A collection letter arrives for an account you never opened after your personal information was exposed in a breach.
Do not pay or admit the debt just to stop the calls
A collection notice can feel urgent, but an unfamiliar debt after identity theft needs verification before payment. CFPB guidance says collectors generally must provide validation information that helps you identify the creditor, account, amount, and deadline for disputing. Read that information before giving the caller more personal data or making a payment.
If the debt is truly not yours, paying a small amount to make the contact go away can complicate your paper trail. Keep the focus on whether the account belongs to you and whether it was created through identity theft.
Verify that the collector itself is real
Scammers sometimes impersonate collectors and use real breach information to sound convincing. Compare the company name, mailing address, creditor name, account number, and callback information with the written validation notice. If you need to call, find the collector’s official contact information independently rather than using a link in a threatening text.
Do not provide a full SSN, bank account number, or card details simply because a caller asks for identity verification. CFPB advises consumers to be cautious with sensitive information until they have verified both the debt and the collector.
Read the validation notice for the 30-day dispute window
CFPB says validation information generally includes an end date for a 30-day period when you can dispute the debt. If you dispute in writing within that period, the collector must pause collection of the disputed amount until it provides verification responding to your request.
Mark that date on your calendar the day the notice arrives. Even if you are also working with the original creditor or a credit bureau, do not let the collector’s deadline pass unnoticed. Separate processes can run at the same time.
Create or update your FTC Identity Theft Report
If the account was opened with stolen identity information, report the theft at IdentityTheft.gov and include the fraudulent debt. The FTC Identity Theft Report helps document that the problem is identity theft rather than a normal billing disagreement.
Keep copies of the FTC report, the collector’s validation notice, the original creditor information, and any credit-report entry for the account. These documents should tell the same story: you did not open the account, you discovered it after the theft, and you are disputing it through the proper channels.
Send a written dispute that identifies the debt clearly
Your dispute should identify the account or reference number, state that you do not owe the debt, and explain that it resulted from identity theft if that is what happened. Include copies of supporting records such as the FTC Identity Theft Report, but keep original documents in your own file.
Use a delivery method that gives you a record of submission. If the collector provides a secure online dispute portal, save the confirmation page. If you mail the dispute, preserve the mailing receipt and a complete copy of what you sent.
Understand what happens after a timely written dispute
CFPB guidance says a debt collector must stop collection activity on the disputed debt after a timely written dispute until it sends verification that responds to the dispute. That pause gives you a chance to review the creditor information and match it against your identity-theft records.
Verification does not automatically prove the debt is yours. If the collector sends documents for an account you never opened, continue the identity-theft process with the original creditor, the credit bureaus, and the collector. Keep each response because later complaints may depend on showing what evidence each company had.
Check whether the fraudulent debt appears on your credit reports
If the debt or original account is reporting to Equifax, Experian, or TransUnion, use the identity-theft blocking or dispute process as well. IdentityTheft.gov explains that victims have rights to remove or block fraudulent information and to stop creditors and collectors from reporting identity-theft accounts.
The collector dispute and credit-report cleanup are related but not interchangeable. Stopping collection contact does not necessarily remove a credit entry, and correcting a credit report does not automatically close the collector’s case file. Address both records.
Keep a contact log instead of relying on memory
Record the date, time, company, phone number, representative name, and result of each interaction. Save envelopes, emails, portal messages, verification packages, and dispute responses. Identity-theft cases often involve multiple transfers between a creditor, collector, bureau, and fraud department, so a chronological log prevents you from having to reconstruct the history later.
If a caller becomes aggressive, write down what was said rather than arguing about every detail in the moment. Your goal is to create a reliable record and move the dispute through formal channels.
Escalate when the process does not match the records
If a collector continues trying to collect despite a timely dispute without providing the required response, or if a credit bureau continues reporting identity-theft information after receiving proper documentation, review the complaint options available through the CFPB and FTC. Keep your documentation organized before submitting a complaint so the agency can see the timeline.
This site does not decide whether a collector violated a law or whether you have a claim for damages. Those are legal questions. The administrative goal here is to preserve the notice, use the dispute rights on time, and connect the account to the documented theft.
Example: a collection letter for a fraudulent store card
Suppose a collector sends a validation notice for a store card opened two months after your SSN was exposed. You never had the card. You verify the collector through its official website, compare the original creditor name with your credit report, and see the same fraudulent account reporting there.
You update your FTC Identity Theft Report, send the collector a written dispute before the notice deadline, dispute or block the account with the bureau, and contact the store-card issuer’s fraud department. Every confirmation goes into one folder. That coordinated record is far stronger than repeatedly telling different call-center agents that the debt is not yours.
