Disputing a Credit Report Error and Recovering From Identity Theft: A Practical Checklist

Consumer Protection > Credit Reporting and Identity Theft | Published 26 November 2025 - Updated 26 July 2026 | UpLaw - uplaw.us

How to Use This Checklist

Parts 1 through 5 fix an error. Parts 6 through 9 respond to identity theft. Parts 10 through 12 cover escalation. Doctrine behind any item is in the comprehensive guide; the narrative introduction is how credit reporting and identity theft actually work.

⚠ The one rule that changes outcomes. Dispute with the credit bureau, in writing, with documents. A phone call to the creditor feels faster, creates no record, starts no clock, and generally creates no legal claim.

Part 1 — Get Everything

☐ Request your file from all three nationwide agencies under 15 U.S.C. § 1681g, which entitles you to all information in the file, its sources, and everyone who obtained a report about you.

☐ Use your free annual disclosures and any additional free reports you are entitled to under 15 U.S.C. § 1681j — after an adverse action, after placing a fraud alert, as an identity theft victim, while unemployed and seeking work, or while receiving public assistance.

☐ Request specialty reports as well: tenant screening, employment screening, insurance claim history, bank account screening, and check verification.

☐ Keep every adverse action notice. It names the agency and starts a sixty-day window for a free report under 15 U.S.C. § 1681m.

☐ Save the report as a dated file, not a browser session. You will need to prove what it said on a given day.

Part 2 — Read the Report Field by Field

☐ Personal information: name variants, Social Security number, date of birth, current and prior addresses, employers. An address you have never lived at is the leading sign of fraud or a mixed file.

☐ Account ownership: is every account yours? Look for accounts belonging to a relative with a similar name.

☐ Balances and status: paid, closed, charged off, in collection, disputed.

☐ Payment history month by month: a single late payment reported in the wrong month can matter.

☐ Date of first delinquency on every negative item. Compare it to your own records. A date later than when you actually stopped paying is re-aging, and the seven-year period under 15 U.S.C. § 1681c runs from the true date.

☐ Duplicate reporting: the same debt appearing as both an original account and a collection with a balance on each.

☐ Public records: judgments and bankruptcies, checked against the actual court disposition.

☐ Inquiries: every entry is a person or company that obtained your report. Anyone without a permissible purpose under 15 U.S.C. § 1681b has violated the statute.

☐ Discharged debts: anything discharged in bankruptcy should show a zero balance and discharged status.

☐ Write down each error with the creditor name, partial account number, the field that is wrong, and the correct value.

Part 3 — Assemble the Evidence

☐ Identity documents: government photo identification and a utility bill or bank statement showing the current address. Insufficient identification is the most common reason disputes are rejected.

☐ For a balance or status error: statements, cancelled checks, payoff letters, settlement agreements.

☐ For a discharged debt: the bankruptcy petition schedule listing the debt and the discharge order.

☐ For a judgment or public record error: the certified court disposition.

☐ For an account that is not yours: identity documents plus, if applicable, an identity theft report.

☐ For a mixed file: documents establishing your identifiers and, where known, the identifiers of the person whose data was merged.

☐ For re-aging: the original creditor's statements showing the true date of first delinquency.

☐ Keep originals; send copies.

Part 4 — Send the Dispute

☐ One letter per agency, addressing every item on that agency's report.

☐ Include full identification: name, current and prior addresses for five years, date of birth, and partial Social Security number, with copies of identity documents.

☐ One paragraph per item, identifying it exactly as it appears on the report.

☐ State the specific field that is wrong and the correct value. Not "this is inaccurate."

☐ Describe each attachment and what it proves.

☐ Demand deletion or correction, written results, and a free copy of the revised report under 15 U.S.C. § 1681i.

☐ Reference the agency's duty to follow reasonable procedures to assure maximum possible accuracy under 15 U.S.C. § 1681e and to forward all enclosed materials to the furnisher.

☐ Send by certified mail with return receipt, or another method producing proof of delivery. Avoid portals where possible; they narrow the dispute to a menu code.

☐ Calendar thirty days from receipt, extended to forty-five if you send more information during the period.

☐ Do not include legal threats, statutes that do not apply, or credit repair boilerplate. These invite a frivolousness determination.

Part 5 — When the Results Come Back

☐ Read the results carefully. "Verified as accurate" without addressing your documents means the reinvestigation did not consider what the agency was required to consider.

☐ Request a description of the procedure used, which the agency must provide on request.

☐ Check whether the item changed on all three reports. Correcting one agency does not correct the others, although a furnisher that finds information inaccurate must correct it with all agencies it reported to under 15 U.S.C. § 1681s-2.

☐ Send a second dispute enclosing the first letter, the response, and a statement of exactly what was not investigated. This sequence is what supports a willfulness theory under 15 U.S.C. § 1681n.

☐ Add a statement of dispute to the file if the item remains.

☐ Watch for reinsertion. If a deleted item returns, the agency must notify you within five business days and must have certification from the furnisher.

☐ If the error caused a denial, get the denial in writing with the terms you would otherwise have received. That document is the damages evidence.

Part 6 — Identity Theft: The First Day

☐ Freeze all three files immediately. Free, reversible, and the only measure that prevents new-account fraud rather than detecting it after the fact.

☐ Freeze specialty agency files too where freezes are offered — bank account screening and check verification in particular.

☐ Place an initial fraud alert under 15 U.S.C. § 1681c-1. One agency must refer it to the others.

☐ Change passwords and enable multi-factor authentication on email first, then financial accounts. Email is the recovery channel for everything else.

☐ Call each institution where a fraudulent account exists and ask them to close it as fraud — then follow up in writing.

☐ Write down a timeline of what you noticed and when. You will be asked repeatedly.

☐ Do not pay anything on an account that is not yours to make collection calls stop.

Part 7 — Build the Identity Theft Report

☐ File a report with law enforcement and obtain a copy with a report number.

☐ Complete a sworn identity theft affidavit describing each fraudulent account, the amounts, and the dates.

☐ Together these constitute your identity theft report — the document that unlocks blocking, extended alerts, and records access.

☐ Make several certified copies. You will send them to agencies, furnishers, collectors, and possibly a court.

☐ Place an extended fraud alert under 15 U.S.C. § 1681c-1, which lasts seven years, removes you from prescreened lists for five, and entitles you to additional free disclosures.

☐ If you are a deployed servicemember, use the active duty alert instead; the servicemember framework more broadly is in servicemember protections.

Part 8 — Block, Don't Just Dispute

☐ Send a block request to each agency under 15 U.S.C. § 1681c-2, enclosing proof of identity, the identity theft report, identification of each item, and a statement that the information does not relate to any transaction by you.

☐ Calendar four business days. Blocking is far faster than the thirty-day reinvestigation under 15 U.S.C. § 1681i, and it also bars the furnisher from selling, transferring, or placing the debt for collection.

☐ Send the same package to each furnisher, with a demand that it cease reporting.

☐ Request the account application and transaction records from every business that opened a fraudulent account, enclosing proof of identity and the identity theft report. These records often identify the perpetrator.

☐ Ask that copies also go to the investigating law enforcement agency.

☐ Track every request and response in a log with dates.

Part 9 — Collectors, Lawsuits, and Aftershocks

☐ Respond in writing to any collector on a fraudulent debt, enclosing the identity theft report and demanding that collection cease and that reporting be corrected.

☐ Never ignore a lawsuit. A default judgment on a fraudulent debt is far harder to undo than a defense filed on time; the mechanics are in debt buyers and default judgments.

☐ Check for tax-related identity theft if a return is rejected as already filed.

☐ Check for medical identity theft by requesting an accounting of disclosures and reviewing explanations of benefits; the records framework is in patient rights and medical records.

☐ Check for criminal identity theft if an arrest or conviction appears in a background check.

☐ Check bank account screening files, which can prevent you from opening an account anywhere.

☐ Re-pull all reports at ninety days and again at six months. Fraudulent items reappear.

Part 10 — Specialty Reports

☐ Tenant screening: request the file, check for eviction filings that were dismissed or resolved in your favor, and dispute in writing. Housing consequences are described in landlord and tenant law.

☐ Employment screening: if a job was denied, confirm you received a pre-adverse action notice with a copy of the report and a reasonable opportunity to respond, as required under 15 U.S.C. § 1681m. Check for expunged or sealed records and for charges reported without dispositions. The employer's obligations are set out in running background checks under the FCRA.

☐ Insurance claim history: check for inquiries recorded as claims and for claims attributed to the wrong policyholder.

☐ Bank account screening: dispute unpaid overdrafts you paid, and closed accounts you closed yourself.

☐ Medical information exchange: request the file if you have been declined for individual life or disability coverage.

☐ Utility and telecom: check before a deposit demand, not after.

Part 11 — If the Reinvestigation Fails

☐ Assemble the complete file: every report version, every dispute with proof of mailing, every enclosure, every response, every adverse action notice, and every application record.

☐ Confirm dissemination. The inquiry section proves the report was actually furnished to someone — the factor that mattered in TransUnion v. Ramirez, 594 U.S. 413 and Spokeo v. Robins, 578 U.S. 330.

☐ Quantify the harm: denials, rate differentials, deposits required, housing or employment lost, time spent, out-of-pocket costs, and the effect on you personally.

☐ Identify each potential defendant: the agency under 15 U.S.C. § 1681e and 15 U.S.C. § 1681i; the furnisher under 15 U.S.C. § 1681s-2; a user under 15 U.S.C. § 1681b or 15 U.S.C. § 1681m.

☐ Check the deadline. 15 U.S.C. § 1681p allows the earlier of two years from discovery or five years from the violation.

☐ Consult a consumer attorney. Fee-shifting under 15 U.S.C. § 1681n and 15 U.S.C. § 1681o means meritorious cases are usually taken on contingency.

Part 12 — Ongoing Habits

☐ Keep the freezes on. Lift temporarily when you apply for credit, then re-freeze.

☐ Freeze your children's files and check whether one exists at all — a minor's file is almost always evidence of fraud.

☐ Rotate report pulls across the three agencies so you see problems within months.

☐ Re-check the date of first delinquency on any remaining negative item each year.

☐ Keep every adverse action notice and every dispute file for at least five years.

☐ Opt out of prescreened offers if you do not want them; the offers themselves are lawful, but each one is a file access.

☐ Treat every breach notice as a signal to freeze, not merely to enroll in monitoring.

Part 13 — Situation Playbooks

The report shows an account belonging to a relative with the same name

☐ Do not use the online portal. Automated verification will confirm the account is accurate — because it is, for the other person. ☐ Send a written dispute enclosing your driver's license, Social Security card, and two proofs of address. ☐ State explicitly that the file contains information belonging to a different individual, and identify the distinguishing data points: middle name, suffix, date of birth, Social Security number, and address history. ☐ Ask the agency to describe the procedure it used, and to explain how the file was matched. ☐ If the item returns after deletion, note the date; reinsertion requires certification and notice within five business days under 15 U.S.C. § 1681i. ☐ Repeat mixing after correction is the strongest willfulness pattern in this field; preserve every round.

A collection appears for a debt you paid years ago

☐ Pull the original creditor's statements and locate the true date of first delinquency. ☐ Compare it to the date reported. A later date restarts a seven-year clock that should have expired under 15 U.S.C. § 1681c. ☐ Dispute both the balance and the date, enclosing proof of payment. ☐ Send a parallel written dispute to the collector demanding validation; the two tracks reinforce each other and are described in consumer credit reporting and debt collection. ☐ Do not make a payment or acknowledge the debt before checking whether doing so revives a limitations period in your state.

A job offer disappeared after a background check

☐ Confirm whether you received a pre-adverse action notice with a copy of the report and a summary of rights, and whether you were given a reasonable period to respond before the decision became final, as 15 U.S.C. § 1681m requires. ☐ Request the report directly from the screening company; you are entitled to it. ☐ Check for records that were expunged, sealed, or resolved without conviction, and for charges reported without dispositions. ☐ Check whether the record belongs to a different person with a similar name. ☐ Dispute in writing with the screening company and ask that the corrected report be sent to the employer. ☐ Ask the employer, in writing, to reconsider once the report is corrected.

A landlord denied your application

☐ Ask which screening company supplied the report; the adverse action notice must tell you. ☐ Request the file and check for eviction filings that were dismissed, settled, or decided in your favor. ☐ Obtain the certified court disposition and dispute with the documentation attached. ☐ Ask the landlord to reconsider in writing once corrected, and keep the denial as damages evidence.

You receive a data breach notice

☐ Freeze all three files the same day. Monitoring detects; freezing prevents. ☐ Change the password on the breached account and on any account sharing that password, starting with email. ☐ Place an initial fraud alert if you have any reason to suspect misuse. ☐ Do not enroll in a paid product before checking whether the free measures cover the risk. ☐ Watch for account-opening notices and for mail that stops arriving, which can indicate an address change fraud.

Part 14 — The File to Keep

☐ Every report version, dated, from every agency and specialty agency. ☐ Every dispute letter, its enclosures, and proof of mailing. ☐ Every agency response and every furnisher response. ☐ Every adverse action notice, denial letter, and rate quote. ☐ The identity theft report, police report number, and affidavit. ☐ Every block request and confirmation. ☐ Account application and transaction records obtained from businesses. ☐ A dated log of every call: who, when, what was said, and what was promised. ☐ Evidence of harm: denied applications, deposits demanded, housing or employment lost, hours spent, and out-of-pocket costs.

⭐ Why this file matters more than any argument. Credit reporting cases are decided on documents. The consumer who can produce a dated sequence showing what was sent, what was ignored, and what it cost is in an entirely different position from the consumer who remembers a phone call.

Part 15 — For Employers, Landlords, and Small Lenders

If you obtain reports about other people, this section is your side of the checklist.

☐ Name the permissible purpose before you pull. The list at 15 U.S.C. § 1681b is exclusive, and curiosity, a favor for a friend, and vetting a business partner are not on it.

☐ For employment, use a standalone disclosure. A document consisting solely of the disclosure — not combined with the application, a liability release, or an arbitration agreement.

☐ Obtain written authorization before ordering the report.

☐ Send a pre-adverse action notice with a copy of the report and the summary of rights, and wait a genuine period before finalizing the decision.

☐ Send the adverse action notice with the agency's name, address, and telephone number, a statement that the agency did not make the decision, and notice of the right to a free copy and to dispute, per 15 U.S.C. § 1681m.

☐ Include score disclosures where a score was used and disclosure is required.

☐ Act on a notice of address discrepancy by forming a reasonable belief that the report relates to the person you are dealing with, under 16 C.F.R. Part 641.

☐ If you furnish data to an agency, adopt written accuracy and dispute procedures as required by 16 C.F.R. Part 660 and 12 C.F.R. Part 1022, and investigate the underlying records rather than confirming your own transmission.

☐ If you extend credit or maintain covered accounts, maintain an identity theft prevention program under 16 C.F.R. Part 681, approved and periodically updated.

☐ Dispose of reports securely, and restrict internal access to those who need it.

☐ Do not become an accidental consumer reporting agency by compiling and sharing tenant or employee histories with peers; the definition at 15 U.S.C. § 1681a turns on what you do, not what you call it.

☐ Train whoever pulls reports, and audit the inquiry log periodically. Impermissible-purpose claims are among the easiest for a plaintiff to prove, because your own inquiry entry is the evidence.

Part 16 — What Not to Do

☐ Do not pay a credit repair company to dispute for you. Everything they can do, you can do for free, and advance-fee arrangements are heavily restricted. Their templates also tend to trigger frivolousness determinations.

☐ Do not dispute accurate items to see what falls off. A pattern of unsupported disputes undermines the credibility of the real one and can justify an agency's refusal to reinvestigate.

☐ Do not close old accounts to "clean up" the file. It usually reduces available credit and shortens average account age.

☐ Do not pay a collector to delete an entry without getting the agreement in writing first, including exactly what will be reported afterward.

☐ Do not let a lawsuit go by default. Undoing a default judgment is far harder than answering on time.

☐ Do not rely on a phone promise. If it is not in writing, it did not happen.

---

Related Documents

• The File That Follows You: How Credit Reporting and Identity Theft Actually Work
• Credit Reporting and Identity Theft: A Comprehensive Guide to Disputes, Freezes, and Damages
• The Credit Report Dispute and Identity Theft Recovery Toolkit
• Disputing a Credit Report Error and Defending a Debt Collection Suit: A Practical Checklist
• FDCPA Debt Collection Compliance: A Practical Checklist
• Building a Privacy Compliance Program: A Practical Checklist