Finding an account you never opened is alarming — but it's also one of the clearest FCRA disputes there is. Inaccurate accounts that aren't yours must be investigated and, if unverified, removed.
There are two common causes, and they call for slightly different handling:
Identity theft: Someone used your personal information to open credit in your name. These accounts are fraudulent and you are not responsible for them.
Mixed file: The bureau merged your file with someone else's — often a relative, someone with a similar name, or a close Social Security number. The account is real, just not yours.
For identity-theft accounts, attach a copy of your FTC Identity Theft Report and, if you have one, a police report. Under the FCRA, information that results from identity theft must be blocked from your report (15 U.S.C. § 1681c-2) once you provide the required documentation. For a mixed file, include proof of your correct identity — government ID, Social Security number, and current address — so the bureau can separate the files.
The bureau generally has 30 days to investigate. Fraudulent and misattributed accounts that can't be tied to you should be removed, and you're entitled to a free updated report showing the change. Keep copies of every letter and report you send.