An identity theft account is a credit card, loan, utility account or collection entry that appears on a credit report because someone used another person's information without permission. Federal law gives that person ways to address it: a dispute, a faster "block" of the fraudulent information, fraud alerts and a free credit freeze.
A consumer may come across an account they never opened through a declined application, a collector's letter for a debt they don't recognize, or a line on a credit report that makes no sense. The questions come quickly. Is this mine? Will it follow me? Who has to fix it? The Fair Credit Reporting Act (FCRA) answers much of that, and this page walks through the dispute, block, fraud alert and freeze rules, what they require of credit bureaus and the companies that report to them, and what the law makes potentially available if those duties are not met.
What an Identity Theft Account on a Credit Report Is
A consumer report is, in the words of 15 U.S.C. § 1681a(d), a communication by a consumer reporting agency "bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics" and related matters. A consumer reporting agency (CRA) is a company that gathers that information and sells reports, such as the three nationwide credit bureaus. A furnisher is the creditor or debt collector that supplies account information to a CRA.
An identity theft account is an entry the consumer never authorized. That separates it from a billing disagreement or a reporting error on a real account, such as a wrong balance. The same fraudulent account can appear on reports from more than one CRA, and it can show up a second time as a collection entry once the unpaid balance is passed to a debt collector.
Under 15 U.S.C. § 1681j(a)(1), the nationwide CRAs must make the disclosures of a consumer's file once during any 12-month period on the consumer's request and without charge, and for a CRA described in 15 U.S.C. § 1681a(p) that applies "only if the request from the consumer is made using the centralized source established for such purpose." Section 1681j(g) names AnnualCreditReport.com (or such other source as may be authorized under federal law) as where free credit reports are available under federal law.
Signs That an Account May Be the Result of Identity Theft
Certain entries tend to point toward identity theft rather than a forgotten account. The CFPB's list of common credit report errors includes "incorrect accounts resulting from identity theft." In practice, the warning signs include:
- a creditor name, account number or open date the consumer does not recognize;
- an address or employer the consumer never used;
- hard inquiries (requests for the report tied to applications) from creditors the consumer never contacted.
A related but different problem is a mixed file: the CFPB describes it as "mixing two consumers' information in a single file," often someone with the same or a similar name.
Spotting these signs does not by itself establish identity theft. The dispute and block processes below are how a consumer formally raises it.
A reinvestigation is the CRA's review of information a consumer says is inaccurate or incomplete. Under 15 U.S.C. § 1681i(a)(1)(A), when a consumer disputes an item directly or through a reseller, the CRA must, "free of charge, conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate and record the current status of the disputed information, or delete the item from the file," within 30 days of receiving the dispute. Under 15 U.S.C. § 1681i(a)(1)(B), that period may be extended by no more than 15 days if the CRA receives information from the consumer during the 30 days that is relevant to the reinvestigation. Under 15 U.S.C. § 1681i(a)(1)(C), the extension does not apply to a reinvestigation in which, during the 30 days, the information is found to be inaccurate or incomplete or the CRA determines that it cannot be verified.
Under 15 U.S.C. § 1681i(a)(2), the CRA must notify the furnisher within 5 business days and pass along all relevant information the consumer sent. The FTC's page on disputing errors on credit reports says the business "must investigate and report the results back to the credit bureau," and, if it finds the information inaccurate, notify all three nationwide bureaus. Under 15 U.S.C. § 1681i(a)(3), a CRA may end a reinvestigation it reasonably finds frivolous or irrelevant, but must tell the consumer why within 5 business days after making that determination.
A consumer may also dispute directly with the furnisher. The CFPB's dispute page says furnishers "generally must investigate and respond to your dispute within 30 days." A dispute is usually a written explanation of what is wrong and why, with copies of supporting documents. Bureau-specific steps are covered on this site's page on credit report dispute steps.
The FCRA's Block Right for Identity Theft Victims
The block is the FCRA's tool built specifically for identity theft. Under 15 U.S.C. § 1681c-2(a), a CRA generally must block the reporting of information the consumer identifies as resulting from identity theft, no later than 4 business days after it receives:
- appropriate proof of the consumer's identity;
- a copy of an identity theft report;
- the consumer's identification of the information; and
- a statement that the information does not relate to any transaction by the consumer.
An identity theft report, for this purpose, is defined by 15 U.S.C. § 1681a(q)(4) to mean, at a minimum, a report that alleges an identity theft, that is a copy of an official, valid report filed with an appropriate federal, state or local law enforcement agency (or another government agency the Bureau deems appropriate), and whose filing subjects the person filing it to criminal penalties if the information is false. The CFPB's identity theft page says reporting at IdentityTheft.gov produces "an Identity Theft Report and recovery plan."
Four business days is far shorter than the 30-day reinvestigation. Under 15 U.S.C. § 1681c-2(b), the CRA must promptly tell the furnisher the information may result from identity theft, that a report was filed, that a block was requested, and the block's effective dates. The CFPB adds that once notified, creditors "can't turn identity theft-related debts over to debt collectors."
Under 15 U.S.C. § 1681c-2(c), a CRA may decline or rescind a block only if it reasonably determines the block was requested in error, rested on a material misrepresentation of fact by the consumer, or the consumer obtained goods, services or money from the blocked transaction; it must then promptly notify the consumer. Certain resellers and check-services companies are treated differently.
Fraud Alerts: What They Do and How Long They Last
A fraud alert is a flag in a credit file telling creditors to confirm a person's identity before opening credit. Under 15 U.S.C. § 1681c-1(a), a nationwide CRA must add an initial fraud alert at the direct request of a consumer who asserts in good faith a suspicion of fraud or identity theft, once it has appropriate proof of identity, and keep it for at least 1 year unless the consumer asks to remove it sooner. The same subsection requires that CRA to refer the alert to the other nationwide CRAs, so one request reaches all three.
Under 15 U.S.C. § 1681c-1(b), a consumer who submits an identity theft report may request an extended alert lasting 7 years, which also removes the consumer from prescreened credit and insurance offer lists for 5 years and entitles them to 2 free file copies within 12 months.
For creditors, the CFPB says an initial alert means they "must take reasonable steps to make sure it's you" before approving new credit, and with an extended alert a creditor must contact the consumer by the method the consumer chooses. A fraud alert does not stop anyone from seeing the report. That is the job of a freeze.
Credit Freezes: What They Do and What They Do Not Do
For someone who has just found one fraudulent account, the natural worry is the next one. A security freeze, according to the CFPB's credit freeze page, "prevents prospective creditors from accessing your credit file." The CFPB says a consumer can freeze and unfreeze for free at each nationwide CRA separately, and that a CRA must place the freeze within one business day of a telephone or secure electronic request, or within three business days of receiving a mailed request, then send written confirmation within five business days.
A freeze has limits. A limited number of entities can still see a frozen file, and the CFPB notes that the federal free-freeze law "does not apply to someone who requests your credit report for employment, tenant-screening, or insurance purposes." The CFPB also says freezes do not affect credit scores.
Does a freeze protect against identity theft? Partly. The FTC's page on credit freezes and fraud alerts says that with a freeze in place "nobody can open a new credit account in your name." It does not remove accounts already opened or already reporting; the dispute and block rights above address those entries.
What Happens When a CRA or Furnisher Does Not Comply
The FCRA's remedies depend on how a company failed to comply. Under 15 U.S.C. § 1681n, a person who willfully fails to comply with a requirement of the Act with respect to a consumer is liable for "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000," "such amount of punitive damages as the court may allow," and, "in the case of any successful action," costs and reasonable attorney's fees as the court determines.
Under 15 U.S.C. § 1681o, a person who is negligent in failing to comply is liable for actual damages sustained as a result, plus costs and reasonable attorney's fees in a successful action. Under 15 U.S.C. § 1681n(c) and 15 U.S.C. § 1681o(b), when a court finds that an unsuccessful pleading, motion or other paper was filed in bad faith or for purposes of harassment, it "shall award to the prevailing party" attorney's fees reasonable in relation to the work expended in responding to it. Under 15 U.S.C. § 1681s-2(c) and (d), sections 1681n and 1681o do not apply to a violation of 15 U.S.C. § 1681s-2(a), including regulations issued under it (with the exception stated in 15 U.S.C. § 1681s(c)(1)(B)); those violations are enforced exclusively by the federal agencies and officials and the State officials identified in 15 U.S.C. § 1681s.
These are what the statute makes potentially available, and each depends on proof: a failure to comply, the required willfulness or negligence, and, for actual damages, harm resulting from the failure. Whether a particular situation involves a violation depends on its facts. This site's page on a federal consumer lawsuit explains how such claims are structured. Separately, the CFPB says it forwards complaints to the company and provides a tracking number.
Filing an Identity Theft Report and Using IdentityTheft.gov
IdentityTheft.gov is the FTC's site for reporting identity theft. According to the CFPB, a person who reports there receives "an Identity Theft Report and recovery plan that walks you through the steps to take," and the FTC's identity theft page describes "a free personal recovery plan with next steps."
That report matters because two FCRA rights turn on it. The block in 15 U.S.C. § 1681c-2(a) requires "a copy of an identity theft report," and the extended alert in 15 U.S.C. § 1681c-1(b) is available to a consumer "who submits an identity theft report." The FTC says extended alerts are available to people who completed an FTC identity theft report or filed a police report, so a report to local law enforcement is another route.
If You'd Like a Consumer Rights Case Review
This page explains the federal rules; it does not cover state law, which may add protections and differs from state to state, and more on the federal statutes appears on this site's consumer rights attorney overview.
A reader may request a consumer rights case review through Federal Consumer Rights.
