After a financial data breach, the federal protections discussed on this page come through the Fair Credit Reporting Act: fraud alerts, credit freezes, identity theft blocks and dispute rights when misused data shows up on a credit report. A breach is unauthorized access to a company's records of account, card or Social Security numbers.
The questions after a breach are practical: what the credit bureaus must do, and what federal law provides when misused data reaches a credit file.
This page walks through what a financial data breach is, how the harm usually reaches a consumer, and what the Fair Credit Reporting Act (FCRA), found at 15 U.S.C. § 1681 et seq., requires once breached data starts appearing in a credit file.
A data breach is the unauthorized access to, taking of, or disclosure of personal information that a company or institution holds. The word "unauthorized" carries the meaning: the person who got the data had no permission to have it.
Financial information, in this setting, means the identifiers tied to a person's money and credit, such as bank account and routing numbers, credit and debit card numbers, card PINs, and Social Security numbers.
State Law and the FCRA's Stated Purpose
State law may add its own protections and differs from state to state.
Under 15 U.S.C. § 1681, Congress stated that the law's purpose is to require consumer reporting agencies to adopt reasonable procedures "with regard to the confidentiality, accuracy, relevancy, and proper utilization" of consumer information.
Identity theft. A person's information is used to open new accounts, take out loans or make purchases without their knowledge.
Account takeover. Someone gets into an existing bank or credit account and uses it.
Credit report damage. Fraudulent accounts, balances or inquiries can appear on a consumer report. A consumer report is, in plain terms, the information a credit bureau shares about a person's credit history and standing. Lenders, landlords, employers and others use it to make decisions.
Tax fraud. A stolen Social Security number can be used to file a false tax return.
A sign of misuse may be an account that isn't yours on a credit report.
The FCRA and Credit Report Errors After a Breach
When breached data lands on a credit report, the FCRA is the main federal law that applies. A few terms help:
- A consumer reporting agency gathers credit information about consumers and furnishes consumer reports to others. The three nationwide credit bureaus are examples.
- A furnisher is a company, such as a lender or card issuer, that supplies information about a consumer to a consumer reporting agency.
- A reinvestigation is the agency's review of a consumer's dispute about something in their file.
The identity theft block. Under 15 U.S.C. § 1681c-2(a), a consumer reporting agency generally must block the reporting of information the consumer identifies as resulting from an alleged identity theft. It must do so within 4 business days after it receives four things: proof of the consumer's identity, a copy of an identity theft report, the consumer's identification of the information, and a statement that the information does not relate to any transaction by the consumer. The agency must then promptly notify the furnisher.
The block is not absolute. Under § 1681c-2(c), the agency may decline or rescind a block if it reasonably determines that the block was made or requested in error, that the request rested on a material misrepresentation of fact, or that the consumer obtained goods, services or money from the blocked transaction. If a block is declined or rescinded, the agency must promptly notify the consumer. Certain resellers and check services companies are subject to separate rules.
Disputes. Under 15 U.S.C. § 1681i(a), an agency must, free of charge, conduct a reasonable reinvestigation and record the current status of the disputed item, or delete it, within 30 days of receiving the dispute. That period may be extended by up to 15 days if the consumer sends relevant information during the 30 days, though the extension does not apply if the item is found inaccurate, incomplete or unverifiable within that time. The agency must notify the furnisher within 5 business days.
An agency may end a reinvestigation it reasonably finds frivolous or irrelevant, but it must tell the consumer why within 5 business days. An item found inaccurate, incomplete or unverifiable must be promptly deleted or modified, and deleted information may not be reinserted unless the furnisher certifies that it is complete and accurate. The credit report dispute process covers these steps in more depth.
Furnishers. The company that reported the information has its own duties once a credit bureau passes a dispute along. Under 15 U.S.C. § 1681s-2(b), the furnisher must investigate the disputed information and review the relevant information the agency sends. It must then report the results back to the agency. If it finds the information inaccurate or incomplete, it must also tell the other nationwide agencies it reported to. And if an item turns out to be inaccurate, incomplete or unverifiable, the furnisher must promptly modify it, delete it or permanently block it.
The furnisher must finish all of this within the agency's reinvestigation period, so its work runs on the same clock as the bureau's. When a bureau answers "verified," those rights continue; see when a bureau won't remove an item.
IdentityTheft.gov and Official Government Resources
The FTC's consumer page on credit freezes and fraud alerts names IdentityTheft.gov as the place to complete an FTC identity theft report. That same page describes a completed FTC identity theft report, or a police report, as what a person needs to place an extended fraud alert.
Fraud alerts. The FCRA offers two main kinds of fraud alert, and they differ in what a consumer must show and how long they last. Under 15 U.S.C. § 1681c-1(a), a consumer who in good faith suspects fraud or identity theft may ask a nationwide agency to place an initial fraud alert. That alert lasts at least 1 year, and the agency must refer it to the other nationwide agencies, so one request reaches all of them.
An extended alert, under § 1681c-1(b), is available to a consumer who submits an identity theft report. It lasts 7 years, keeps the consumer off prescreened credit and insurance offer lists for 5 years, and comes with the right to 2 free file copies within 12 months. With either kind of alert, the agency must provide the disclosures required under 15 U.S.C. § 1681g without charge not later than 3 business days after a request for a free copy of the file.
Credit freezes. A security freeze, under 15 U.S.C. § 1681c-1(i), is a restriction that prohibits an agency from disclosing the contents of the frozen report to any person requesting it, subject to the exceptions the statute lists. The CFPB's page on credit and security freezes states a nationwide company must place a freeze within one business day of a phone or secure electronic request, or within three business days after receipt of a request by mail. The CFPB notes the free-freeze law does not apply to those requesting reports for employment, tenant-screening or insurance purposes. The FTC's page describes freezes and alerts as free and says a freeze does not affect a credit score. It also describes how to get free credit reports.
What the Law Makes Potentially Available to Consumers
The FCRA's remedies depend on why a company failed to comply, and on that company having a duty under the FCRA in the first place.
Willful noncompliance. Under 15 U.S.C. § 1681n(a), a person who willfully fails to comply with an FCRA requirement is liable to the consumer for:
- actual damages, or damages of not less than $100 and not more than $1,000
- punitive damages, in whatever amount the court may allow
- in a successful action, costs and reasonable attorney's fees
A separate measure applies to a natural person who obtains a report under false pretenses.
Negligent noncompliance. Under 15 U.S.C. § 1681o(a), a negligent failure makes a person liable for actual damages and, in a successful action, costs and reasonable attorney's fees.
Under both sections, a court must award attorney's fees against a party that filed an unsuccessful paper in bad faith or to harass.
These are what the statute makes potentially available. A breach does not by itself create an FCRA claim. Whether a particular situation does depends on its facts: which company had which duty, what it did after a dispute or block request, and whether its failure was willful or negligent. More on consumer rights remedies appears elsewhere on this site.
What This Page Does Not Cover
This page explains federal consumer protection law as it applies when financial data is exposed and reaches a credit report. It does not cover any state's breach notification statute beyond noting that state law varies. It does not address medical data breaches under HIPAA, disputes over charges on a card account itself, employment background check disputes, or debt collection practices, which are separate topics. It does not discuss any particular company's breach, settlement or class action. Federal Consumer Rights is a website that provides information and facilitates inquiries; it is not a law firm and does not provide legal advice.
If You'd Like a Consumer Rights Case Review
This page covers federal consumer-reporting law when financial data is exposed and reaches a credit report. It does not cover state breach notification law or any one company's breach. A reader may request a consumer rights case review through Federal Consumer Rights.
