Identity Theft and Debt: How to Protect Yourself and Clean Up the Mess

The notification comes out of nowhere: a collections notice for a credit card you never opened, or a credit report showing a car loan in your name for a vehicle you have never seen. Your heart races. Someone has stolen your identity — and now there are debts attached to your name that you did not create, authorize, or benefit from in any way.

Identity theft is one of the fastest-growing crimes in the United States. According to the Federal Trade Commission (FTC), Americans reported more than 1.4 million cases of identity theft in 2023 alone, with fraud and identity theft combined generating over $10 billion in losses. But the real financial damage goes far beyond stolen cash. The most devastating consequence of identity theft is the fraudulent debt left behind — debts that collectors pursue, credit bureaus report, and courts may enforce if you do not act quickly and correctly.

This guide walks you through everything you need to know: how identity thieves create debt in your name, the immediate steps to take the moment you discover fraud, how to file an FTC report, the difference between fraud alerts and credit freezes, and the step-by-step process for disputing and removing every fraudulent debt from your record.

How Identity Theft Creates Debt You Never Owed

Identity theft is not just about someone draining your bank account. The most financially destructive form is new account fraud — where a thief uses your personal information (Social Security number, date of birth, address) to open entirely new credit accounts in your name.

Here is how it typically works:

1. The thief obtains your personal information. This can happen through data breaches, phishing emails, stolen mail, skimming devices at ATMs, malware on your computer, or even dumpster diving for unshredded documents containing your SSN or account numbers.
2. The thief applies for credit. Using your SSN and other identifying details, the fraudster applies for credit cards, personal loans, auto loans, or even mortgages. Many online applications require minimal verification, making this relatively easy.
3. The thief maxes out the accounts. Once approved, the thief uses the credit lines aggressively — making large purchases, cash advances, or balance transfers — often across multiple accounts simultaneously.
4. The accounts go delinquent. Because the thief never intends to repay, the accounts quickly become past due. The creditor writes off the debt and sells it to a collection agency, or the account is charged off and sent directly to collections.
5. Collectors come after you. The collection agency sees the account in your name and begins calling, mailing, and pursuing you for payment. The fraudulent debt appears on your credit report, dragging down your score. This is where the real nightmare begins.

There are also other forms of identity-related debt fraud: account takeover (where a thief gains access to your existing accounts and runs up charges), medical identity theft (where someone uses your insurance for medical services, leaving you with bills), and tax identity theft (where someone files a tax return using your SSN to claim your refund). Each creates a different kind of financial mess that requires a specific cleanup approach.

Immediate Steps to Take the Moment You Discover Fraud

Speed matters. The faster you act, the easier it is to stop the thief and limit the damage. Here is exactly what to do, in order:

1. Freeze or lock your credit files immediately. Contact all three credit bureaus — Equifax, Experian, and TransUnion — and place a fraud alert or credit freeze. A freeze prevents any new accounts from being opened. This stops the bleeding instantly.
2. Review all your financial accounts. Check bank statements, credit card bills, investment accounts, and any other financial services for unauthorized transactions. Flag and report every suspicious charge to the financial institution immediately.
3. Obtain your credit reports. Get free copies of your credit reports from all three bureaus at AnnualCreditReport.com. This is the only federally authorized source for free credit reports. Look for accounts you do not recognize, inquiries you did not authorize, and any other suspicious activity.
4. File an FTC Identity Theft Report. Go to IdentityTheft.gov and complete the online report. This creates an official federal Identity Theft Report that you will use to dispute fraudulent debts, request account closures, and remove negative items from your credit report. Print copies — you will need them.
5. File a police report. Contact your local police department and file a report for identity theft. Provide your FTC report, any evidence of fraud, and identification. Get a copy of the police report with the case number. Some creditors and credit bureaus require this for extended protections.
6. Contact the fraud department of each affected company. Call the fraud or security department of every company where an unauthorized account was opened or your existing account was compromised. Tell them your identity was stolen, provide your FTC report number, and request the account be closed or flagged as fraudulent.

Filing an FTC Identity Theft Report

The FTC Identity Theft Report is your most powerful weapon in cleaning up identity theft-related debt. It is a federally recognized document that combines your personal statement of the theft with an official FTC tracking number. Here is why it matters and how to file one.

Why the FTC Report Is Critical

• It triggers legal protections. Under the Fair Credit Reporting Act (FCRA), once you provide an FTC Identity Theft Report to a credit bureau, the bureau must block information related to the identity theft within four business days. This means fraudulent accounts are removed from your credit report during the investigation.
• It forces creditors to stop collection. Creditors and debt collectors who receive your FTC report must stop collecting on the fraudulent debt and close the accounts.
• It replaces a police report. Many creditors and bureaus accept the FTC report in place of a local police report, which is especially helpful if your police department is slow or unresponsive.
• It creates a recovery plan. IdentityTheft.gov generates a personalized, step-by-step recovery plan based on the specific types of theft you report.

How to File

1. Go to IdentityTheft.gov. This is the official FTC website for identity theft recovery. Do not use third-party services that charge a fee — the FTC report is completely free.
2. Answer the questionnaire. The site will ask what information was stolen, how you discovered the theft, and what accounts or activities are affected. Be as specific and thorough as possible.
3. Review and submit. The FTC will generate your Identity Theft Report with a unique complaint reference number. Download and print multiple copies.
4. Use your recovery plan. The FTC generates pre-filled dispute letters, affidavit forms, and a timeline for your case. Use these documents when contacting creditors, credit bureaus, and debt collectors.

Fraud Alerts vs. Credit Freezes: Which One Do You Need?

Two primary tools protect your credit file after identity theft: fraud alerts and credit freezes. Both are free under federal law, but they work differently and offer different levels of protection.

Fraud Alerts

A fraud alert places a notice on your credit file telling creditors to take extra steps to verify your identity before opening new accounts. There are two types:

• Initial fraud alert: Lasts 1 year. Anyone can request this if they suspect they may be a victim of identity theft. You only need to contact one credit bureau — by law, that bureau must notify the other two.
• Extended fraud alert: Lasts 7 years. Requires an FTC Identity Theft Report or a police report. Provides stronger protections and entitles you to two free credit reports from each bureau within 12 months.

A fraud alert does not prevent new accounts from being opened — it adds a verification step. A determined thief with forged documents might still get through, which is why many identity theft victims choose to go a step further.

Credit Freeze (Security Freeze)

A credit freeze is the nuclear option. It completely locks your credit file so that no creditor can access your credit report — and therefore no new accounts can be opened. You must place a freeze separately with each of the three credit bureaus:

• Equifax: equifax.com/personal/credit-freeze
• Experian: experian.com/freeze/center.html
• TransUnion: freeze.transunion.com

Freezes are free to place and remove. When you need to apply for credit yourself, you can temporarily lift the freeze for a specific time period or for a specific creditor using the PIN each bureau provides.

The Identity Theft Affidavit

An identity theft affidavit is a sworn statement in which you declare, under penalty of perjury, that specific accounts or transactions on your credit file were the result of identity theft — not your own actions. Many creditors and credit bureaus require this document as part of their fraud investigation.

What Goes in an Affidavit

A standard identity theft affidavit includes:

• Your full legal name, date of birth, and Social Security number
• A detailed description of the identity theft event (when you discovered it, how it happened if known)
• A list of every fraudulent account or transaction, including the creditor name, account number, and approximate date opened
• A statement that you did not open, authorize, or benefit from these accounts
• Your signature, dated, affirming the statement is true under penalty of perjury

The FTC provides a standardized Identity Theft Affidavit form as part of the IdentityTheft.gov recovery plan. Many creditors also have their own affidavit forms. When a creditor requires their own form, complete that one in addition to the FTC affidavit.

How to Use the Affidavit

Send your completed affidavit, along with a copy of your FTC Identity Theft Report, to every creditor and credit bureau involved in the fraud. Send via certified mail with return receipt requested so you have proof of delivery. Keep copies of everything you send. The affidavit, combined with your FTC report, creates the legal foundation for disputing every fraudulent debt and demanding its removal from your credit file.

Disputing Fraudulent Debts: The Complete Process

Once you have your FTC Identity Theft Report, police report, and identity theft affidavit, the real cleanup work begins: getting every fraudulent debt removed from your credit report and stopping collectors from pursuing you.

1. Identify every fraudulent account. Review your credit reports from all three bureaus. Make a list of every account you did not open or authorize. Note the creditor name, account number, balance, and which bureau(s) are reporting it.
2. Send a dispute letter to each credit bureau. Write a formal dispute to each bureau reporting a fraudulent account. Include your FTC Identity Theft Report, your identity theft affidavit, copies of your ID, and proof of address. Demand that the bureau block and remove the fraudulent information under FCRA Section 605B. Learn more about the dispute process in our guide on how to remove collections from your credit report.
3. Send a dispute letter to each creditor. Write directly to the creditor or lender that opened the fraudulent account. Provide your FTC report and affidavit. Demand they close the account, mark it as fraudulent, and stop reporting it to credit bureaus.
4. Respond to any collection notices. If a debt collector is contacting you about a fraudulent debt, send a debt validation letter within 30 days of first contact. Attach your FTC Identity Theft Report and identity theft affidavit. Demand that the collector cease all collection activity and close the account. Under the Fair Debt Collection Practices Act (FDCPA), collectors who continue pursuing verified fraudulent debts may be violating federal law.
5. Follow up within 30 days. Credit bureaus have 30 days to investigate your dispute. If they confirm the account is fraudulent, they must remove it. If they fail to respond or refuse to remove verified fraud, you may have a claim under the FCRA and should consult a consumer rights attorney.
6. Verify the removal. After the investigation, request updated credit reports from all three bureaus to confirm the fraudulent accounts have been removed. If any remain, escalate with a second dispute and consider filing complaints with the CFPB and FTC.

Preventing Identity Theft Before It Happens

Prevention is always cheaper and easier than cleanup. Here are the most effective steps to protect yourself from identity theft:

• Freeze your credit proactively. You do not need to be a victim to freeze your credit. Millions of Americans keep their credit files frozen year-round, lifting them only when they need to apply for credit. This is the single most effective prevention measure available.
• Monitor your credit reports regularly. Check your credit reports from all three bureaus at least annually through AnnualCreditReport.com. Consider a free credit monitoring service that alerts you to new accounts or inquiries on your file.
• Protect your Social Security number. Do not carry your SSN card. Do not share your SSN unless absolutely necessary (employers, banks, the IRS). Ask why any organization needs it and whether there is an alternative identifier.
• Use strong, unique passwords. Use a password manager to generate and store unique passwords for every account. Enable two-factor authentication (2FA) on all financial accounts, email, and any service that holds your personal information.
• Be skeptical of unsolicited communications. The FTC reports that phishing remains the most common method of identity theft. Never click links in unsolicited emails, texts, or calls claiming to be from your bank, the IRS, or any government agency. Contact the organization directly through their official website or phone number.
• Shred sensitive documents. Shred any documents containing your SSN, account numbers, or personal information before disposal. This includes pre-approved credit offers, medical statements, and tax documents.
• Secure your mail. Use a locked mailbox or request mail hold when you are away. Thieves frequently steal mail to obtain financial statements, credit card offers, and tax documents.
• File your taxes early. Tax identity theft — where a thief files a fraudulent return using your SSN to claim your refund — is common. Filing early prevents a thief from beating you to it.

How Long Does Identity Theft Cleanup Take?

Be prepared: resolving identity theft and removing fraudulent debts is not a quick process. Here is a realistic timeline:

• Week 1-2: Place fraud alerts/credit freezes, file FTC report, file police report, contact affected companies.
• Week 2-4: Send dispute letters and affidavits to credit bureaus and creditors via certified mail.
• Week 4-8: Credit bureaus investigate (30-day window by law). Creditors review your fraud documentation and may close accounts.
• Week 8-12: Receive investigation results. Verify removals on updated credit reports. Escalate any accounts that were not removed.
• Months 3-6: Some cases require multiple rounds of disputes, CFPB complaints, or attorney involvement. Complex cases involving medical identity theft or tax fraud can take 6 months or longer.

Frequently Asked Questions