Fraudulent Account on Your Credit Report: What to Do
Photo by Lukas Blazek on Pexels

Fraudulent Account on Your Credit Report: What to Do

By US Debt Compass Editorial TeamUpdated 2026-09-02
On this page

An account on your credit report that you genuinely never opened isn’t an ordinary mistake to dispute — it’s identity theft, and federal law gives you a stronger, faster legal process than the one that applies to a wrong balance or a duplicate listing. This is different from disputing an inaccurate item, which covers real accounts with wrong information on them. If you’re not sure which situation you’re in, the test is simple: did you ever open this account, under any name or address associated with you? If not, this page — not the ordinary dispute process — is the one that actually protects you.

Under FCRA § 605B (15 U.S.C. § 1681c-2), once you provide a credit bureau with proof of your identity, an identity theft report, and a statement that you didn’t authorize the account, the bureau is legally required to block that information within 4 business days and notify whoever furnished it. This isn’t a request the bureau can slow-walk the way a standard dispute sometimes drags on — it’s a specific, faster legal obligation, and it forces the furnisher to be notified directly rather than waiting for them to respond to a routine dispute. If a bureau ignores a valid block request, you have grounds to pursue damages under the FCRA’s enforcement provisions.

Start here: IdentityTheft.gov

The FTC’s own recovery tool, IdentityTheft.gov, is free and does most of the paperwork for you: it generates a personalized recovery plan, a pre-filled Identity Theft Affidavit, and an Identity Theft Report that substitutes for a police report in most situations — which is exactly the documentation § 605B requires to force a block. There’s no legitimate reason to pay anyone for what this free federal tool already produces.

Do this in the first 24-48 hours

  1. File your report at IdentityTheft.gov — this single document is what triggers every stronger protection below.
  2. Place a fraud alert or a credit freeze, depending on how urgent this is. A fraud alert is faster to set up (placing it with one bureau notifies the other two automatically) and lasts 12 months for free; a credit freeze blocks access to your report entirely but has to be placed separately at each of the three bureaus. An extended fraud alert — 7 years, and it also removes you from prescreened credit-offer mailing lists for 5 years — requires your identity theft report to qualify, so file that first.
  3. Send your identity theft report to the fraudulent account’s furnisher directly, along with a § 605B block request, and keep a dated copy of everything.
  4. Contact the specific creditor or bank the fraudulent account was opened with — most have their own fraud department separate from the standard dispute process.

You don’t owe it while this is pending — but document everything

Once a collector has your identity theft report, federal law requires them to stop collection activity on that specific account. In practice, this protection is only as strong as your documentation — a real CFPB enforcement action was brought against a debt collector specifically for failing to investigate identity theft reports and continuing to misrepresent the debt as the consumer’s. Keep copies of the identity theft report, the date you sent it, and any response, since that record is what makes the protection enforceable if a collector doesn’t comply.

This is a genuinely common problem, not a rare one

The FTC’s own 2024 data shows $12.5 billion in reported fraud losses, a 25% increase year over year, and more than 1.1 million identity theft reports filed through IdentityTheft.gov that year alone. If a collector is contacting you about an account you don’t recognize, see First Collector Contact for your general rights during that contact, and once the fraudulent account is actually removed, Rebuilding Your Credit After Collections, a Layoff, or a Crisis for what to focus on afterward.

Questions & Answers

Is a fraudulent account the same thing as an ordinary credit report error?

No, and the distinction matters. An ordinary error (a wrong balance, a duplicate listing) goes through a standard FCRA dispute. An account you never opened at all qualifies for a stronger federal mechanism — a "block" under FCRA § 605B — which removes it faster and with more legal teeth than a standard dispute.

— US Debt Compass Editorial Team

Do I have to pay a fraudulent debt while I'm disputing it?

No. Once you've filed an identity theft report and a collector has it, federal law requires them to stop collection efforts on that specific debt. Keep a copy of everything you send and the date you sent it.

— US Debt Compass Editorial Team

How long does a fraud alert or credit freeze last?

An initial fraud alert lasts 12 months and is free. An extended fraud alert lasts 7 years, but requires an identity theft report or police report to qualify, and also removes you from prescreened credit offer lists for 5 years. A full credit freeze has no expiration and blocks access to your report entirely until you lift it — but it has to be placed separately at each of the three bureaus, unlike a fraud alert, which one bureau shares with the other two automatically.

— US Debt Compass Editorial Team

Is IdentityTheft.gov actually free?

Yes — it's run directly by the FTC, generates a personalized recovery plan, and produces a pre-filled Identity Theft Affidavit and an Identity Theft Report that substitutes for a police report in most situations. There's no cost and no reason to pay a third party for what this tool already does.

— US Debt Compass Editorial Team

Sources