Identity theft on your credit report
If a thief opened accounts in your name, the Fair Credit Reporting Act lets you have them blocked from your credit report. The bureau must block the information within 4 business days after you send proof of identity, an identity theft report, the items to block and your statement that they are not yours. If it refuses without a lawful reason, or keeps reporting the accounts after a dispute, you can sue.
Identity theft gets a faster remedy than an ordinary dispute. An ordinary dispute gives the bureau 30 days to reinvestigate. An identity theft block gives it 4 business days, and the bureau does not decide whether the account is "verified"; it blocks the information unless one of a few narrow exceptions applies. The work is in sending the right package, and then holding the bureau and the lenders to it.
What it looks like
- New accounts you did not open. Credit cards, store cards, personal loans, phone plans or auto loans in your name.
- Hard inquiries you did not authorize. A string of applications at lenders you have never contacted, often on the same day.
- Collection accounts for fraud debts. The thief stops paying, the account is charged off and sold, and a collector starts calling you.
- New addresses and phone numbers. The thief's contact details appear in your file, so bills and notices never reach you.
- The block is ignored. You sent the package and the accounts are still there weeks later, or the bureau "verified" them through the lender.
- The accounts come back. A blocked account reappears after the lender re-reports it or sells it to a collector.
The law
The block: 15 U.S.C. § 1681c-2
A consumer reporting agency must block the reporting of any information in your file that you identify as resulting from identity theft, not later than 4 business days after it receives:
- appropriate proof of your identity;
- a copy of an identity theft report;
- your identification of the information; and
- your statement that the information does not relate to any transaction by you (§ 1681c-2(a)).
The agency must promptly notify the furnisher that the information may be the result of identity theft, that a report was filed, and that a block was requested (§ 1681c-2(b)). It may decline or rescind the block only if it reasonably determines the block was issued in error, was based on a material misrepresentation, or that you obtained goods, services or money as a result of the blocked transaction (§ 1681c-2(c)).
What counts as an identity theft report
The Act defines it as a report that alleges identity theft, filed with a law enforcement agency, where filing false information subjects the filer to criminal penalties (§ 1681a(q)(4)). The Federal Trade Commission says the Identity Theft Report you create at IdentityTheft.gov is an official report to law enforcement, and that with it, bureaus must honor your request to block fraudulent information. You may also file with your local police.
If you use an ordinary dispute instead
Without a report, you can still dispute. The bureau then has 30 days to reinvestigate (§ 1681i(a)(1)), must pass the dispute to the lender within 5 business days (§ 1681i(a)(2)), and the lender must investigate once notified (§ 1681s-2(b)). It is slower, and the FTC notes there is no promise the items will come off.
What you can recover
A bureau that fails to block without a lawful reason, or a bureau or lender that keeps reporting fraud accounts after a proper dispute, may be liable for actual damages or statutory damages of $100 to $1,000 for a willful violation, plus punitive damages (15 U.S.C. § 1681n(a)), and actual damages for a negligent one (§ 1681o(a)). The FCRA requires a company found liable to pay the consumer's reasonable attorney's fees and costs.
The damages in these cases are usually about what the fraud accounts did to you after you reported them: denials, higher rates, collection calls, and the hours and distress of fighting them. Under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), you need a concrete harm, and proof that the report went to a lender or landlord is the clearest.
What to do now
- Report it to the FTC. Create an Identity Theft Report at IdentityTheft.gov. Print it.
- Pull all three reports. List every account, inquiry, address and phone number that is not yours.
- Send a block request to each bureau. Include the Identity Theft Report, a copy of your ID, the list of items, and a signed statement that they do not relate to any transaction by you. Keep copies and proof of delivery.
- Write to each lender and collector. Tell them the account is fraud, enclose the report, and ask for the application and account records. The FTC notes you have the right to documents related to the theft.
- Count 4 business days from delivery. If the accounts are still there, send a follow-up and save the report showing them. Then call a lawyer.
If a collector has sued you on a fraud account, do not ignore the papers; the answer deadline is short. See sued by a debt collector.
The clock
Earlier of 2 years from discovery or 5 years from the violation
An FCRA claim must be filed within 2 years after you discover the violation, and within 5 years after it happened (15 U.S.C. § 1681p). A claim against a collector under the FDCPA has one year from the violation (15 U.S.C. § 1692k(d)).
In New York, New Jersey and Florida
The block and the dispute rights are federal and work the same in all three states. In New York, the state fair credit reporting act bars an agency from reporting information it has reason to know is inaccurate (N.Y. Gen. Bus. Law § 380-j(a)), with damages, costs and fees under §§ 380-l and 380-m. In Florida, any person collecting a consumer debt, including an original creditor, may not disclose a debt known to be reasonably disputed without disclosing the dispute (Fla. Stat. § 559.72(6)). See New York, New Jersey and Florida.
Common questions
What is an identity theft report?
Under the FCRA it is a report alleging identity theft that is filed with a law enforcement agency, where filing false information carries criminal penalties (15 U.S.C. section 1681a(q)(4)). The FTC says the Identity Theft Report you create at IdentityTheft.gov is an official report to law enforcement.
How fast must the bureau block the accounts?
Within 4 business days after it receives your proof of identity, a copy of the identity theft report, identification of the items and your statement that they do not relate to any transaction by you (15 U.S.C. section 1681c-2(a)).
Can the bureau refuse the block?
Only on limited grounds: if it reasonably determines the block was issued in error, was based on a material misrepresentation by you, or you received goods, services or money from the blocked transaction (15 U.S.C. section 1681c-2(c)). A refusal that fits none of those is a problem for the bureau.
A collector is calling about the fraud account. What do I do?
Dispute the debt in writing with the collector, say it is the result of identity theft, and keep a copy. The FDCPA bars collectors from misrepresenting the debt, and a collector that keeps reporting a debt it knows you dispute without noting the dispute violates 15 U.S.C. section 1692e(8).
Tell us what they did.
One conversation with an attorney, in your language. We tell you which laws the collector or the credit bureau broke, which deadline runs first, and what to save this week. If it is not a case we can take, we say so and tell you where to go.
(718) 484-7510The FDCPA and the FCRA require a company found liable to pay the consumer’s reasonable attorney’s fees and costs. Our fee arrangement is confirmed in a written retainer before we begin. English, Russian and Spanish in-house; an interpreter for any other language.