Patrick McKenzie, someone passionate about credit reports and the industry, has some good advice in light of the recent Equifax leak:
You should never call a CRA, ever. They have phone centers staffed with people whose only job is getting you off the phone. They have very limited availability to help, for the same reason that the phone center for Walmart does not have anyone who can help a shoe. You will deal with CRAs only in writing.
Banks deal with lots of angry people, and are optimized to treat this like a customer service problem. Some do better and some do worse at this, but you never want identity theft treated like a customer service problem. Their CS department is scored on number of tickets resolved per hour, and each rep’s incentives are simply to classify you as something requiring no followup and get you off the phone.
Instead, you want to communicate with the bank in a manner which suggests that you’re an organized professional who is capable of escalating the matter if the bank does not handle it themselves. You do not yell – not that you’re ever verbally speaking with anyone, but you wouldn’t yell in a letter, either. You do not bluster. (“I will tell on you to my attorney” is, generally, bluster, and that’s bluster that is common to people who do not actually have attorneys.) You instead present as if you’re collecting a paper trail.
Actually, that last bit is great advice if you need to handle any problem with any company. Acting professional will get you much further than not.