Identity Theft and Your Credit

By the time you find out your identity has been stolen, it has usually been stolen for a while. The fraud appears in your credit report as accounts you didn't open, hard inquiries from lenders you've never contacted, and addresses you've never lived at listed as current. The discovery almost always comes months after the theft — sometimes years after — when the fraudulent account finally becomes delinquent and lands on your report.

Cleaning up identity theft is solvable, but it's tedious and time-consuming. Disputing fraudulent accounts, working with creditors, and restoring your credit to its pre-theft state can take months. Most of that work can be avoided with a credit freeze — a simple, free measure that the majority of people who are aware of it still haven't done. The time investment is about fifteen minutes. The protection is significant.

How identity theft shows up in your credit report

The clearest signals are accounts you don't recognize — a credit card from a bank you've never used, a personal loan you didn't take out, a store credit account you didn't open. These appear in the Accounts section of your credit report. Fraudulent hard inquiries — from lenders who pulled your report when someone applied for credit in your name — show up in the Inquiries section. Both types should trigger immediate action.

Subtler signs: addresses on your report you've never lived at, phone numbers you don't recognize listed as associated with your file, or a name variation that isn't yours. Identity thieves sometimes update this personal information when creating new accounts, which is why your credit report's personal information section is worth reviewing as carefully as the accounts section. You're entitled to free credit reports from all three bureaus — Equifax, Experian, and TransUnion — at AnnualCreditReport.com.

The credit freeze — the most effective protection available

A credit freeze — also called a security freeze — instructs each bureau to block lenders from pulling your credit report. Since most lenders require a credit pull to open a new account, a freeze prevents new fraudulent accounts from being opened in your name. The freeze doesn't affect your credit score. It doesn't prevent existing creditors from accessing your report. It doesn't block you from applying for credit — you simply lift the freeze at the relevant bureau before applying, which takes about a minute online, and re-freeze afterward.

Credit freezes are free at all three major bureaus. You must freeze at each one separately — Equifax.com, Experian.com, and TransUnion.com each have a freeze option in their account settings. ChexSystems, which handles bank account opening inquiries, also allows a freeze if you want to prevent fraudulent bank accounts as well. Freezing all three bureaus takes about fifteen minutes total and costs nothing.

A fraud alert is a lesser measure — it tells lenders to take extra steps to verify your identity before opening new accounts, but it doesn't block the pull outright. Fraud alerts are easier to place (you only file at one bureau and it notifies the others) but meaningfully weaker than a freeze. If you're choosing between them, the freeze is almost always the better option unless you're actively applying for multiple credit accounts and don't want the friction of lifting and re-freezing.

What to do the moment you find something wrong

If you find a fraudulent account or inquiry on your credit report, the sequence of actions is: place a freeze at all three bureaus immediately, file a report at IdentityTheft.gov (the FTC's official reporting site), and then file disputes with the bureaus reporting the fraudulent item. IdentityTheft.gov generates a personalized recovery plan and pre-filled dispute letters. The FTC report also establishes a legal record of the theft, which creditors are required to take seriously when evaluating your dispute.

Contact the creditor directly in addition to filing a bureau dispute. Most creditors have a fraud department that handles these calls. They can freeze the fraudulent account on their end, preventing further charges, while the formal dispute process proceeds. Some creditors remove fraudulent accounts immediately upon receiving adequate documentation. Others take the full 30-day investigation window that the Fair Credit Reporting Act allows.

The dispute process — your legal rights

Under the Fair Credit Reporting Act, credit bureaus must investigate disputes within 30 days and remove items they cannot verify as accurate. When you dispute a fraudulent account, the bureau contacts the creditor and asks them to verify the account. If the creditor can't confirm the account belongs to you — which they often cannot, since the thief used fabricated information — the account must be removed.

File disputes in writing, not just online. Certified mail creates a paper trail and starts the 30-day investigation clock definitively. Keep copies of everything — your dispute letter, the FTC report, any responses from bureaus or creditors. If a fraudulent item is removed and then reappears on your report later, which happens, your documentation proves it was already investigated and removed, and the bureau is required to notify you before reinserting it.

How your information gets stolen

Data breaches are the most common source. When a company you've done business with gets breached, your name, email, Social Security number, or financial data may be exposed. There have been major breaches at Equifax, Yahoo, Target, Marriott, and hundreds of other companies. The data from these breaches circulates on dark web markets for years after the original incident. You can check whether your email address appears in known breaches at haveibeenpwned.com.

Phishing — fraudulent emails or websites designed to capture your login credentials — is another major source. Physical mail theft, particularly of pre-approved credit card offers and financial statements, still generates fraud. Social engineering attacks that persuade you to give out information directly are increasingly common and increasingly sophisticated. No single protection covers all vectors, which is why the credit freeze matters: even if your information is stolen, a thief can't open new credit accounts if the bureaus are locked.

A credit freeze doesn't prevent all forms of identity theft. Someone with your information can still file a fraudulent tax return, open a bank account at an institution that doesn't check the major bureaus, or apply for government benefits in your name. But a freeze eliminates the most common and most credit-damaging variety — fraudulent credit account opening — at zero cost and minimal inconvenience. Most people who haven't done it have no specific reason not to. The fifteen minutes it takes is the most efficient financial protection available.