How to report credit report fraud and place fraud alerts

Fraud on a credit report means accounts, inquiries, or personal data you did not authorize. Reporting is a sequence: secure the files, document the theft, alert the bureaus and creditors, then dispute and rebuild. Freezes and alerts alone are not the whole job—see Credit freezes and fraud alerts for the lock mechanics.

First 24 hours: contain the damage

1. Pull all three reports at AnnualCreditReport.com (How to get a copy of your free credit reports). Save PDFs.
2. Freeze Equifax, Experian, and TransUnion so new accounts are harder to open.
3. Place an initial fraud alert (usually one year) at one bureau; it often propagates to the others.
4. Change passwords on email and financial accounts; turn on phishing-resistant MFA where available.
5. Call fraud lines for any account that is not yours using numbers from official issuer sites (Chase, Bank of America, Capital One, Amex, store-card banks such as Synchrony)—not numbers in a text.

If the pattern looks like mixed real/fake identity data, read How to spot synthetic identity fraud while you work the same freeze/alert steps.

File the identity-theft report

1. Complete the FTC identity-theft report and recovery plan at IdentityTheft.gov (FTC).
2. Keep the report PDF and affidavit-style materials the site generates.
3. File a local police report if creditors or bureaus request one, or if your state process expects it.
4. Use the FTC materials to request an extended fraud alert (often seven years) at the bureaus.

The FTC report is the backbone document for extended alerts and many creditor fraud investigations.

Tell the bureaus and dispute the junk

For each fraudulent item (account, collection, inquiry, address):

1. Dispute with Equifax, Experian, and TransUnion online or by mail; attach the FTC report and a clear list of what is not yours (How to dispute an error on your credit report).
2. Send a separate fraud notice to the creditor or collector that owns the tradeline; ask them to close the account as fraud and stop reporting it as yours.
3. Request written confirmation. Calendar 30-day follow-ups.

Authorized hard inquiries you did not make belong in the same dispute stack as fake accounts.

Worked example

Jordan finds a Capital One card and two hard inquiries on Experian that they never applied for, plus a new address in another state on Equifax.

Jordan’s same-day path:

1. Freezes all three bureaus; places a one-year fraud alert.
2. Downloads all three AnnualCreditReport.com files.
3. Files an FTC IdentityTheft.gov report naming the Capital One account and inquiries.
4. Calls Capital One’s fraud line from the back of a legitimate card (or the bank’s public site), reports the account, and requests fraud closure.
5. Disputes the card, inquiries, and false address with each bureau, attaching the FTC report.

Two weeks later Jordan upgrades to an extended fraud alert using the FTC materials and starts the longer rebuild checklist in How to rebuild after identity theft.

Who else to notify

What “reporting” does not do by itself

• It does not instantly clear scores or delete accurate accounts you opened.
• It does not refund every fraudulent charge without issuer investigation timelines.
• It does not replace monitoring statements for existing accounts (freezes mainly block new credit pulls).

Checklist

1. Freeze all three bureaus; place at least an initial fraud alert.
2. Save PDFs of Equifax, Experian, and TransUnion reports.
3. File IdentityTheft.gov and keep the report number.
4. Notify each fraudulent creditor’s fraud department in writing or recorded channels.
5. Dispute every fraudulent tradeline and inquiry with the bureaus.
6. Upgrade to an extended alert when eligible; follow the rebuild guide for long-tail cleanup.

Educational only. Not legal advice, credit advice, or an offer of credit. Procedures change; follow current FTC, CFPB, and bureau instructions.