Someone Took Out a Personal Loan in My Name: What to Do Next

If you discover a personal loan or other credit account that you did not open, treat it as a potential identity-theft problem and move quickly, but do not send money or sensitive information to an unverified caller simply because they know your name or account details.

A practical recovery sequence is:

• 1. Verify what the unfamiliar account is using trusted records and independently located contact information.
• 2. Report identity theft at IdentityTheft.gov and keep the recovery documentation.
• 3. Freeze your credit at all three nationwide credit bureaus.
• 4. Consider adding a fraud alert.
• 5. Review all three credit reports for other unfamiliar accounts or inquiries.
• 6. Use the federal identity-theft blocking process for fraudulent credit-report information.
• 7. Contact the creditor or information furnisher through a verified fraud channel.
• 8. If a debt collector contacts you, verify the collector and the debt before paying.
• 9. Preserve letters, report numbers, screenshots, dates, and confirmation records.

The Consumer Financial Protection Bureau updated its identity-theft recovery guidance on August 3, 2026. It explains that a consumer can ask credit reporting companies to block fraudulent information by providing an identity-theft report, proof of identity, and a letter identifying the fraudulent information or debts.

An unfamiliar personal loan can appear in several ways:

• a new account on a credit report;
• a hard inquiry you do not recognize;
• a bill or collection notice for credit you never requested;
• an email or text about an account you did not open; or
• a debt collector calling about a loan you do not recognize.

The CFPB lists unfamiliar accounts, inquiries, bills, and debt-collector contacts among possible identity-theft warning signs.

But an unfamiliar name is not automatically proof of fraud.

A loan can be serviced or collected by a company whose name differs from the original creditor. A lender can also sell or assign an account. And credit-report entries can contain mistakes unrelated to identity theft.

Start by recording exactly what you see:

• company name;
• partial account number;
• opening date;
• reported balance;
• inquiry date;
• credit bureau where the item appears; and
• any phone number or address shown on an official report or statement.

Then locate the company's legitimate website or verified customer-service channel independently.

Do not use a phone number from a suspicious text merely because it looks convenient.

The FTC operates IdentityTheft.gov, a federal recovery resource for identity-theft victims.

The CFPB specifically identifies an identity-theft report from IdentityTheft.gov as one of the documents that can support a request to block fraudulent information on a credit report.

At IdentityTheft.gov, a consumer can report what happened and receive a recovery plan with steps tailored to the type of theft.

Keep copies or confirmation information from the report.

The report can become useful when dealing with:

• credit bureaus;
• creditors;
• debt collectors;
• banks or payment companies; and
• other organizations affected by the fraud.

Do not send your identity-theft report to CashPath. CashPath does not operate the creditor account and cannot process a bureau block on your behalf.

The FTC says a credit freeze is free, can be placed by anyone, and does not affect a credit score.

A freeze restricts access to a credit report so that a new creditor generally cannot open an account in your name while the freeze is in place.

To place a freeze, contact each of the three nationwide credit bureaus:

• Equifax;
• Experian; and
• TransUnion.

A freeze remains until you lift it.

If you later need a legitimate credit check, you can temporarily lift the freeze with the relevant bureau and restore it afterward.

A freeze helps stop new-account fraud, not every type of fraud

The CFPB warns that a freeze does not prevent an identity thief from taking over an account that already exists.

Continue monitoring:

• bank statements;
• credit-card accounts;
• email login alerts;
• mobile-phone accounts; and
• other financial or identity-sensitive services.

If an existing bank or card account was compromised, contact that institution using its verified fraud process.

A fraud alert and a credit freeze are not the same thing.

The FTC explains that an initial fraud alert tells businesses to verify identity before opening new credit, but it does not block access to the credit report.

An initial fraud alert is free and generally lasts one year.

To place an initial alert, you can contact one of the three nationwide credit bureaus. That bureau must notify the other two.

A person who has experienced identity theft may qualify for an extended fraud alert, which lasts longer and requires supporting identity-theft documentation.

You can use a fraud alert in addition to a freeze.

Do not confuse either tool with a paid “credit lock” product. The legal mechanisms and provider terms can differ.

Identity theft is not always limited to one account.

After finding one unauthorized loan, review your credit reports for:

• other accounts you do not recognize;
• unfamiliar hard inquiries;
• addresses you never used;
• phone numbers that are not yours;
• duplicate-looking debts;
• unexpected collection accounts; and
• incorrect balances or payment histories.

Use AnnualCreditReport.com or the official bureau channels rather than an unfamiliar website that asks for sensitive data.

Create a simple fraud inventory.

For each suspicious item, record:

• bureau;
• creditor or furnisher;
• account/inquiry identifier;
• date first noticed;
• action taken;
• confirmation number; and
• current status.

That list can keep a stressful recovery process from turning into a pile of disconnected phone calls.

The CFPB's August 3, 2026 guidance describes a specific process for fraudulent information caused by identity theft.

To ask a credit reporting company to block fraudulent debts or information, the consumer can submit:

• an identity-theft report, which can be completed through IdentityTheft.gov;
• proof of identity; and
• a letter identifying the fraudulent debts or information on the credit report.

CFPB says the credit reporting company must block qualifying fraudulent information within four business days after receiving the required request.

The bureau must also tell the companies that furnished the fraudulent information that the consumer reported identity theft.

This four-business-day rule should not be turned into a promise that every item a consumer disputes will disappear in four days.

CFPB also explains that a credit reporting company can refuse or remove a block if the information submitted is not correct or if the debt was not caused by identity theft.

Use the identity-theft blocking process for actual identity-theft information. Ordinary credit-report disagreements have a separate dispute process.

The credit bureau is not the only organization that may need to know about the fraud.

Contact the company that opened, owns, or reports the account through a verified fraud or identity-theft channel.

Ask what documentation it requires and where to send it securely.

Do not assume every company uses the same process.

Ask for written confirmation of:

• the fraud case or reference number;
• whether the account is frozen or under review;
• what documents were received;
• whether further collection or billing is paused, if applicable;
• whether the company will update the credit bureaus; and
• what follow-up date to use if no response arrives.

Keep copies of every document you send.

Avoid transmitting a Social Security number or full bank credentials through ordinary email unless you have independently verified that the company requires that method and you understand the security risk.

An identity thief may leave a fraudulent account that eventually goes to collection.

A scammer may also impersonate a collector.

Do not assume that a call is legitimate simply because the caller knows:

• your name;
• part of your Social Security number;
• an old address; or
• the amount of a reported debt.

The CFPB advises consumers to verify debt collectors and watch for red flags such as threats, refusal to provide basic company information, or demands for sensitive financial details.

Ask for the collector's:

• company name;
• mailing address;
• telephone number;
• creditor name;
• account reference; and
• validation information.

If the debt is the result of identity theft, use the identity-theft documentation and dispute/blocking process appropriate to the situation.

Do not pay simply to make a frightening call stop. Payment can complicate the record and does not substitute for resolving the underlying fraud.

A fraudulent personal loan can be accompanied by bank-account misuse.

For example, an identity thief might:

• change an account's payment destination;
• use stolen bank credentials;
• initiate unauthorized electronic transfers; or
• attempt to collect supposed “verification” fees.

Credit-bureau actions do not automatically fix bank-account fraud.

Contact the affected financial institution immediately through a verified channel and follow its fraud-reporting process.

The rules and deadlines for unauthorized bank transactions can differ from credit-report rules, so do not wait for a bureau dispute to finish before contacting the bank.

Identity-theft recovery often involves several organizations at once.

Keep one folder, digital or paper, containing:

• IdentityTheft.gov report information;
• copies of credit reports;
• bureau dispute/block requests;
• creditor fraud forms;
• collector letters;
• confirmation numbers;
• dates and times of calls;
• names or employee IDs when provided;
• screenshots of online submissions; and
• delivery confirmations for mailed documents.

Avoid storing unencrypted copies of highly sensitive documents in a shared or public folder.

A clean timeline makes it easier to explain what happened if a company asks for follow-up information.

Do not apply for several new loans to “rebuild” immediately

A new borrowing application does not remove an identity-theft account.

First stop the fraud and correct the file.

Do not pay an unknown person for a guaranteed deletion

A company that promises to erase any negative credit information for a fee may be selling a service it cannot lawfully guarantee.

Do not send identity documents to an unverified email address

Verify the recipient and process first.

Do not assume a credit freeze fixes an existing account takeover

A freeze primarily restricts new-credit access to the report. Existing accounts still need to be secured separately.

Do not assume CashPath can close the account

CashPath is not the lender, creditor, credit bureau, servicer, or debt collector. It cannot alter an independent provider's records.

Identity theft and debt status are separate questions.

A fraudulent account can still be labeled delinquent, charged off, or placed in collection before the fraud is resolved.

Do not interpret the status label as proof that the debt is yours.

Likewise, do not interpret “charge-off” as proof that no one can contact you about the account.

The right response is to document the identity theft, use the credit-report blocking process where applicable, and communicate with the creditor/collector through verified channels.

For more context about those debt-status labels, see Personal Loan Charge-Off vs. Collections. That guide does not replace the identity-theft recovery steps on this page.

CashPath can answer questions about the CashPath website and information it controls.

But CashPath cannot:

• reverse a third-party lender's credit decision;
• close a provider's account;
• remove a bureau tradeline;
• freeze your credit;
• validate a debt;
• alter a provider's repayment schedule; or
• accept identity-theft documents on behalf of a separate creditor.

If you believe someone misused the CashPath website, you can contact CashPath about the website issue. Do not email your Social Security number, bank credentials, passwords, full provider application, or copies of identity documents.

For an independent provider account, use that provider's verified fraud process.

Does a credit freeze hurt my credit score?

The FTC says placing or lifting a credit freeze is free and does not affect your credit score.

Do I need to contact all three bureaus for a credit freeze?

Yes. The FTC says to contact Equifax, Experian, and TransUnion separately to place a freeze.

Do I need to contact all three bureaus for a fraud alert?

For an initial fraud alert, the FTC says you can contact one bureau, and that bureau must notify the other two.

Will a freeze stop someone from using an existing account?

Not necessarily. The CFPB specifically warns that a freeze does not prevent identity thieves from taking over existing accounts. Secure affected bank, card, email, and other accounts separately.

How quickly can identity-theft information be blocked from a credit report?

The CFPB says credit reporting companies must block qualifying fraudulent information within four business days after receiving the required identity-theft request. The request needs the required documentation, and a block can be refused or removed if the information is incorrect or the debt was not caused by identity theft.

Should I pay a collector for a loan I never opened?

Do not send money to an unfamiliar collector simply because the caller demands payment. Verify the collector and debt, preserve the notice, and use the identity-theft and dispute processes that apply to the situation.

Can CashPath remove a fraudulent personal loan from my credit report?

No. CashPath is not a credit bureau, creditor, lender, servicer, or debt collector and cannot remove or modify a third-party account.

If a loan was opened in your name without permission, the first job is to stop additional fraud and build a clean paper trail. Use IdentityTheft.gov, freeze your credit, review all three reports, use the identity-theft blocking process when it applies, and deal only with verified creditors, bureaus, banks, and collectors.

If someone opened a loan in your name, the priority is fraud recovery, not another loan request.

Start with IdentityTheft.gov, freeze your credit, review your reports, and work through the verified creditor and bureau processes.

If you later choose to explore a legitimate personal-loan request after your identity and credit file are secure, compare any provider's disclosures carefully. CashPath is not a lender and does not guarantee a match, approval, amount, APR, fees, funding, or timing.

Last reviewed: September 11, 2026.