Your credit report is the document where identity theft becomes visible: every account opened in your name, every address a lender associates with you, every time someone pulled your file. Most people have never read theirs, partly because an industry works hard to sell them substitutes. This guide is the ten-minute version, and it starts with where to get the real thing.
The one official source
Federal law entitles you to free reports from all three bureaus through exactly one site: AnnualCreditReport.com. Despite the name, weekly access is now permanent. Everything else in the search results, including sites with confusingly similar names offering "free" reports that require a card number for a trial, is marketing. You never need a credit card to get the report the law already gives you. Note also that the report is not the score: the three-digit number is a product derived from the report, and for fraud-spotting purposes the report is what matters.
The ten-minute scan, four sections
Personal information. Read the addresses and name variants on file. An address you never lived at is one of the earliest fraud tells: it usually means an account application listed it, and it predates the collection letters by months. Same for employers you never had.
Accounts. Read every open account name and opening date. You are looking for anything you do not recognize: a card, a phone plan, a financing line. Do not skim past retail names; fraudulent accounts are often small and boring on purpose, because boring survives longer. This is the section where SSN misuse physically appears.
Hard inquiries. Each one records someone pulling your file to grant credit. An inquiry you did not trigger means someone applied in your name, even if the application was denied: a denied fraudster tries again elsewhere, so treat the inquiry itself as the alarm.
Collections and public records. Debts you do not recognize, however small. A $60 unpaid utility bill in a strange city is not noise. It is somebody living as you.
- Stagger the bureaus: Equifax in January, Experian in May, TransUnion in September. Free year-round coverage, one ten-minute session per season.
- After any breach letter involving your SSN, pull all three at once instead.
- Parents: there should be no report at all for a minor child. If one exists, that is itself the alarm.
When you find something
Dispute it with the bureau in writing through their online process, and simultaneously with the company that reported it. The bureau has a legal clock, generally 30 days, to investigate. If it is fraud rather than an error, file at IdentityTheft.gov first: the report it generates strengthens every dispute that follows. And if you have not already, this is the moment the freeze stops being theoretical: it prevents the next fraudulent account while you clean up the last one.