What do I do about a student loan I never took out?

What are the 12 steps, in order?

Twelve steps: build the federal paper trail first (steps 1–8), engage the school ninth, then records requests and escalation.

1. Pull all three credit reportsAt annualcreditreport.com, the free, federally mandated site. Identify the fraudulent tradeline, servicer, and school code; save PDFs.
2. Freeze your credit at all three bureausImportant protection generally, even though it did not stop this loan type — see credit freezes below.
3. File an FTC Identity Theft ReportAt IdentityTheft.gov. It unlocks your rights under the Fair Credit Reporting Act; cite the report number in every later step.
4. File police reports — pluralOne in your jurisdiction, one in the school's; the school's local police can request records that you, the victim, cannot.
5. Pull the federal loan record at studentaid.govWith your own FSA ID: school, disbursement dates, amounts, servicer, Master Promissory Note details.
6. Send FCRA § 605B block letters by certified mailTo all three bureaus, with return receipt — not the online portals. Paper plus a receipt documents what the agency received and when; the four-business-day trigger is under records rights.
7. File the servicer fraud claim and the federal discharge applicationBoth — see discharge. Also demand the fraudulent application documents under FCRA § 1681g(e): free within 30 days.
8. Report to the ED Office of Inspector GeneralAt oig.ed.gov, with the school code and every red flag you can document. OIG intake puts the case in federal enforcement view.
9. Only now engage the school's processIn writing, never phone-only. Insist on live-video identity verification with government-ID review — see why the school comes last. The school's default advice ("file our appeal form") is this step — 9 of 12, not step 1.
10. File a state public records requestFor the full application record — in Minnesota, a Government Data Practices Act request. Expect a fight over metadata — see records rights.
11. Escalate if stalledFederal Student Aid Ombudsman → CFPB → state Attorney General → congressional casework, in that order. Executives respond to regulators; front desks do not.
12. Document everything, contemporaneouslyAfter every call, send a "for the record" email. Those emails become your evidence — here, they document events the institution otherwise had no record of.

Sources: FTC: Identity theft recovery steps · 15 U.S.C. § 1681c-2: identity-theft information blocks · Federal Student Aid: False Certification Identity Theft Discharge (PDF) · Department of Education OIG Hotline

Does a credit freeze stop student loan fraud?

Usually not for the loan type documented here: Direct Subsidized and Unsubsidized loans generally do not use the consumer credit check a freeze blocks.

The victim's credit was frozen at all three bureaus, and the loan was originated anyway. Direct PLUS loans are different: Federal Student Aid performs a credit check, and an applicant with a security freeze must lift it before applying. Keep the freeze regardless — it remains important protection against other uses of your identity.

Sources: Federal Student Aid: federal loan credit-check exceptions · Federal Student Aid: PLUS credit checks and security freezes

Can someone take out a federal student loan with just my SSN?

In the case documented on this site, yes — a stolen SSN and a lookalike email were sufficient inputs.

A fabricated address, phone number, high school, and prior-college history were accepted without verification, and a Direct loan was originated in the victim's name — see What Went Wrong. That case-specific record does not establish that every application can be opened this way.

How do I get a fraudulent federal student loan discharged?

File a False Certification (Identity Theft) Discharge application under 34 CFR 685.215 with the loan holder, alongside a separate servicer fraud claim.

Attach the identity-theft documentation the form requests. Servicer acknowledgment and tradeline removal are not the same as a Department of Education discharge: here, the discharge remained pending as of July 2026 after the servicer removed the tradeline — status on The Case.

Sources: Federal Student Aid: False Certification Identity Theft Discharge (PDF)

What records am I entitled to?

Free copies of the fraudulent application documents within 30 days under FCRA § 609(e), 15 U.S.C. § 1681g(e); § 605B credit-report blocks within four business days; and — at a public institution — the application record via a state public-records request.

Section 605B requires a consumer reporting agency to block fraud-resulting information within 4 business days after it receives proof of your identity, a copy of your identity theft report, identification of the disputed information, and your statement that the information does not relate to any transaction by you. Expect the institution to withhold origination metadata (timestamps, IP addresses, audit logs) as "security information," as happened here; challenge that through your state's records-dispute mechanism — in Minnesota, a free Minn. Stat. § 13.072 advisory opinion. Other remedies are fact-specific — see Where the Law Fails; none of it is individual legal advice.

Sources: 15 U.S.C. § 1681c-2: identity-theft information blocks · 15 U.S.C. § 1681g(e): transaction records · Federal Student Aid: False Certification Identity Theft Discharge (PDF)

Where can I get help right now?

Start with steps 1–4 above — the FTC report, police reports, and credit-bureau actions are the first-response moves that preserve your rights and create a verifiable paper trail.

Document every contact contemporaneously and keep copies outside institutional portals. Compare the dates and notices in your own records with the documented case timeline. This is a case-based playbook, not legal advice.

Sources: FTC: Identity theft recovery steps

Why engage the school last?

Because email-based identity verification is the attack vector: it asks you to prove you are you through the same channel the fraudster used to become you.

Steps 1–8 build the federal paper trail everything else depends on: the FTC report unlocks FCRA rights, and certified mail creates enforceable deadlines. Engaging the school first puts you in a process designed for enrollment disputes, not identity fraud. When you do engage, do it in writing and insist on live-video verification with government-ID review. For the institutional failure modes to watch for, see What Went Wrong.