What this answers
On this page
One stolen Social Security number rarely produces one fraudulent account. It produces a cascade, and the cascade is driven less by the thief than by how the credit system decides which file incoming data belongs to.
A Predictable Failure, Not Bad Luck
Identity theft is a regular feature of the consumer reporting system rather than a freak event. Someone obtains your Social Security number, account number, card number, or PIN, and uses it to obtain credit in your name before you know anything happened.
What makes it compound is the architecture. Reports are issued and credit is extended through highly automated channels built for speed. Verification costs money and loses sales, so the tolerances are set accordingly.
The Detail Most Consumers Miss
A thief usually does not submit your complete and accurate information. They cannot: an application carrying your real address sends the new card to your mailbox.
So they submit a hybrid. Your Social Security number, a variation of your name, their address, their phone number. Sometimes a transposed digit, sometimes a middle initial you have never used, sometimes a first name close to their own.
That hybrid is the seed of everything that follows.
How the Snowball Forms
The hybrid application generates an inquiry, and the data goes to a bureau carrying a mix of your identifiers and the thief's. The bureau's matching algorithm has to decide whose file it belongs to, and the algorithms are built to err toward inclusion, because dropping legitimate data is treated as the worse error.
So it matches to you. And now something has changed that is worse than one bad account: the thief's address and the altered name version are attached to your file as known identifiers for you.
From that point the file does the thief's work. Every future item carrying that address or that name variation matches back to you automatically. A second account, then a third. A collection. A public record. None of it requires the thief to do anything new.
This is why victims describe it as spreading. It is not that the thief kept targeting them. It is that the file learned to accept the thief's identifiers as theirs.
Why Speed Matters So Much
The intervention that matters is the one that happens before the identifiers settle in.
- A freeze stops new accounts from being opened at all, which cuts off the source of new hybrid applications
- A block under section 605B, 15 U.S.C. § 1681c-2, obliges a bureau to remove the identified fraudulent information, generally within four business days of a complete request
- Correcting the identifiers, the wrong address and the name variation, is what stops the matching from happening again
Most victims do the first two and skip the third, and that is why accounts keep reappearing months after everything was supposedly resolved. Removing the account without removing the address that attracted it leaves the mechanism intact.
What to Do, In Order
- Freeze all three files first. It is free, and it closes the door while you work on everything else.
- File an identity theft report at IdentityTheft.gov. It is the document the rest of your rights depend on.
- Pull full file disclosures from all three bureaus and read the personal information section, not just the accounts.
- List every name variation and address that is not yours. Those are the targets.
- Send block requests naming each fraudulent item specifically, and ask in the same letter that the incorrect identifiers be removed.
- Dispute with each bureau separately. A correction at one does not travel.
- Pull the reports again a month later and confirm nothing came back.
When It Keeps Happening
An account that reappears after being blocked, or a new account arriving at the same wrong address months later, is not the thief being persistent. It is a sign the file still carries the identifiers that let the match happen, or that the furnisher kept sending the same monthly data after being told.
Both are specific failures with specific remedies, and both are provable only from dated reports taken before and after. Keep every report, every letter, and every receipt.
Catching It Early
Everything about this problem is easier before the thief's identifiers settle into your file, which is an argument for a small amount of routine attention rather than a large amount of later effort.
The earliest signals are rarely dramatic. A piece of mail for someone at your address with a name close to yours. A collection call about an account you do not recognise, which you dismiss as a wrong number. A denial that does not match your credit history. A verification quiz asking about a lender you have never used.
Each of those is the system telling you something has already attached to your file. Treating any of them as a reason to pull all three reports costs an hour and can save months.
Breaking the Chain
If it has already started, the order of operations matters, because some steps stop the spread and some only clean up after it.
Freeze first. It is the only step that stops new accounts while you work, and it is free.
Then the identity theft report, because the remedies that follow all require it.
Then full file disclosures from all three bureaus, read for the personal information section first. You are looking for the addresses and name variations that do not belong to you, because those are the magnet.
Then block requests naming each fraudulent item, and in the same letter, a request to remove the incorrect identifiers.
Then the check a month later. An account that reappears, or a new one at the same wrong address, means the magnet is still there.
Common Questions
How does identity theft spread across my credit file?
A thief submits a hybrid application carrying some of your identifiers and some of their own. The bureau's matching software attaches it to your file, and the thief's address and name variation become known identifiers for you. Every later item carrying those details matches back automatically.
Why does fixing one fraudulent account not stop the others?
Because removing an account does not remove the incorrect address or name variation that caused it to land. The identifiers are what keep attracting data, so they have to be corrected too.
What should I do first?
Freeze all three files. It is free, it stops new accounts immediately, and it buys you time to work through everything else.
How fast can the bureaus remove fraudulent information?
Can one breach really cause years of problems?
Yes, because a Social Security number cannot be reissued the way a card number can, and data from a breach stays in circulation. That is why a seven year extended fraud alert exists.
How will I know it has stopped?
Pull all three reports a month after you think it is resolved, and again a few months later. Nothing new, and nothing returning, is the only real confirmation.
Should I close the accounts the thief opened?
You cannot close an account that was never yours, and you should not try to take ownership of one in order to close it. Report it as fraudulent and have it blocked, which removes it rather than leaving a closed fraudulent account on your history.
Does a police report help?
It can, and an FTC report from IdentityTheft.gov is sufficient for FCRA purposes. Where the thief is identifiable, or the amounts are large, a police report is worth having as well.
How long does recovery usually take?
Months rather than weeks, and expect at least one item to need a second round. That is not a sign you did it wrong; it is a sign the process resists exactly this.
Can I be sued for a debt the thief ran up?
A collector can attempt it, which is why responding in writing with your identity theft report matters rather than ignoring the letters. Never let a suit go undefended on the basis that the debt obviously is not yours.