Identity theft on your credit report, step by step
If an identity thief opened accounts in your name, file an Identity Theft Report at IdentityTheft.gov, freeze your credit with each bureau, and send each bureau a block request with the report, proof of identity and a statement identifying the fraudulent accounts. Once a bureau has those, federal law requires it to block the information within four business days.
A lender turned you down, and the reason was an account you never opened. Or a collector called about a phone contract in another state. Someone has been using your name.
The law gives identity theft victims a specific tool that ordinary disputes do not have: the block. Here is how to use it, in order.
Step 1: File the Identity Theft Report
Go to IdentityTheft.gov, the FTC's site. It builds a recovery plan and produces an Identity Theft Report. The FTC describes that report as an official report to law enforcement.
That matters because the FCRA defines an "identity theft report" as a report alleging identity theft that is filed with a law enforcement agency, where filing false information carries criminal penalties (15 U.S.C. § 1681a(q)(4)). The block in Step 4 depends on it. Be exact. List only the accounts and inquiries that are actually fraudulent.
Step 2: Freeze your credit, or at least set an alert
These stop new damage while you fix the old.
- Security freeze. Free by federal law. A bureau must place it within one business day of a phone or online request (three business days by mail), and lift it within one hour of a phone or online request to lift it (15 U.S.C. § 1681c-1(i)). Place it with each nationwide bureau.
- Initial fraud alert. Lasts at least one year. The bureau you ask must pass it to the other nationwide bureaus (§ 1681c-1(a)).
- Extended fraud alert. Lasts seven years and requires an identity theft report (§ 1681c-1(b)).
Step 3: Get every report
Pull your reports from Equifax, Experian and TransUnion at AnnualCreditReport.com, the only site the FTC says is authorized to fill orders for the free reports. On request, each bureau must disclose everything in your file and where it came from (15 U.S.C. § 1681g(a)). Mark every account, inquiry and address you do not recognize.
Step 4: Demand the block
This is the step that separates identity theft from an ordinary dispute. Send each bureau that shows the fraud:
- Proof of your identity.
- A copy of your Identity Theft Report.
- A list of the information to block, account by account.
- Your statement that the information does not relate to any transaction you made.
Once the bureau has all four, it must block the information no later than four business days after receiving them, and promptly notify the company that furnished it (15 U.S.C. § 1681c-2(a), (b)). A bureau may decline or rescind the block only if it reasonably determines it was issued in error, rested on a material misrepresentation, or that you got goods, services or money from the transaction (§ 1681c-2(c)).
Compare that with an ordinary dispute, where the bureau has 30 days to reinvestigate (§ 1681i(a)(1)). Send the block request by mail with tracking and keep copies of everything.
Keep the request tight. List each fraudulent account by creditor name and the last digits the report shows, and each inquiry you did not authorize. Leave out accounts that are yours, even if they have errors of their own: those go in a separate, ordinary dispute. Mixing real and fraudulent accounts in one block request gives the bureau a reason to question the whole packet, and the statute lets it decline a block based on a material misrepresentation.
Step 5: Deal with the collectors
If a collector is chasing a fraudulent account, dispute it in writing within 30 days of its first written notice. A written dispute in that window requires it to stop collecting until it mails verification (15 U.S.C. § 1692g(b)). A collector may not falsely represent that a debt is yours (§ 1692e(2)(A)), and after your dispute it may not report the debt without saying it is disputed (§ 1692e(8)). Send it a copy of your Identity Theft Report.
If the accounts stay
A bureau that does not block within the statutory time, or keeps reporting a fraudulent account after a proper dispute, may be liable. For a willful violation the FCRA allows actual damages or statutory damages of $100 to $1,000, plus punitive damages; for a negligent one, actual damages (15 U.S.C. §§ 1681n, 1681o). The FCRA requires a company found liable to pay the consumer's reasonable attorney's fees and costs. Your claim must be filed by the earlier of two years after you discover the violation or five years after it occurred (§ 1681p).
The identity theft page covers the claim, and failed dispute covers what happens when a bureau verifies anyway.
What to do this week
- Day one: file your Identity Theft Report at IdentityTheft.gov and save the PDF.
- Day one: freeze your credit with Equifax, Experian and TransUnion.
- Day two: pull all three reports and list every fraudulent item.
- Day three: mail each bureau the four-part block request, and write to every collector on a fraudulent account.
- Calendar it: four business days after each bureau receives your packet, check whether the items are blocked.
Sources: 15 U.S.C. §§ 1681a(q)(4), 1681c-1, 1681c-2, 1681g, 1681i, 1681n, 1681o, 1681p; 15 U.S.C. §§ 1692e, 1692g; FTC, What To Know About Identity Theft; FTC, Free Credit Reports.
Common questions
What is the difference between a fraud alert and a freeze?
A fraud alert tells lenders to take extra steps to confirm your identity; an initial alert lasts at least one year, and an extended alert, which requires an identity theft report, lasts seven years. A security freeze restricts access to your file. By federal law a freeze is free, must be placed within one business day of a phone or online request, and lifted within one hour of a phone or online request to lift it.
Do I need a police report?
The FCRA's block needs an identity theft report, which the statute defines as a report alleging identity theft filed with a law enforcement agency. The FTC says the Identity Theft Report you create at IdentityTheft.gov is an official report to law enforcement that can be used for this purpose.
Can the bureau refuse to block?
It may decline or rescind a block only if it reasonably determines the block was issued in error, was based on a material misrepresentation, or that you obtained goods, services or money from the blocked transaction. It must promptly notify the company that furnished the information about the block.
Tell us what they did.
One conversation with an attorney, in your language. We tell you which laws the collector or the credit bureau broke, which deadline runs first, and what to save this week. If it is not a case we can take, we say so and tell you where to go.
(718) 484-7510The FDCPA and the FCRA require a company found liable to pay the consumer’s reasonable attorney’s fees and costs. Our fee arrangement is confirmed in a written retainer before we begin. English, Russian and Spanish in-house; an interpreter for any other language.