Identity-Theft Red Flags on Your Credit Report

Identity theft typically leaves a paper trail on your credit report before it causes major financial damage. Recognizing the signs early is the difference between catching it at the inquiry stage and discovering it after several accounts have been opened and used.

This post walks through the specific patterns that indicate identity theft, the FCRA pathway for responding, and the order in which to take action.

This is educational. None of it is legal advice or financial advice.

Pattern 1: Hard inquiries you didn't authorize

What it looks like: a hard inquiry from a lender or company you've never applied with, on a date you didn't apply for credit.

Why it matters: a hard inquiry typically precedes an account opening. If the inquiry is fraudulent, the corresponding account application may have been approved (or may still be pending). Catching it at the inquiry stage gives you a window before any accounts are opened.

What to do:

1. Verify the inquiry isn't from a parent company or affiliate of a lender you have applied with (sometimes Experian shows a "lender name" different from the brand you applied with)
2. If still unrecognized, contact the lender directly to ask why they pulled your credit
3. If the lender confirms an application was made that you didn't authorize, report it as fraud
4. File a fraud alert with one bureau (which automatically alerts the other two)
5. Consider freezing your credit at all three bureaus

Pattern 2: New accounts you didn't open

What it looks like: a tradeline appears on your report for a new account you didn't apply for. The account number is unfamiliar and the opening date is recent.

Why it matters: a new fraudulent account is identity theft in progress. The thief may already be using the account to incur charges that will eventually become your problem if not addressed.

What to do:

1. File an Identity Theft Report at https://www.identitytheft.gov — this is the FTC's central toolkit and produces a document the bureaus accept
2. Contact the issuer of the fraudulent account directly (using contact information from the issuer's official website, not from the credit report)
3. Request the issuer close the account and remove it from your credit report
4. Place an extended fraud alert (7 years) at any one bureau (alerts the other two)
5. Consider freezing your credit at all three bureaus
6. File a § 1681c-2 identity-theft block dispute with the bureaus, attaching the FTC Identity Theft Report

Pattern 3: Personal information you don't recognize

What it looks like: in the personal-information section at the top of your report, names you've never used, addresses you've never lived at, or employers you've never worked for.

Why it matters: this can indicate identity theft (someone using your SSN with their own contact information) or mixed-file error (data from another consumer commingled with yours). Both are problems but they have different fixes.

What to do:

1. Determine whether the unfamiliar information could plausibly be an identity-theft pattern (the address is one a thief might use to receive fraudulent mail) or a mixed-file pattern (the address is one another consumer with similar identifiers might have lived at)
2. If identity-theft pattern, follow the identity-theft pathway above
3. If mixed-file pattern, follow the mixed-file dispute pathway under § 1681i with explicit "file separation" framing

Pattern 4: Address history that doesn't match your records

What it looks like: a list of prior addresses that includes places you don't recognize. Or a current address that's not where you actually live.

Why it matters: thieves sometimes update an address with a creditor to redirect statements and notifications. If your address history shows an address you didn't live at, your account may have been compromised at the time the address was added.

What to do:

1. Contact the creditor where the address was added and verify whether your account was modified
2. If your account was modified without your authorization, treat it as identity theft
3. Update your contact information directly with each major creditor to ensure future communications reach you
4. Place a fraud alert and consider freezing credit

Pattern 5: Account that's marked closed when it's still open (or vice versa)

What it looks like: an account you're using shows as closed; or an account you closed shows as open.

Why it matters: this can indicate furnisher error (most common) but it can also indicate that someone has reopened a closed account in your name (rare but possible). It's worth verifying the account status with the issuer directly.

What to do:

1. Contact the issuer to confirm the actual status
2. If the issuer's status differs from the credit report, dispute the report under § 1681s-2(b)
3. If the issuer reports the account is open but you didn't reopen it, treat as identity theft

Pattern 6: Public record you don't recognize

What it looks like: a bankruptcy, judgment, or tax lien on your report that doesn't apply to you. Most civil judgments and tax liens were removed from major reports in 2017, but some remain. Bankruptcies remain.

Why it matters: a bankruptcy filed in your name without your knowledge is severe identity theft — both for credit purposes and for legal purposes. It requires immediate action.

What to do:

1. Contact the court that issued the public record to verify whether you were named
2. If you were not named, request court records showing the actual party
3. Dispute the public record with the bureau under § 1681i, attaching the court records
4. If you were fraudulently named in the proceeding, file a police report and an Identity Theft Report
5. Consult a consumer-protection or family-law attorney

Pattern 7: Multiple inquiries from a specific industry in a short window

What it looks like: a cluster of inquiries from card issuers, payday lenders, or auto lenders in a 3-7 day window — none of which you authorized.

Why it matters: identity thieves typically apply for multiple lines of credit quickly to maximize the value extracted before the fraud is detected. A cluster of unauthorized inquiries often precedes multiple new accounts.

What to do:

1. File a fraud alert immediately (any one bureau, alerts all three within 24 hours)
2. File an Identity Theft Report at https://www.identitytheft.gov
3. Consider freezing credit at all three bureaus
4. Monitor each bureau for new accounts that may follow the inquiries
5. Contact each lender that pulled your credit to verify whether an application was submitted

Order of operations after suspecting identity theft

When you've spotted any of these patterns and believe identity theft is likely:

Step 1 (immediate). Place a fraud alert at any one bureau — they will notify the other two. Initial fraud alert lasts 1 year and is free.

Step 2 (same day). File an Identity Theft Report at https://www.identitytheft.gov. This produces an official document.

Step 3 (within 1 week). File a police report. Some bureaus and creditors require this for certain identity-theft remedies.

Step 4 (within 1 week). Place credit freezes at all three bureaus. Free under § 1681c-1.

Step 5 (within 30 days). Dispute fraudulent items under § 1681c-2 (identity-theft block) with the FTC Identity Theft Report attached. Items must be blocked within 4 business days of receipt.

Step 6 (ongoing). Monitor your credit reports monthly using the free reports available under fraud-alert and identity-theft-victim provisions. Use the additional free reports to verify the fraudulent items are being removed and no new fraudulent activity is appearing.

Step 7 (if needed). Consult a consumer-protection attorney if specific items are difficult to remove or if the identity theft has caused actual financial damage that may support legal action.

When to use § 1681c-2 (identity-theft block) vs. § 1681i (ordinary dispute)

§ 1681c-2 is faster (4 business days vs. 30 days) but has stricter requirements:

• Requires an Identity Theft Report (typically from https://www.identitytheft.gov)
• Items must result from identity theft (not mere errors or mixed file)
• Bureau can decline if the consumer hasn't provided sufficient documentation

§ 1681i is slower but applies to any dispute:

• 30-day investigation window (45 with additional information)
• No Identity Theft Report required
• Investigation result depends on furnisher response

For confirmed identity theft with documentation, use § 1681c-2 first. For ambiguous cases (might be identity theft, might be mixed file, might be furnisher error), use § 1681i.

Related reading

• Cluster A09: Credit freezes and fraud alerts
• Cluster D02: Mixed-file errors: why they happen
• Cluster A02: Your right to a free credit report
• Customer KB: Fraud and identity theft help

Sources cited

• 15 U.S.C. § 1681c-1 — https://www.law.cornell.edu/uscode/text/15/1681c-1
• 15 U.S.C. § 1681c-2 — https://www.law.cornell.edu/uscode/text/15/1681c-2
• 15 U.S.C. § 1681i — https://www.law.cornell.edu/uscode/text/15/1681i
• IdentityTheft.gov — https://www.identitytheft.gov
• CFPB consumer-reporting guidance — https://www.consumerfinance.gov

Educational content. Identity-theft procedures vary by situation. Cite specific facts to a credit-repair or consumer-protection attorney.