Finding an account you never opened on your credit report is unsettling, and the instinct to panic-Google is understandable. What actually matters is doing the next few steps in the right order, because federal law built a specific sequence for exactly this situation — and skipping steps costs you time you don't have.

Step 1: File Your FTC Report First

Before you call a single bureau or creditor, go to identitytheft.gov and file a report. This takes about 20 minutes and produces an FTC Identity Theft Report — the document every other step in this checklist depends on. The site also generates a personalized recovery plan based on what happened (a stolen SSN, a hijacked account, a tax-fraud filing, etc.), with letter templates already built for you.

Do this first because your FTC report is what lets you request an extended fraud alert (seven years, versus one year for a standard alert) and what gives bureaus and creditors the legal basis to block fraudulent information quickly rather than treating your dispute as an ordinary one.

Step 2: Lock Down Your Credit Files

With your FTC report in hand, place either a credit freeze or an extended fraud alert — ideally both, depending on your situation.

  • A freeze blocks any new account from being opened at all until you lift it.
  • An extended fraud alert (available because you now have an FTC report) requires extra identity verification for seven years and removes you from prescreened offer lists.

We cover exactly how to place both, at all three bureaus, in our credit freeze vs. fraud alert guide — that post is the detailed how-to; this one is about the order of operations around it.

Step 3: Pull All Three Reports and Identify Every Fraudulent Item

Get your reports from all three bureaus at AnnualCreditReport.com — not just one. Fraudsters don't always hit all three bureaus the same way, and a creditor may report to only one or two. Go line by line. For each account you don't recognize, note:

  • The creditor name and account number
  • The date it was opened
  • The balance being reported
  • Which bureau(s) show it

This becomes your dispute list.

Step 4: Dispute Every Fraudulent Item — With Your FTC Report Attached

Send a dispute to each bureau reporting a fraudulent item, and separately notify the creditor or furnisher directly. Attach a copy of your FTC Identity Theft Report to every dispute. This matters: an identity-theft dispute backed by an FTC report carries a faster, stronger legal obligation than an ordinary "this isn't accurate" dispute. Under the FCRA, a bureau must generally block the fraudulent information within four business days of receiving your report and dispute, pending their standard investigation.

For the mechanics of writing an effective dispute letter, see our guide on how to dispute credit report errors — the identity-theft dispute uses the same channel, with your FTC report as the added leverage.

Step 5: Notify Existing Creditors and Your Bank

If any existing accounts were compromised (not just new fraudulent ones opened), call the fraud department of each affected bank or card issuer directly. Ask them to flag the account, reissue card numbers if needed, and confirm in writing what they've done. Keep a log: date, time, name of the representative, and what was agreed.

Step 6: Follow Up in Writing, and Escalate if Ignored

Give each bureau and creditor 30 days to respond to your dispute. If a fraudulent item is still reporting after that window, or a bureau ignores the block requirement:

  1. Send a written follow-up referencing your original dispute date and FTC report number.
  2. File a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov/complaint. A documented FCRA violation — like ignoring the four-business-day block requirement — is exactly the kind of case the CFPB acts on.
  3. Keep every piece of correspondence. If this ever needs an attorney's involvement, a clean paper trail is the difference between a fast resolution and a slow one.

What Recovery Does Not Require

You do not need to pay a "credit repair" company to file your FTC report, place a freeze, or send an identity-theft dispute — every one of the steps above is free and something you're entitled to do yourself under federal law. Where professional help earns its cost is in cases with multiple fraudulent accounts, disputes that bureaus are mishandling, or a credit profile complicated enough that recovery and rebuilding need to happen at the same time.

The Bottom Line

Identity theft recovery isn't guesswork — it's a defined sequence: FTC report first, then lock your files, then pull all three reports, then dispute with your FTC report attached, then follow up in writing and escalate if ignored. Move through it in that order and you protect yourself from further damage while you clear the existing fraud.

If your situation involves multiple accounts, a bureau that isn't cooperating, or fraud damage layered on top of credit issues that predate it, we can help you sort out what's fraud, what's fixable through a standard dispute, and what the fastest realistic path back looks like.

Book a free 30-minute consultation and let's map out your specific recovery plan.