When a data breach exposes your information, identity theft happens if someone then uses it without permission. Federal law gives consumers tools that respond to that risk: a free security freeze, fraud alerts, a block on information that resulted from alleged identity theft, which a consumer reporting agency must place within 4 business days of receiving the items the statute lists, and a right to dispute errors.
A breach notice in the mail, or an account on a credit report that no one in the house opened, tends to raise the same unsettled questions at once. Was my information actually used? Is this my problem to fix, or the company's? Does the law do anything for me, or am I on my own?
This page explains how a breach can lead to identity theft, the federal credit reporting rules that apply, and when civil rights under those rules may become relevant.
A Data Breach and Identity Theft: How They Differ
A data breach and identity theft are separate events. The Federal Trade Commission describes identity theft plainly: identity theft is when someone uses your personal or financial information without your permission.
According to the FTC's guidance on credit freezes and fraud alerts, a consumer does not have to wait for information to be exposed in a data breach, or misused by an identity thief, to get a credit freeze: anyone can place one, any time.
The Federal Laws That Apply When a Breach Leads to Identity Theft
The Fair Credit Reporting Act (FCRA), which begins at 15 U.S.C. § 1681, is the main federal law here. It governs consumer reporting agencies, the companies that gather information about consumers and sell reports on them, including the nationwide credit bureaus. It also governs furnishers, the companies that send information about a consumer to those agencies. The FCRA has been amended over the years, including by the Fair and Accurate Credit Transactions Act of 2003.
Three FCRA tools bear on identity theft after a breach. 15 U.S.C. § 1681c-1 covers fraud alerts and the security freeze. Under its freeze rule, a nationwide consumer reporting agency that receives a direct request and proper identification "shall, free of charge, place the security freeze" within 1 business day for a request by toll-free telephone or secure electronic means, or 3 business days for a request by mail. It must send confirmation within 5 business days of placing it. A freeze removed at the consumer's direct request must come off free of charge within 1 hour (phone or electronic) or 3 business days (mail).
Fraud alerts work differently. According to the FTC, an initial fraud alert lasts one year and can be renewed, and the bureau a consumer contacts must tell the other two. An extended alert lasts seven years.
The third tool, the block under 15 U.S.C. § 1681c-2, is covered in the sections below, as is the FTC's IdentityTheft.gov, where the CFPB says a consumer reports identity theft to the FTC.
What an Identity Theft Report Is and How It Works
An identity theft report is the formal record of the theft that unlocks several FCRA rights. The CFPB explains that a person who reports identity theft to the FTC at IdentityTheft.gov receives an Identity Theft Report and a recovery plan that walks through next steps. A consumer may also file a police report.
What the report unlocks is concrete. The FTC states that the seven-year extended fraud alert is available to people who have completed an FTC identity theft report at IdentityTheft.gov or filed a police report. A copy of an identity theft report is also one of the four items a consumer reporting agency needs before it must block fraudulent information under 15 U.S.C. § 1681c-2. And when a consumer places an initial fraud alert, the CFPB says the consumer may order one free copy of the credit report from each nationwide bureau, separate from the free annual report.
A report is a tool, not a fix. Filing one starts these legal processes; it does not by itself remove anything or end the misuse.
How Fraudulent Accounts and Errors Appear on a Consumer Report
A consumer report, as 15 U.S.C. § 1681a(d) defines it, is a communication by a consumer reporting agency of information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used as a factor in establishing the consumer's eligibility for credit or insurance for personal, family, or household purposes, for employment purposes, or for another purpose authorized under 15 U.S.C. § 1681b. According to the FTC, accounts in a consumer's name that the consumer does not recognize could be a sign of identity theft. For the full picture of that problem, see the page on an account that isn't yours.
Under 15 U.S.C. § 1681i, when a consumer disputes the completeness or accuracy of an item in the file, the agency generally must, free of charge, conduct a reasonable reinvestigation and record the item's current status or delete it within 30 days of receiving the dispute. That period may be extended by up to 15 days if the consumer sends relevant information during the 30 days, but not where the item is found inaccurate or incomplete or cannot be verified. The agency must notify the furnisher within 5 business days. An agency may end a reinvestigation it reasonably finds frivolous or irrelevant.
Furnishers have their own duties under 15 U.S.C. § 1681s-2. A furnisher may not report information it knows or has reasonable cause to believe is inaccurate, which means having specific knowledge, other than solely allegations by the consumer, that would cause a reasonable person to have substantial doubts about its accuracy; a furnisher that clearly and conspicuously specifies an address for notices is instead covered by the notice rule that follows. A furnisher also may not report information after the consumer has told it, at the address it specifies for such notices, that specific information is inaccurate, if the information is in fact inaccurate. Under 15 U.S.C. § 1681s-2(c), and except as provided in 15 U.S.C. § 1681s(c)(1)(B), the civil liability provisions of 15 U.S.C. § 1681n and 15 U.S.C. § 1681o do not apply to a violation of those subsection (a) duties. More on this process appears on the credit report error page.
Is Identity Theft a Federal Crime?
Identity theft can be a federal crime. 18 U.S.C. § 1028 is the federal criminal statute on fraud connected with identification documents, authentication features and identifying information. Under 18 U.S.C. § 1028(a)(7), that includes a person who knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law. When the theft involves breaking into a computer, 18 U.S.C. § 1030, the federal law on fraud connected with computers, may also be involved.
Criminal law and consumer law run on separate tracks. The FCRA, by contrast, provides for civil liability under 15 U.S.C. § 1681n and 15 U.S.C. § 1681o, discussed below, and its identity theft tools, the fraud alert, the security freeze and the block, operate on the consumer's credit file.
What Happens After a Breach: The Consumer's Situation and Available Options
After a breach notice, a consumer may look at their credit reports and weigh which tools fit. Under 15 U.S.C. § 1681j, each nationwide consumer reporting agency must provide a free disclosure once in any 12-month period on request made through the centralized source set up for that purpose, within 15 days of the request. A reinvestigation requested after that free report must be completed within 45 days.
From there, a consumer may place a fraud alert, place a security freeze, file an FTC identity theft report, dispute fraudulent accounts with the agencies and furnishers, or ask for a block of fraudulent information. The CFPB notes that the federal free-freeze law does not apply to someone requesting a report for employment, tenant-screening or insurance purposes, and that a freeze does not affect credit scores. The CFPB also states that once furnishers are notified of a block, creditors cannot turn identity-theft-related debts over to debt collectors.
The CFPB explains that people with authority to act for "protected consumers," including those under 16, can request a freeze, and that a bureau with no file on the child will create a record in order to freeze it. None of these steps guarantees a particular result.
When Civil Legal Rights May Be Relevant
The FCRA attaches civil liability to two kinds of failure. Under 15 U.S.C. § 1681n, a person who "willfully fails to comply" with an FCRA requirement with respect to a consumer is liable for actual damages or damages "of not less than $100 and not more than $1,000," plus "such amount of punitive damages as the court may allow," and, in a successful action, costs and reasonable attorney's fees. Under 15 U.S.C. § 1681o, negligent noncompliance makes a person liable for actual damages sustained as a result, and costs and fees in a successful action. These are what the statute makes potentially available; each depends on proof of the failure, its willful or negligent character, and, for actual damages, harm caused by it.
Conduct may violate the FCRA when, for example, a consumer reporting agency fails to block information within 4 business days after receiving proof of identity, an identity theft report, the consumer's identification of the information and the consumer's statement that it is not theirs, unless an exception in 15 U.S.C. § 1681c-2 applies, including the agency's reasonable determination under 15 U.S.C. § 1681c-2(c) that it may decline to block. Whether any particular situation violates the law depends on its facts. Not every breach notice, and not every credit report error, gives rise to a civil claim. More detail is on the page about consumer rights remedies.
If You'd Like a Consumer Rights Case Review
This page covers the federal credit reporting tools that bear on identity theft after a data breach. It does not cover the breached company's own security obligations or identity theft rules under state law; more on the topic appears on the identity theft page.
A request for a consumer rights case review may be made through Federal Consumer Rights.
