Accounts you never opened, reported as though you did

What identity theft looks like on the report itself

Fraud shows up in patterns rather than a single line. The most common is a tradeline opened on a date you can account for elsewhere, carrying an address you have never used and a balance that grew quickly before charging off. Alongside it there is often a cluster of hard inquiries from lenders you never approached, dated within days of each other, because an application spree leaves a trail even where only one application succeeded. Collection agencies then appear later, sometimes two or three of them reporting the same underlying debt as it is sold along, which makes a single fraudulent account look like several.

The personal information section deserves as much attention as the accounts. Fraudulent activity frequently deposits an unfamiliar former address, a variant spelling of your name, or an employer you never worked for into the header of the file. Those identifiers are what allow new fraudulent data to keep matching to your record after the first accounts are removed, so a correction that ignores the header tends not to hold.

Common causes

• A data breach exposing a social security number, date of birth, and prior addresses, which is enough for most online applications.
• Account takeover, where an existing card or loan is redirected to a new address or email rather than a new account being opened.
• Synthetic identity fraud, in which a real social security number is combined with a fabricated name and date of birth, so the tradeline attaches only partially to your file.
• Familiar fraud, meaning a relative or household member who had access to your documents and used them, which is common and frequently the hardest for a consumer to report.
• Business identity theft, where a personal guarantee is forged on commercial credit and the resulting default is reported personally.

Documents to gather first

The strength of an identity theft claim is almost entirely a function of its documentation. Before anything is sent, collect government issued identification, proof of your current address, and all three reports pulled within the last thirty days so the record reflects the file as it stands today. Then add the identity theft report generated at IdentityTheft.gov, any police report or case number, the dates you first noticed each item, and copies of every letter, email, or portal message already exchanged with a creditor or bureau. A short written timeline of what you knew and when you knew it does more work than most consumers expect, because a clear sequence is what distinguishes fraud from a disputed but genuine obligation.

How the dispute and escalation process generally works

Two separate mechanisms exist and they are often confused. The ordinary dispute under section 1681i asks the bureau to reinvestigate an item, which it forwards to the furnisher for verification, generally within thirty days. The identity theft block under section 1681c-2 is different: on receipt of an identity theft report, proof of identity, and a clear identification of the fraudulent items, the bureau is directed to block that information from the file, generally within four business days, and to notify the furnisher. The block does not wait on the furnisher's own conclusion, which is why it is usually the stronger route where the documentation supports it.

Alongside those, a victim may request from the creditor the application and business transaction records connected to the fraudulent account. That request resolves a meaningful share of cases without further steps, because a creditor that cannot produce a signed application, an identity verification record, or a delivery address is in a poor position to insist the account is yours. Where the bureaus reject a block on technical grounds, or a furnisher re-reports blocked information, the matter escalates: a documented notice of the failure, a complaint to the Consumer Financial Protection Bureau, and where the conduct warrants it, a claim under the enforcement provisions of the statute.

When legal representation becomes appropriate

Many people successfully place a fraud alert, freeze their files, and clear one or two items on their own. Representation becomes worth considering when a bureau rejects a properly supported block, when an item is deleted and then reappears, when several furnishers are involved and each points at the others, or when the fraud has already affected a mortgage, lease, employment screening, or security clearance. Those situations call for correspondence written with litigation in mind rather than a portal submission.

No outcome can be promised. What can be said honestly is that the record built during these steps determines what remedies remain available later, and that records assembled after the fact are always weaker than records assembled as events occur.