Credit Recovery After Identity Theft: The 12-Month Roadmap

Identity theft is one of the few credit problems where federal law actively works in the victim's favor. Once the right paperwork is on file, the Fair Credit Reporting Act forces the three credit bureaus to block fraudulent tradelines within four business days — and free, free, free is the operative phrase at every step.

The credit-recovery side of identity theft is a 12-month process. But the highest-leverage steps happen in the first 48 hours, and most consumers never take them because the process looks complicated from the outside. It's not — once you know the order.

Below is the roadmap: what to do in the first two days, what gets filed in the first thirty, how the FCRA § 605B block actually works, the freeze-vs-alert decision, and the monitoring routine for months two through twelve.

The first 48 hours

Five steps, in this order:

1. File an FTC Identity Theft Report at IdentityTheft.gov. This is the foundation. The site generates a personalized recovery plan based on what was stolen and a legal Identity Theft Report you'll need for almost everything that comes next — the bureau block, the extended fraud alert, the document requests from creditors. The site auto-generates pre-filled dispute letters and tracks your progress. Save the PDF in a permanent folder.

2. Place a free credit freeze at all three bureaus. (https://consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts), freezes are free, online or by phone, and effective within one business day. A freeze stops anyone from opening new credit in your name, even with your full information. Contact Equifax (888-298-0045), Experian (888-397-3742), and TransUnion (888-909-8872), or use each bureau's website.

3. Pull free credit reports from all three bureaus. AnnualCreditReport.com gives you free copies and is the only government-authorized source. Print or save the PDFs. Highlight every account, inquiry, or address you don't recognize. This list is what you'll block in step 4.

4. Call every creditor where fraud occurred. Get the fraudulent accounts marked as such on their end, get any charges reversed, and ask for the address and contact to send a written follow-up plus the FTC report. Many creditors have a dedicated identity-theft team — ask for it by name.

5. Change every password on every financial account and enable two-factor authentication. Assume any password that may have been exposed is compromised. Use a password manager so the new ones are actually unique.

(https://consumer.ftc.gov/articles/identity-theft), getting these five steps done in the first 48 hours sets up everything downstream. The longer fraudulent tradelines sit unblocked, the more secondary damage they create.

Days 3-30: blocks, freezes, and disputes

The first 48 hours stops the bleeding. Days 3 through 30 are the administrative work that gets the bureau reports clean.

Invoke FCRA § 605B blocking with each bureau. Send each bureau a packet containing your FTC Identity Theft Report, a copy of your driver's license or government ID, a clear list of every fraudulent tradeline (account number, creditor, amount, date opened), and a signed statement that none of those items relate to any transaction by you. Send by certified mail with return receipt. The bureau has 4 business days to apply the block.

Request fraudulent application documents. Under FCRA § 609(e), each affected creditor must give you — at no charge — copies of any application or transaction record relating to the fraudulent account. (https://www.consumerfinance.gov/ask-cfpb/what-do-i-do-if-i-think-i-have-been-a-victim-of-identity-theft-en-31/), these documents are essential both for the bureau block and for any later civil action. Send a written request to each creditor citing § 609(e) and including the FTC report.

File a police report if a creditor demands one or if your state requires it. The FTC Identity Theft Report alone is usually enough for the bureau block, but specific creditors sometimes ask for the local police paperwork. File once, save the report number, distribute as needed.

Place the 7-year extended fraud alert. With the FTC Identity Theft Report in hand, you qualify for a 7-year extended fraud alert at any one bureau (which then notifies the other two). The alert flags your file so lenders must verify your identity before opening new credit. This sits on top of your freeze — both run in parallel, and both are free.

By day 30, the bureau reports should show no fraudulent tradelines, the freeze should be live at all three bureaus, and you should have a paper trail of every action taken.

The FCRA § 605B block in detail

Most credit-recovery tools are slow. The § 605B block is a hard exception.

(https://www.law.cornell.edu/uscode/text/15/1681c-2), a consumer reporting agency must block the reporting of any information in a consumer's file that the consumer identifies as resulting from alleged identity theft within 4 business days of receiving:

1. Appropriate proof of identity.
2. A copy of an identity theft report (the FTC report from IdentityTheft.gov, or a police report).
3. The identification of the information to be blocked.
4. A statement that the information does not relate to any transaction by the consumer.

That's it. The bureau must block, must notify the data furnisher, and — this is the powerful part — once notified, the furnisher may not sell, transfer, or place that debt for collection.

§ 605B is stronger than the regular FCRA dispute process because it bypasses the furnisher's verify-or-delete answer. The bureau doesn't ask the furnisher whether the entry is accurate; it blocks the entry based on the consumer's documentation, then tells the furnisher to stand down.

Freeze vs. fraud alert

Both protect you, but in different ways. Most identity-theft victims use both.

Credit freeze: blocks new credit pulls entirely. A lender pulling your file gets a "frozen" response and cannot proceed. Free at all three bureaus, placed within 1 business day, lifted within 1 hour when you need to apply for legitimate credit. Permanent until you remove it. Strongest protection available.

Fraud alert: flags your file so that lenders are required to take "reasonable steps" to verify your identity before opening new credit. A 1-year alert is free with one call (the bureau notifies the other two). Identity-theft victims with an FTC Identity Theft Report qualify for a 7-year extended alert — free.

The standard recommendation: freeze for hard protection, extended fraud alert as a backup so the protection persists during the brief windows you lift the freeze for a legitimate application.

Months 2-6: monitoring and escalation

Pull credit reports from each bureau monthly during this window. AnnualCreditReport.com lets you pull each bureau separately, so spread them out (Experian week 1, Equifax week 2, TransUnion week 3) for near-continuous coverage at no cost.

If a blocked tradeline re-appears on your report — the furnisher re-reported it — file a second § 605B notice and a CFPB complaint at consumerfinance.gov/complaint. Re-reporting after a valid block is a serious furnisher violation; the CFPB complaint adds regulator attention to the bureau correspondence.

If a collector picks up a fraudulent debt despite the block (the block legally prohibits sale/transfer, but it occasionally happens), you can (/blog/how-to-write-a-debt-validation-letter-with-template) under the FDCPA as a backup. For any tradeline that needs the regular FCRA dispute process — say, an inaccurate but non-fraudulent entry that surfaces during the cleanup — our guide to how to (/blog/how-to-dispute-a-collection-account-2026) covers the standard process.

Document every call, every letter, every certified-mail green card. A simple spreadsheet — account, date opened, fraud type, action taken, date, response — is enough.

Months 6-12: rebuild and stabilize

By month six, fraudulent tradelines should be off the reports. Look at what's left.

If your credit was healthy before the identity theft and the blocks worked cleanly, your score will already have recovered. (https://www.experian.com/blogs/ask-experian/identity-theft-recovery-after/), scores typically rebound within 60-90 days of the § 605B block because the fraudulent items disappear from the calculation entirely — they aren't just disputed, they're gone.

If there's residual damage from collateral effects (missed payments while accounts were frozen, late fees on a fraudulent account that posted before you caught it), treat that like a normal rebuild: secured card if needed, perfect on-time payments, utilization under 10%.

Keep the freeze and the extended fraud alert in place. Both are free, neither affects your score, and identity thieves often come back to a profile they hit successfully once. At month 12, pull a full fresh report from each bureau and confirm no fraudulent items have crept back in. Re-file blocks for any that have.

Documents to request and keep

For each piece of fraudulent activity, build a permanent folder containing:

• The FTC Identity Theft Report (PDF download from IdentityTheft.gov).
• The local police report, if filed.
• Copies of every fraudulent application or transaction record requested from each creditor under FCRA § 609(e).
• All bureau correspondence — your packets out and the bureau responses back.
• Certified-mail receipts and green cards for everything sent.
• A spreadsheet listing every fraudulent tradeline: account, creditor, amount, date opened, date reported, status, dates of every action.

This folder is the foundation for any later civil action, any IRS dispute if the fraud included filed tax returns, and any reinstatement of the bureau block if something re-appears.

What you cannot do (and what scammers promise)

You can't use identity-theft claims to remove accurate negative items from your report. The § 605B block applies to fraudulent items — items that genuinely don't belong to you — not to accurate items you wish weren't there. A false claim is itself a federal offense.

You can't speed past the 4-business-day block window by paying any service. The bureau works on a statutory timeline; no one can move it faster.

Be cautious of services charging large monthly fees promising to "fix" your post-identity-theft credit. Most of what those services do is what IdentityTheft.gov does for free, and the FTC's playbook does it better. State law often layers on additional rights — most states cap or prohibit advance fees for credit-repair services. See our (/blog/alabama-credit-repair-law) overview for the rules where you live.

Frequently Asked Questions

How long does identity theft stay on my credit report?

Fraudulent tradelines blocked under FCRA § 605B come off within four business days of the bureau receiving your FTC Identity Theft Report and proof of identity. Tradelines you dispute through the regular process come off when the bureau or furnisher can't verify them, typically within 30 days.

Should I freeze my credit or just place a fraud alert?

Most identity-theft victims do both. A freeze blocks new credit pulls entirely — strongest protection. An extended seven-year fraud alert (free with an FTC Identity Theft Report) makes lenders verify identity before opening any new credit. The two together is the standard recommendation.

Will identity theft permanently lower my credit score?

Almost never, when handled correctly. Once the fraudulent tradelines are blocked under § 605B and removed from the report, scores typically recover within 60 to 90 days because the fraudulent items disappear from the calculation.

Do I need to file a police report?

Sometimes. The FTC Identity Theft Report from IdentityTheft.gov is enough for the bureau block and the extended fraud alert. A police report is required only if a specific creditor demands one, or if you need to invoke certain state-law remedies.

<script type="application/ld+json"> { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ {"@type": "Question", "name": "How long does identity theft stay on my credit report?", "acceptedAnswer": {"@type": "Answer", "text": "Fraudulent tradelines blocked under FCRA § 605B come off within four business days of the bureau receiving your FTC Identity Theft Report and proof of identity."}}, {"@type": "Question", "name": "Should I freeze my credit or just place a fraud alert?", "acceptedAnswer": {"@type": "Answer", "text": "Most identity-theft victims do both. A freeze blocks new credit pulls entirely. An extended seven-year fraud alert makes lenders verify identity before opening any new credit."}}, {"@type": "Question", "name": "Will identity theft permanently lower my credit score?", "acceptedAnswer": {"@type": "Answer", "text": "Almost never, when handled correctly. Once the fraudulent tradelines are blocked under § 605B and removed from the report, scores typically recover within 60 to 90 days."}}, {"@type": "Question", "name": "Do I need to file a police report?", "acceptedAnswer": {"@type": "Answer", "text": "Sometimes. The FTC Identity Theft Report from IdentityTheft.gov is enough for the bureau block and the extended fraud alert. A police report is required only if a specific creditor demands one."}} ] } </script>

Bottom line

Identity theft is uniquely well-handled by federal law. The combination of IdentityTheft.gov, the FCRA § 605B block, and the 7-year extended fraud alert is a powerful, free toolkit most consumers don't know exists. Used in the right order, in the first 48 hours, it limits damage to weeks rather than years.

Concrete first step today: open IdentityTheft.gov in a browser right now and start the recovery plan. Everything downstream depends on that report.