and tells the bureau exactly which information must be blocked.

The four-business-day rule applies after the bureau receives a complete request. The FCRA also allows a bureau to decline or later rescind a block in limited circumstances, including when there was a material misrepresentation or when the consumer received goods, services, or money from the transaction.

Sample Identity Theft Letter to the Credit Bureaus

This template can serve as a starting point when contacting credit bureaus; tailor it to your unique situation. Remember to send a separate letter to each bureau reporting fraudulent activity.

[Your full name]
[Your current address]
[Date]

[Credit bureau name and address]

Re: Request to block identity theft information under 15 U.S.C. § 1681c-2

I am a victim of identity theft. The following information on my credit report does not relate to any transaction that I made or authorized:

[List the company name, partial account number, and description of each fraudulent item.]

I am requesting that you block these items from my credit file under 15 U.S.C. § 1681c-2.

I have enclosed proof of my identity, my FTC Identity Theft Report, and a copy of my credit report with the fraudulent information marked.

Please send me written confirmation when the block is complete, along with an updated copy of my credit report.

Sincerely,
[Your signature]
[Your printed name]

Attach copies of your photo ID, proof of address, FTC Identity Theft Report, and the relevant credit report pages. You can also include police reports, creditor letters, or account records that make the fraud easier to identify.

Keep the original documents and a complete copy of everything you send. IdentityTheft.gov also provides a sample identity theft letter for credit bureaus.

What If the Credit Bureau Ignores You or Refuses?

Should this occur, start by checking the submission package you sent. Delays on an otherwise legitimate request can often stem from a missing identification document, an unfinished FTC report, or an incorrectly identified account. Rectify any identified errors and forward the required missing details.

However, a completed Section 605B request must not be treated as a typical dispute. A credit bureau might be in violation of its FCRA obligations if it fails to observe the four-business-day deadline, processes documented identity theft as an ordinary 30-day dispute, or persists in reporting the account despite receiving the necessary proof.

Keep your delivery records, every bureau response, and fresh copies of your reports. See our Q&A on what to do when the credit bureaus ignore your identity theft dispute.

Depending on the facts, a willful FCRA violation may allow a consumer to seek actual damages or statutory damages of $100 to $1,000, possible punitive damages, costs, and reasonable attorney’s fees. A negligent violation may support actual damages, costs, and attorney’s fees.

If the fraudulent accounts remain after you followed the process and provided the necessary documents, speak with an identity theft lawyer about what happened.