Identity theft leaves civil consumer-law problems behind: fraudulent accounts on a credit report, debt collectors pursuing debts a person never took on, and charges the person never made. Federal law, mainly the Fair Credit Reporting Act, the Fair Debt Collection Practices Act and the Fair Credit Billing Act, governs those problems.
A person facing identity theft may find out sideways: a collection letter for an account they never opened, a credit report line they do not recognize, a card statement with charges from a city they have never visited, or a loan denial that makes no sense. What follows is often a strange mix of fear and embarrassment, as if the theft were somehow their fault, and a tiring round of calls to companies that ask them to prove a negative. The real question underneath is practical: which companies have to fix what, under which law.
This page walks through the federal rules that apply to credit reports, debt collectors and billing disputes after identity theft, the federal reporting process, and the records that matter.
What Identity Theft Is and What Federal Law Covers
Identity theft is someone using another person's personal information, such as a name, Social Security number or account number, without permission to open accounts, make charges or obtain credit. The Federal Trade Commission puts it in one line: identity theft "is when someone uses your personal or financial information without your permission."
Two separate tracks follow. The theft itself is a crime, and prosecuting the thief belongs to law enforcement and prosecutors. The damage it leaves behind in a victim's financial life is addressed by civil consumer-protection law, which regulates the companies that report, collect and bill on the fraudulent accounts. That second track is the subject of this page.
Three federal statutes do most of the work across the United States:
- The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., which governs credit bureaus and other companies that compile consumer reports, the businesses that supply information to them, and those that use the reports. Under 15 U.S.C. § 1681, its stated purpose is to require that consumer reporting agencies adopt reasonable procedures with regard to "the confidentiality, accuracy, relevancy, and proper utilization" of consumer information.
- The Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692 et seq., which 15 U.S.C. § 1692 says exists "to eliminate abusive debt collection practices by debt collectors."
- The Fair Credit Billing Act (FCBA), 15 U.S.C. § 1666 et seq., which governs billing errors on open-end credit accounts such as credit cards.
State law may add protections of its own, and those protections differ from state to state. A broader overview of these statutes appears on the page about a consumer rights attorney.
How Identity Theft Damages a Credit Report — and What the FCRA Requires
A consumer reporting agency (CRA) is a company, such as a credit bureau, that assembles information about consumers into reports sold to lenders, landlords, employers and others. A furnisher is a business, such as a lender or collector, that sends account information to a CRA. When a thief opens an account, the furnisher may report it under the victim's name, and the fraud can become part of the victim's file.
The FCRA gives identity theft victims a specific tool: a block. Under 15 U.S.C. § 1681c-2(a), a CRA generally must block the reporting of information the consumer identifies as resulting from alleged identity theft no later than 4 business days after it receives four things: appropriate proof of the consumer's identity, a copy of an identity theft report, the consumer's identification of the information, and a statement that the information does not relate to any transaction by the consumer. The CRA must then promptly notify the furnisher that the information may result from identity theft, that a report was filed, that a block was requested and the block's effective dates.
The block is what the statute makes available, and it has exceptions. A CRA may decline or rescind a block if it reasonably determines the information was blocked in error or a block was requested by the consumer in error, the information was blocked or a block was requested on the basis of a material misrepresentation of fact by the consumer, or the consumer obtained possession of goods, services or money as a result of the blocked transaction, and it must notify the consumer promptly if it does. Separate rules apply to resellers and check services companies.
Apart from the block, the FCRA requires a CRA to conduct a reinvestigation, meaning a fresh check of disputed information, when a consumer disputes an item in the file.
Debt Collectors and Identity Theft: What the FDCPA Covers
A collector calling about an account you never opened can feel like being accused of something you did not do. The FDCPA sets rules for how that collector may behave.
Under 15 U.S.C. § 1692a(6), a debt collector is any person who uses interstate commerce or the mails "in any business the principal purpose of which is the collection of any debts, or who regularly collects or attempts to collect, directly or indirectly, debts owed or due or asserted to be owed or due another." The statute lists exclusions, including a creditor's own employees collecting in the creditor's name. The FDCPA governs debt collectors as that definition describes them.
Debt validation is the collector's duty to identify the debt and back it up on request. Under 15 U.S.C. § 1692g(a), within five days after its initial communication, a debt collector generally must send a written notice, unless the information was in that first communication or the consumer has paid, containing, among other items, the amount of the debt, the name of the creditor to whom it is owed, and a statement that unless the consumer disputes the validity of the debt within thirty days after receipt of the notice, the collector will assume it valid. If a consumer notifies the collector in writing within that thirty-day period that the debt, or any part of it, is disputed, 15 U.S.C. § 1692g(b) requires the collector to stop collecting the disputed amount until it obtains verification of the debt or a copy of a judgment, or the name and address of the original creditor, and mails a copy to the consumer. A consumer who believes a debt came from identity theft may send that written dispute. Not disputing, under 15 U.S.C. § 1692g(c), may not be treated by a court as an admission of liability.
A debt, under 15 U.S.C. § 1692a(5), is any obligation or alleged obligation of a consumer to pay money arising out of a transaction primarily for personal, family or household purposes, so the FDCPA's conduct rules are not limited to debts that prove valid. The CFPB describes harassment by a debt collector as including repetitious calls or messages intended to harass, obscene language, threats of violence and calls without the collector giving its name. Contacts with relatives are covered on the page about collectors calling family members.
Fixing Unauthorized Charges Under the Fair Credit Billing Act
When the theft shows up as charges on an existing credit card, the FCBA supplies a separate process aimed at the card issuer. Under 15 U.S.C. § 1666(b), a "billing error" includes a statement showing an extension of credit that was not made to the account holder.
The process runs on written notice. If the creditor receives, at the address it discloses for billing errors, a written notice within sixty days after sending the statement, identifying the account, the amount believed to be in error and the reasons, 15 U.S.C. § 1666(a) requires the creditor to send a written acknowledgment within thirty days, unless it resolves the matter sooner. Within two complete billing cycles, and in no event later than ninety days, and before trying to collect the disputed amount, it must either correct the account, including crediting finance charges, or send a written explanation after investigating.
While that explanation is pending, 15 U.S.C. § 1666(d) says a creditor on an open-end plan may not restrict or close the account solely because the disputed amount went unpaid, though it may apply the amount against the credit limit. Under 15 U.S.C. § 1666(a), a notice on a payment stub or other payment medium supplied by the creditor does not count as the written notice if the creditor so stipulates in its disclosure.
The FCBA governs the card issuer's handling of the bill. Reporting by credit bureaus and collection by debt collectors are covered by the FCRA and the FDCPA, described above.
Filing an Identity Theft Report with the FTC
The FTC states that a person who thinks someone stole their identity can report it to the FTC at IdentityTheft.gov and "get a free personal recovery plan with next steps." The CFPB's page for identity theft victims adds that a person reporting there "will get an Identity Theft Report and recovery plan that walks you through the steps to take."
The FCRA block rests on an identity theft report: a copy of an identity theft report is one of the four items 15 U.S.C. § 1681c-2(a) lists. Under 15 U.S.C. § 1681a(q)(4), an identity theft report means, at a minimum, a report that alleges an identity theft, that is a copy of an official, valid report filed by a consumer with an appropriate federal, state or local law enforcement agency, including the United States Postal Inspection Service, or another government agency the Consumer Financial Protection Bureau deems appropriate, and whose filing subjects the person filing it to criminal penalties relating to the filing of false information if that information is false. The CFPB describes the block request as including a letter identifying the fraudulent debts and information, notes that a sample letter is available on IdentityTheft.gov, and states that once notified, "creditors can't turn identity theft-related debts over to debt collectors." That statement summarizes a rule that carries exceptions, including the repurchase of a debt and a transfer of debt as a result of a merger, acquisition or transfer of substantially all of an entity's assets.
The report also matters for fraud alerts. According to the FTC's page on credit freezes and fraud alerts, an extended fraud alert lasting seven years is available to people who have completed an FTC identity theft report or filed a police report, while an initial fraud alert lasts one year and can be placed by contacting one of the three bureaus. The CFPB explains that a security freeze is free and must be placed within one business day of a telephone or secure electronic request, or three business days after a mailed request.
The CFPB's harassment page states that a consumer who believes a debt collector is harassing them can submit a complaint with the CFPB.
When Identity Theft Problems May Become Consumer-Law Issues
Examples that may raise a consumer-law question include a fraudulent account that remains on a credit report after a dispute or a block request; a debt collector that keeps pursuing a debt after a written dispute; and adverse action based on a fraudulent account. Adverse action means a negative decision, such as a denial of credit, insurance or a job, based in whole or in part on a consumer report.
On remedies, 15 U.S.C. § 1692k(a) makes a debt collector that fails to comply with the FDCPA liable for any actual damage sustained, for such additional damages as the court may allow in an individual action, but not exceeding $1,000, and, in a successful action, for the costs of the action and a reasonable attorney's fee as determined by the court; under 15 U.S.C. § 1692k(d) an action may be brought within one year from the date on which the violation occurs. Each part depends on proving a violation, on the facts, and on the court. The FCRA has its own remedy provisions; the FCRA's rule on business records for victims, 15 U.S.C. § 1681g(e)(6), says that, except as provided in 15 U.S.C. § 1681s, 15 U.S.C. §§ 1681n and 1681o do not apply to violations of that subsection. More on how these cases work appears on the page about a consumer lawsuit.
Whether any situation violates one of these statutes depends on its facts. This page does not cover criminal prosecution of identity theft, immigration consequences connected to identity theft, data breach litigation, or problems outside consumer-protection law.
What Evidence Typically Matters in an Identity Theft Matter
Evidence in these matters is mostly paper, and a victim usually has more of it than they realize. The FTC identity theft report from IdentityTheft.gov is one of the key documents: the FTC says an extended fraud alert is available to people who have completed it or filed a police report, and a block under 15 U.S.C. § 1681c-2(a) requires a copy of an identity theft report as 15 U.S.C. § 1681a(q)(4) defines that term.
Documentation that is typically relevant includes:
- the FTC identity theft report and any police report, if one was filed;
- credit reports from each bureau showing the fraudulent accounts, with the dates they were pulled;
- every letter sent to and received from CRAs, including block requests, disputes and responses;
- collection letters, the validation notice, any written dispute and the collector's reply;
- account statements showing unauthorized charges, and any FCBA billing-error notice and the creditor's answer;
- denial letters or other notices of adverse action;
- notes of calls, with dates, times and what was said, which the CFPB describes as records that "can help you if you're disputing the debt, meeting with a lawyer, or going to court."
Victims can also obtain the thief's paperwork. Under 15 U.S.C. § 1681g(e), a business that dealt with the impostor generally must provide copies of application and transaction records, without charge, no later than 30 days after a victim's written request, subject to verification of the victim's identity and claim, and it may decline in good faith on grounds the statute lists, including lack of confidence in the requester's identity.
Submitting an Inquiry Through Federal Consumer Rights
Federal Consumer Rights is a website that provides information and facilitates inquiries concerning consumer-protection matters under federal law. It is not a law firm and does not represent anyone.
An inquiry sent through this site may be passed to attorneys, who decide for themselves whether to respond. This site cannot say whether anyone will respond, when, or whether anyone will take a matter.
The identity theft problems this site focuses on are the consumer-law ones: fraudulent accounts on credit reports, debt collection on debts that came from fraud, billing disputes over unauthorized charges, and decisions made on reports carrying fraudulent information. Matters outside consumer-protection law, such as criminal defense or a situation where no consumer-protection statute applies, fall outside what this page addresses.
Requesting a Consumer Rights Case Review
This page does not cover criminal prosecution, immigration questions or whether any particular bill should be paid.
A person may request a consumer rights case review through Federal Consumer Rights.
