If an account that isn't yours shows up on your credit report, federal law gives you the right to dispute it. The credit bureau must reinvestigate for free, generally within 30 days, and tell the company that reported it. If the account cannot be verified or is wrong, it must be corrected or deleted.
A person who finds an account they have never seen may be trying to work out two things at once: whether someone has stolen their identity, and whether this stranger's debt will follow them into a loan, an apartment application or a job screening. The entry may be a credit card they never opened, a collection account under an unfamiliar name, or a loan tied to an old address. This page explains what can cause it, what the Fair Credit Reporting Act requires of the credit bureaus and the companies that report to them, and what the law makes potentially available when an error is not fixed.
Why an Account You Don't Recognize Can Appear on Your Report
A credit report is what the law calls a consumer report: a file of information about a person's credit history that is sold to lenders and others. The company that compiles it is a consumer reporting agency, or CRA. The FTC refers to three nationwide credit bureaus, and a consumer may have a separate file at each. The business that sends account information to a CRA is a furnisher: a creditor, a lender or a debt collector.
An unfamiliar account may trace to causes such as these:
- Identity theft. Someone used the reader's personal information to open the account.
- A mixed file. The CFPB describes a mixed file as mixing two consumers' information in a single file, often accounts of a person with the same or a similar name (CFPB).
- Furnisher error. The creditor or collector reported the account to the wrong person.
Not every unfamiliar name is an error. The CFPB notes that accounts may be sold or sent to a collection company, and store cards often appear under the issuing bank's name (CFPB). All three causes fall under the same federal law, 15 U.S.C. § 1681 et seq., though the steps can differ.
What the FCRA Requires CRAs to Include — and Exclude — from a Consumer Report
The core accuracy rule is short. Under 15 U.S.C. § 1681e(b), "Whenever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates."
A CRA is not the original creditor. It compiles what furnishers send, so accuracy depends on both sides. Furnishers carry their own duty: under 15 U.S.C. § 1681s-2(a)(1)(A), a person shall not furnish information about a consumer to a CRA if the person knows or has reasonable cause to believe it is inaccurate. The CFPB's guidance puts the baseline plainly: a report should contain only items about the consumer.
Time limits also apply. The FTC explains that, as long as the information is correct, a credit bureau can report most negative information for seven years and bankruptcy information for 10 years (FTC). Those limits apply to accurate information; an account that never belonged to the consumer is a different problem.
Access is limited too. Under 15 U.S.C. § 1681e(a), a CRA must maintain reasonable procedures to limit reports to the purposes listed in 15 U.S.C. § 1681b, require users to identify themselves and certify their purpose, and may not furnish a report to any person if it has reasonable grounds for believing the report will not be used for a purpose listed in 15 U.S.C. § 1681b. The inquiries section lists who obtained a report within a limited period. An unfamiliar inquiry may reflect prescreening for credit offers, which the CFPB says the FCRA permits, and 15 U.S.C. § 1681b(e) lets a consumer elect to be excluded from those lists.
How the FCRA's Dispute Process Works
The dispute right belongs to the consumer, and the work belongs to the CRA. A reinvestigation is the CRA's second look at a disputed item to decide whether it is accurate. Under 15 U.S.C. § 1681i(a)(1)(A), when a consumer disputes the completeness or accuracy of an item and notifies the CRA directly or through a reseller, the agency "shall, free of charge, conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate and record the current status of the disputed information, or delete the item from the file," before the end of the 30-day period beginning when it receives the notice.
That period may be extended by up to 15 more days if the consumer sends relevant information during the 30 days, 15 U.S.C. § 1681i(a)(1)(B), but not when the item is found inaccurate or incomplete or cannot be verified within the 30 days, 15 U.S.C. § 1681i(a)(1)(C).
Within five business days of receiving the dispute, the CRA must notify each furnisher of the disputed item and pass along all relevant information, 15 U.S.C. § 1681i(a)(2). The furnisher must then investigate, review that information, and report results to the CRA, 15 U.S.C. § 1681s-2(b)(1). If the item is inaccurate, incomplete or unverifiable, it must promptly modify, delete or permanently block it, and report corrections to the other nationwide CRAs it supplied. It must finish within the CRA's deadline, 15 U.S.C. § 1681s-2(b)(2).
The CFPB describes a written dispute that explains what is wrong and why, with supporting copies, and notes a CRA need not investigate a dispute it reasonably finds frivolous, such as one that does not say what is disputed, but must send notice of that decision within five business days (CFPB). A consumer may also dispute directly with the furnisher; the CFPB says furnishers generally must respond within 30 days.
Identity Theft and the FCRA's Specific Protections
Identity theft is the use of a person's identifying information, without permission, to open accounts or obtain credit. The FTC lists examples such as new credit cards or utility accounts opened in the victim's name (FTC). When the account traces to this, the FCRA adds tools beyond the ordinary dispute.
A fraud alert is a flag in the file. Under 15 U.S.C. § 1681c-1(a), a nationwide CRA must place an initial fraud alert when a consumer, with proof of identity, asserts in good faith a suspicion of fraud or related crime, including identity theft. It lasts not less than 1 year, and the CRA must refer it to the other nationwide CRAs. It must also tell the consumer a free file copy is available and provide the disclosures within 3 business days of a request. An extended alert, under 15 U.S.C. § 1681c-1(b), requires an identity theft report and runs for a 7-year period. The CFPB's identity theft page also describes a security freeze, sometimes called a credit freeze, alongside these alerts (CFPB).
The block is a separate tool. Under 15 U.S.C. § 1681c-2(a), a CRA must block the reporting of information that the consumer identifies as resulting from alleged identity theft not later than 4 business days after it receives appropriate proof of the consumer's identity, a copy of an identity theft report, the consumer's identification of the information, and a statement that the information does not relate to any transaction by the consumer. Under 15 U.S.C. § 1681c-2(c), a CRA may decline to block, or rescind a block, if it reasonably determines that the information was blocked in error, that the block was requested on the basis of a material misrepresentation of fact, or that the consumer obtained goods, services or money as a result of the blocked transaction. Under 15 U.S.C. § 1681c-2(b), the CRA must promptly notify the furnisher that the information may be a result of identity theft, that an identity theft report has been filed, that a block has been requested, and of the effective dates of the block. The CFPB says that, once notified, creditors generally can't turn identity theft-related debts over to debt collectors. Narrower rules apply to resellers and check services companies, 15 U.S.C. § 1681c-2(d)-(e).
The FTC describes IdentityTheft.gov as where to report identity theft and get a personalized recovery plan. When the account has gone to collections, debt collection law may also apply.
What Happens When a CRA or Furnisher Does Not Correct an Error
The FCRA addresses noncompliance through two liability sections, and whether a given situation is a violation depends on its facts.
For willful noncompliance, 15 U.S.C. § 1681n(a) makes a person who willfully fails to comply liable for "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000," plus "such amount of punitive damages as the court may allow," and, in a successful action, costs and reasonable attorney's fees as determined by the court. For negligent noncompliance, 15 U.S.C. § 1681o(a) provides actual damages resulting from the failure and, in a successful action, costs and reasonable attorney's fees. Both sections allow a court to award fees against a party that files papers in bad faith or to harass.
These are what the law makes potentially available; any award depends on proof of the failure, its willful or negligent character, and the harm caused. A CRA or furnisher that does not follow the reinvestigation or investigation duties may violate the FCRA, but only if the facts meet the statute's conditions. Under 15 U.S.C. § 1681s-2(c), 15 U.S.C. § 1681n and 15 U.S.C. § 1681o "do not apply to any violation of" the furnisher duties in 15 U.S.C. § 1681s-2(a), and those duties are enforced by the agencies and officials named in the Act (15 U.S.C. § 1681s-2(d)); the furnisher investigation duties in 15 U.S.C. § 1681s-2(b) are not within that limit.
Timing is set by 15 U.S.C. § 1681p: an action must be brought by the earlier of "2 years after the date of discovery by the plaintiff of the violation" or "5 years after the date on which the violation … occurs." More on how such cases work is in the overview of consumer lawsuits under federal law.
How to Get a Copy of Your Credit Report
Seeing the account on all three reports, or only one, helps show where an error started. Under 15 U.S.C. § 1681j(a)(1)(A), the nationwide CRAs must make their disclosures "once during any 12-month period upon request of the consumer and without charge," and for the nationwide credit bureaus that applies when the request goes through the centralized source the statute requires, 15 U.S.C. § 1681j(a)(1)(B).
The FTC identifies that source as AnnualCreditReport.com, and says the three bureaus have permanently extended a program allowing a free check of each report once a week there (FTC). Each bureau's report may differ.
Other free copies arise in specific situations, including the free copy tied to a fraud alert described above. Separately, adverse action includes a denial or other unfavorable decision based on a consumer report. Under 15 U.S.C. § 1681e(c), a CRA may not prohibit a user who took adverse action from showing the consumer the report's contents.
Filing a Complaint with a Federal Agency
An agency complaint and a lawsuit are two separate things.
The Consumer Financial Protection Bureau runs a complaint process for credit reporting problems. Its page says that when a consumer submits a complaint, the CFPB will forward the issue to the company, give a tracking number, and provide updates on its status (CFPB). The CFPB's guidance on disputes also notes a consumer may ask the bureaus to add a statement explaining the dispute when a furnisher stands by its reporting.
For identity theft, the CFPB says reporting to the Federal Trade Commission at IdentityTheft.gov produces an Identity Theft Report and a recovery plan (CFPB). That report is the document that supports an extended fraud alert and an identity theft block. These are official channels a consumer may use.
If You'd Like a Consumer Rights Case Review
An account that isn't yours can involve more than one company: the bureaus holding the file, the furnisher that reported it, and sometimes a collector. This page does not cover bankruptcy, credit repair services or debt settlement.
A reader may request a consumer rights case review through Federal Consumer Rights, and more on how these laws fit together appears in the overview of a consumer rights attorney's work.
