A client of ours — we’ll call her Renata — found out her identity had been stolen when a collections agency called about a $14,300 auto loan she never signed for, on a car she’d never seen, financed at a dealership three states away. Her credit score, which had been sitting at 718 for years, had dropped to 561 by the time she pulled her report. Two fraudulent credit cards, one auto loan, and six hard inquiries had appeared over four months, and she hadn’t noticed because she wasn’t checking her report regularly. This is a far more common story than most people realize, and the good news buried inside it is this: credit score rescue after identity theft is one of the most legally well-defined repair processes that exists, because federal law gives victims specific, enforceable tools that ordinary credit disputes don’t have.
The bad news is that most people respond to identity theft in exactly the wrong order — calling the creditor first, arguing on the phone, and waiting weeks for a callback that never comes. The steps below are the sequence that actually works, in the order that gets fraudulent items off your report the fastest and stops new damage from accumulating while you clean up the old.
What Identity Theft Actually Does to Your Credit Score
Identity theft doesn’t damage your score in one uniform way — it stacks several types of harm at once, which is why the point drops can look so severe. A new fraudulent account lowers your average account age and can spike your credit utilization if a thief maxes out a card in your name. Each hard inquiry a thief generates by applying for credit costs you roughly 5-10 points, and several inquiries within a short window compound that damage.
The worst damage comes from missed payments on accounts you never opened. A single 30-day late mark on a fraudulent account can cost 60-110 points depending on your starting score, and a collections account or charge-off can cost significantly more. This is exactly what happened to Renata: the fraudulent auto loan went unpaid for three months before she discovered it, and that delinquency history did more damage than the account itself.
It’s worth noting that FICO and VantageScore models don’t currently distinguish between a late payment you caused and one a thief caused — the algorithm scores the data on your report, not the story behind it. That’s precisely why disputing and blocking the fraudulent items, rather than just closing the accounts, is the only way to actually restore your score. Closing an account still leaves the derogatory history intact; blocking removes it as though it never happened.
The First 48 Hours: What to Do Before You Call Anyone
Speed matters enormously here, because every additional week a fraudulent account stays open is another statement cycle where it can report a late payment or a higher balance. The first action, before you call a single creditor, is filing a report at IdentityTheft.gov, the FTC’s dedicated recovery portal. This generates an FTC Identity Theft Report and a personalized recovery plan, and it’s free and takes about 20-30 minutes.
Second, file a report with your local police department, referencing the FTC report number. Some creditors and bureaus require both documents, not just one, particularly for larger fraudulent balances like Renata’s auto loan. Keep both reports — digital and printed — because you’ll attach them to every dispute letter you send.
Third, pull all three of your credit reports immediately at AnnualCreditReport.com and go through them line by line. Note every account, inquiry, and address you don’t recognize, including old addresses that might indicate mail theft or mail-forwarding fraud. Don’t skip this step even if you already know about one fraudulent account — thieves rarely stop at one, and Renata’s case is typical in that regard: one call about an auto loan uncovered five other fraudulent items she didn’t know existed.
Fraud Alerts vs. Credit Freezes: Which One to Use First
These two tools get confused constantly, and using the wrong one at the wrong time slows recovery. A fraud alert, placed with one bureau (which is required to notify the other two), tells lenders they must verify your identity before opening new credit in your name. It’s free, lasts one year, and can be extended to seven years once you have a police report on file.
A credit freeze is stronger. It blocks any third party from accessing your credit file at all, which means no new account can be opened, period, until you lift it. Freezes are free under federal law, can be placed and lifted instantly online, and don’t affect your existing score or accounts. For anyone actively dealing with identity theft, we recommend freezing all three bureaus immediately, not just placing an alert — Equifax, Experian, and TransUnion each have separate freeze portals, and all three need to be done individually.
Practical tip: freeze your minor children’s credit files too, if applicable. Child identity theft often goes undetected for years because no one checks a credit report for a 9-year-old, and thieves specifically target Social Security numbers with no existing credit history.
Disputing Fraudulent Accounts Under FCRA Section 605B
This is the legal mechanism that makes identity theft recovery faster than a standard credit dispute. Under Section 605B of the Fair Credit Reporting Act, once you submit an FTC Identity Theft Report along with an ID Theft Affidavit to a credit bureau, that bureau must block the fraudulent information from your report within four business days. This isn’t a request the bureau can slow-walk the way it sometimes handles ordinary disputes — it’s a statutory deadline.
Send the block request in writing to each bureau separately, including copies (never originals) of your police report, FTC Identity Theft Report, and a government-issued ID. Certified mail with return receipt gives you proof of delivery, which matters if a bureau misses the four-day window and you need to escalate to the CFPB.
This process is closely related to disputing errors that aren’t fraud-related but still require documentation and bureau accountability — we cover the mechanics of that broader dispute process in our guide to fixing FICO errors from automated credit bureaus. The core skill is the same: know exactly which federal provision applies to your situation and cite it directly in your dispute letter, rather than sending a vague “this isn’t mine” note that bureaus can more easily reject or delay.
Cleaning Up Hard Inquiries From Fraudulent Applications
Every application a thief submitted in your name generated a hard inquiry, and those inquiries need to be disputed separately from the accounts themselves. Inquiries don’t automatically disappear when the associated account is blocked — you have to identify each one and dispute it directly with the bureau that shows it.
List every unrecognized inquiry from your credit reports, matched to the date range of the fraud, and include them in the same dispute package referencing your FTC Identity Theft Report. Bureaus are required to remove inquiries tied to identity theft under the same Section 605B framework used for the accounts.
We’ve seen cases where six or more inquiries from a single fraud spree cost a victim 40-60 points cumulatively, even after the fraudulent accounts themselves were removed — inquiries are often the piece people forget to dispute. For a deeper look at how inquiry damage compounds and how to dispute it correctly even outside of fraud cases, see our guide to fixing credit score damage from inquiries.
Dealing With Debt Collectors Chasing Fraudulent Debt
Renata’s collections call is the point where most victims panic and start negotiating a payment plan for a debt they don’t owe — don’t do this. Under the Fair Debt Collection Practices Act, once a collector receives written notice that a debt resulted from identity theft, along with your FTC report, they’re required to cease collection activity and, in most cases, return the account to the original creditor.
Send the collector a dispute letter within 30 days of first contact if possible, by certified mail, including your FTC Identity Theft Report number and police report. Request in writing that they stop reporting the account to the bureaus. If a collector continues calling or reporting after receiving this documentation, that’s a separate FDCPA violation you can report to the CFPB, and it can carry statutory damages.
Never provide bank information, make a “good faith” partial payment, or verbally acknowledge the debt as yours — even a small payment can be interpreted as accepting responsibility and can restart the statute of limitations on debt that isn’t legally yours to begin with. If the fraudulent debt has already gone to a public record or judgment, the process gets more complex; our article on correcting erased and inaccurate public records walks through what to do when fraud has escalated to that level.
Realistic Recovery Timeline: What Happens Month by Month
Setting accurate expectations matters, because victims who expect an overnight fix often give up on the paperwork before it pays off. In the first two weeks, freezes and fraud alerts go active immediately, stopping new damage. Blocked accounts under Section 605B should be removed from your report within four business days of a properly documented request, though it can take another cycle for the score to reflect the change once the bureau recalculates.
By day 30-45, most victims see accounts and associated late payments disappear from their report entirely, and scores typically recover 60-80% of the lost points at this stage, assuming no legitimate derogatory history existed before the fraud. By day 60-90, remaining disputed inquiries should be resolved and removed, closing out most of the recovery.
Full restoration to a pre-theft score, particularly if utilization was affected or if you had to close and reopen accounts, can take 6-12 months as new positive payment history and account age rebuild. Renata’s score went from 561 back to 704 in 71 days once her disputes were filed correctly and in the right sequence — a recovery timeline that’s typical when the paperwork is done right the first time instead of restarted after rejected disputes.
Common Mistakes That Slow Down Recovery
The single biggest mistake is disputing directly with the creditor by phone instead of filing the formal FTC and bureau paperwork first. Phone disputes create no legal record and no enforceable deadline — bureaus can sit on them indefinitely. Always put every dispute in writing, referencing the specific FCRA section that applies.
The second mistake is disputing only the account you know about and skipping the full report pull. Thieves who successfully open one account frequently attempt several more using the same stolen information within the same window, and missing even one fraudulent item leaves ongoing damage on your report.
The third mistake is paying any portion of a fraudulent debt to “make it go away.” This can legally muddy your claim that the debt isn’t yours and gives collectors leverage to argue you accepted responsibility. If you’re also managing legitimate delinquencies from before the identity theft occurred, don’t lump them into the same dispute process — those require a different approach, which we cover in our guide to credit repair for ex-delinquencies. Keeping fraud disputes and legitimate debt cleanup separate prevents bureaus from questioning the credibility of your entire dispute package.
When to Handle It Yourself vs. When to Get Help
A single fraudulent account with a cooperative bureau and no collections involvement is often manageable on your own using the IdentityTheft.gov affidavit and a Section 605B letter. Most people can execute that in a weekend.
Professional help becomes worth the cost when multiple bureaus are slow-walking your blocks past the four-day statutory window, when collectors continue contacting you after receiving your dispute documentation, or when the fraud has spread into tax records, medical billing, or public court records — situations that require coordinating disputes across multiple agencies simultaneously rather than one clean bureau letter. Complex cases involving synthetic identity theft, where a thief combines your Social Security number with a different name and address, also tend to require professional documentation work because the fraudulent file can be tangled with your legitimate one in ways that are hard to separate without experience reading bureau responses.
If you’re several weeks into disputes with no movement, or you’re getting form-letter denials from a bureau that clearly haven’t reviewed your documentation, that’s the signal to bring in help rather than keep resending the same letter and hoping for a different result.
Your Next Step
If you’ve discovered a fraudulent account or a stranger’s debt on your credit report, don’t wait for the next statement cycle to see if it resolves itself — it won’t, and every month it sits there is another cycle of reported damage. File your FTC Identity Theft Report today, freeze your credit with all three bureaus this week, and get your dispute letters out with certified mail tracking so you have proof of every deadline.
If the fraud involves multiple accounts, a collector who won’t stop calling, or bureaus that have already missed their four-day block deadline, book a free consultation with our team. We’ll review your credit reports, identify every fraudulent item across all three bureaus, and build the exact dispute sequence to get your score back to where it was before someone else used your name.
