Last updated: July 31, 2026 · Written by John C. Hubbard, Attorney
You pulled your credit report and found accounts you never opened. Someone may have used your identity to obtain credit, and the resulting balances, late payments, or collections are now being reported in your name. The fix follows a defined path: report the theft to the FTC, dispute the fraudulent accounts in writing with each credit bureau reporting them, and see what comes back. The bureaus and the companies furnishing the accounts have investigation duties under the Fair Credit Reporting Act. When they mishandle a properly documented identity-theft dispute and the failure causes harm, the consumer may have an FCRA claim. John C. Hubbard is a consumer protection attorney licensed in Alabama and Texas. Call 205-378-8121 in Alabama or 832-410-8121 in Texas.
How do I know it’s identity theft and not some other error?
The identifiers are yours but the accounts aren’t. With identity theft, your name, Social Security number, and usually your address sit on top of accounts you never opened: a credit card from a bank you’ve never used, a loan in a state you’ve never lived in, hard inquiries you never authorized. If the report also shows names, addresses, or employers that were never yours, you may instead be dealing with a mixed credit file, where the bureau has blended you with another real person. Sometimes the two problems overlap, so the correct dispute strategy depends on the records.
Step 1: Report the identity theft to the FTC
Go to IdentityTheft.gov, the FTC’s official site, answer its questions, and preserve the completed Identity Theft Report and recovery plan. This costs nothing and takes minutes. The report matters because it creates an official record of the identity theft that supports every dispute that follows, and false information in the report may carry criminal consequences. A police report may also be useful, particularly when you know the suspected thief, the fraud occurred locally, or a creditor requests additional documentation.
Step 2: Dispute the fraudulent accounts with each credit bureau
Send a written dispute to every bureau reporting a fraudulent account: Equifax, Experian, and TransUnion each get their own letter, because each maintains its own file. Identify each fraudulent account, balance, collection, and inquiry specifically, state that it resulted from identity theft and does not relate to any transaction by you, and attach your Identity Theft Report along with copies, not originals, of the identification the bureau requests. Redact what is not necessary, but leave enough visible for the bureau to verify your identity. Trackable mail is not legally required, but it creates the clearest record of what you sent and when the bureau received it. Keep a complete copy of each package.
This step does two jobs at once. Under 15 U.S.C. § 1681i, the bureau generally must complete a reasonable reinvestigation within 30 days; in some circumstances, the period can be extended by up to 15 additional days if you provide relevant information during the initial investigation. And the bureau must forward relevant dispute information to the furnisher (the bank or lender reporting the account), which triggers the furnisher’s own duty under § 1681s-2(b) to reasonably investigate.
A direct complaint to the lender may be useful and may trigger separate obligations, and it’s worth sending your Identity Theft Report to the creditor’s designated fraud address. But a dispute sent through a credit bureau is ordinarily necessary to trigger the furnisher investigation duty under § 1681s-2(b) that consumers commonly enforce through a private FCRA lawsuit. So dispute through every bureau reporting the account, even if you’ve already contacted the lender directly.
Step 3: See what comes back
Common outcomes include deletion or blocking, a request for more information, partial correction, or a response stating that the account was verified. Watch for reinsertion or transfer of the account to a new collector, and compare updated reports from all three bureaus, because results can differ bureau to bureau.
The “verified” letter is the one that matters most. It means the bureau completed its stated dispute process without removing the account. The letter does not necessarily reveal what documents the bureau forwarded, what the furnisher reviewed, or how either company reached its conclusion. Keep the letter and envelope; they may become important evidence.
If an account is verified, preserve the response and obtain advice before paying, settling, or submitting another dispute. Payment may not remove the fraudulent information and could complicate the record.
When does a lawsuit become possible?
When a bureau or furnisher mishandles a properly documented identity-theft dispute and the failure causes harm. Whether a claim exists depends on the facts: what you sent, what they did with it, and what it cost you. The theories line up this way:
Against the bureau. A bureau may violate § 1681i if it merely rubber-stamps a furnisher’s response without reasonably considering clear identity-theft evidence submitted by the consumer. And if the bureau prepares or provides an inaccurate consumer report containing the fraudulent account, its procedures may also be challenged under § 1681e(b), which requires reasonable procedures to assure maximum possible accuracy.
Against the furnisher. A furnisher may be liable under § 1681s-2(b) if, after receiving notice of the dispute from a bureau, it fails to conduct a reasonable investigation, disregards relevant identity-theft information, or reports results that are inaccurate or incomplete.
Repeated failures matter. Repeated verifications despite increasingly specific disputes and compelling identity-theft documentation may strengthen an argument that the defendant acted recklessly rather than merely negligently. Willfulness remains a fact-specific question.
What damages are available under the FCRA?
For a negligent violation, a consumer may recover proven actual damages and, when successful, reasonable attorney’s fees and costs under 15 U.S.C. § 1681o. Depending on the evidence and causation, actual damages may include losses from credit denials, increased borrowing costs, out-of-pocket expenses, lost time, and emotional distress. For a willful violation, § 1681n permits actual damages or statutory damages of $100 to $1,000, possible punitive damages, and reasonable attorney’s fees and costs. Statutory damages are an alternative to actual damages, not a bonus on top.
FCRA claims generally must be filed by the earlier of: (1) two years after you discover the violation, or (2) five years after the violation occurred, under § 1681p. When that clock started can get complicated with accounts that were repeatedly verified, so do not assume you are too late without checking.
What should I do right now?
- Pull all three reports at annualcreditreport.com and list every account and inquiry that is not yours
- File your Identity Theft Report at IdentityTheft.gov and save the PDF
- Send a written dispute to each bureau reporting a fraud account, with the report and redacted copies of your ID attached, by a trackable method
- Send a copy of the Identity Theft Report to each creditor’s designated fraud address
- Keep complete copies of everything you send and everything that comes back
- Calendar 30 days from each bureau’s receipt as a follow-up date
- If an account comes back “verified,” preserve the response and get the file reviewed before paying or re-disputing
What about credit freezes, fraud alerts, and identity theft blocks?
They’re worth using, and none of them replaces the dispute process above. A security freeze is free at each bureau and generally restricts access for new credit applications, which makes it much harder for the thief to open anything else; it does not remove existing fraudulent accounts or prevent existing creditors and their collectors from accessing the report. A fraud alert (one year, or seven for identity theft victims with a report) tells creditors to verify your identity first; place it with one bureau and it must notify the other two. The FCRA also has a blocking procedure, 15 U.S.C. § 1681c-2, that can require a bureau to block identified identity-theft information within four business days of a complete request. Each tool helps. The written dispute remains the step that triggers the investigation duties most FCRA lawsuits are built on, so do that one regardless.
Talk to an Alabama or Texas identity theft and credit report lawyer
Contact John C. Hubbard, LLC if a credit bureau or lender verified an account you did not open after a documented identity-theft dispute, or restored a fraud account that had been removed. Consultations are free, and there is no attorney’s fee unless money is recovered.
Call 205-378-8121 (Alabama) or 832-410-8121 (Texas) or use the contact form.
This website provides general information and is not legal advice. Viewing the website, submitting a contact form, or speaking with the firm does not create an attorney-client relationship. An attorney-client relationship is created only through a written engagement agreement signed by the client and the firm. Do not send confidential or time-sensitive information until the firm confirms that it represents you. Every matter is different. Past results do not guarantee or predict a similar outcome. Responsible attorney: John C. Hubbard. Principal office: Birmingham, Alabama. John C. Hubbard is licensed in Texas and Alabama.