When identity theft puts accounts you never opened on your credit report, federal law gives you two tools: a dispute that the credit bureau must reinvestigate, generally within 30 days, and a block of the fraudulent information, generally within four business days of the required documents. Both come from the federal Fair Credit Reporting Act, and each carries conditions that the sections below set out.
This page explains what federal law requires of the companies that keep these records and what a consumer may ask for.
What Identity Theft Does to a Credit Report
Identity theft can leave marks on a credit report such as new accounts opened in the consumer's name, hard inquiries from applications the consumer never made, collection accounts for debts the consumer does not owe, and addresses the consumer never lived at. Each is information someone else's conduct put into the consumer's file.
A few terms matter here. A consumer report is, in the words of 15 U.S.C. § 1681a(d)(1), a communication of information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected in part as a factor in establishing the consumer's eligibility for credit or insurance, employment, or another purpose the statute authorizes; a credit report is the most familiar example. A consumer reporting agency is a company that compiles and sells those reports; the CFPB explains that credit reporting companies are "also known as credit bureaus or consumer reporting agencies" (CFPB). A furnisher is a creditor, lender or debt collector that supplies account information to an agency.
The federal law that governs how agencies and furnishers handle disputed and fraudulent information is the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq. Congress stated its purpose as requiring agencies to adopt reasonable procedures that are fair to the consumer "with regard to the confidentiality, accuracy, relevancy, and proper utilization" of the information, under 15 U.S.C. § 1681(b). The broader topic of identity theft accounts on credit reports has its own page on this site.
How to Check Whether Someone Is Using Your Identity
A credit report itself is often where identity theft shows up. The FTC calls checking a credit report "a good way to spot identity theft" (FTC).
The FTC states that AnnualCreditReport.com is the only website "authorized to fill orders for the free annual credit reports you are entitled to by law," that federal law requires each nationwide bureau to give a free copy once every 12 months on request, and that the three bureaus have permanently extended a program allowing a free check from each once a week through that site (FTC). The FTC also warns that imposter sites copy the name.
The signs on a report are concrete: accounts the consumer did not open, creditors the consumer never applied to, addresses the consumer never used, and inquiries from companies the consumer never contacted. A single account that isn't yours can be the first visible sign.
An identity theft report is defined in 15 U.S.C. § 1681a(q)(4) as, at a minimum, a report that alleges an identity theft; that is a copy of an official, valid report filed by a consumer with an appropriate Federal, State, or local law enforcement agency, including the United States Postal Inspection Service, or another government agency the CFPB deems appropriate; and whose filing subjects the person filing it to criminal penalties relating to the filing of false information if the information is false. The CFPB says a person who reports identity theft to the FTC at IdentityTheft.gov "will get an Identity Theft Report and recovery plan" (CFPB). A copy of an identity theft report is one of the four items the FCRA's blocking rule requires.
What the FCRA Requires When Identity Theft Affects a Credit Report
These federal duties apply across the United States.
The block. Under 15 U.S.C. § 1681c-2(a), an agency generally must block the reporting of information the consumer identifies as resulting from an alleged identity theft no later than 4 business days after it receives all four of these: appropriate proof of the consumer's identity; a copy of an identity theft report; the consumer's identification of the information; and the consumer's statement that the information does not relate to any transaction by the consumer. The agency must promptly notify the furnisher that the information may result from identity theft, that a report was filed, that a block was requested, and the block's effective dates. An agency may decline or rescind a block if it reasonably determines that the information was blocked in error or a block was requested by the consumer in error, that the block was requested on the basis of a material misrepresentation of fact by the consumer relevant to the request, or that the consumer obtained possession of goods, services, or money as a result of the blocked transaction, and it must then notify the consumer promptly. Narrower rules apply to some resellers and check services companies.
The reinvestigation. A reinvestigation is the agency's review of an item a consumer disputes. Under 15 U.S.C. § 1681i(a), an agency generally must, free of charge, conduct a reasonable reinvestigation and record the item's current status or delete it within 30 days of receiving the dispute. That period may be extended by up to 15 days if the consumer sends relevant information during the 30 days, but not if the item is found inaccurate, incomplete or unverifiable within the 30 days. Within 5 business days of receiving the dispute, the agency must notify the furnisher and pass along all relevant information. An item found inaccurate, incomplete or unverifiable must be promptly deleted or modified. An agency may end a reinvestigation it reasonably determines is frivolous or irrelevant, and must say why within 5 business days. Deleted information may come back only on the rules covering reinserted information.
The furnisher's investigation. Once notified by the agency, a furnisher must, under 15 U.S.C. § 1681s-2(b), investigate, review the relevant information, report results to the agency, report inaccurate or incomplete results to every nationwide agency it furnished, and promptly modify, delete or permanently block an item found inaccurate, incomplete or unverifiable, all within the agency's deadline.
How to Fix a Credit Report After Identity Theft
A consumer dealing with identity theft on a credit report has two statutory tracks, a dispute and a block.
The first track is the dispute. A consumer may send a written dispute to an agency identifying the information believed to be inaccurate or fraudulent. The CFPB describes explaining in writing what is wrong and why, enclosing supporting documents, and keeping copies (CFPB). The agency's notice to the furnisher is what triggers the furnisher's duties under 15 U.S.C. § 1681s-2(b). Separately, the CFPB describes disputing directly with the furnisher in writing by certified mail, at the address on the report or one the furnisher specifies, and says furnishers "generally must investigate and respond to your dispute within 30 days." The general dispute process is covered further on the page about wrong information on credit reports.
The second track is the block under 15 U.S.C. § 1681c-2, which depends on the identity theft report and the other three items that rule lists. IdentityTheft.gov is the FTC's official federal resource for that report.
The FTC and CFPB also describe fraud alerts and security freezes. An initial fraud alert lasts one year, and the bureau contacted must tell the others (FTC); a freeze is free and must be placed at each nationwide bureau separately (CFPB). The CFPB's dispute guidance also includes a section on submitting a complaint to the CFPB.
What Remedies the FCRA Makes Potentially Available
The FCRA makes civil remedies potentially available. Those remedies depend on how a company failed to comply. Under 15 U.S.C. § 1681n, a person who willfully fails to comply with an FCRA requirement is liable for any actual damages sustained by the consumer as a result, or damages of not less than $100 and not more than $1,000; punitive damages as the court may allow; and, in a successful action, costs and reasonable attorney's fees as determined by the court. Under 15 U.S.C. § 1681o, a person who is negligent in failing to comply is liable for actual damages sustained as a result and, in a successful action, costs and reasonable attorney's fees. Under both, on a finding that an unsuccessful pleading, motion, or other paper filed in connection with an action was filed in bad faith or for purposes of harassment, the court shall award the prevailing party attorney's fees reasonable in relation to the work expended in responding to it.
Whether a particular situation gives rise to a claim under the FCRA depends on its facts. A related page on this site covers the topic of a credit report error attorney.
Submitting an Inquiry Through Federal Consumer Rights
Federal Consumer Rights is a website that provides information and facilitates inquiries about consumer-protection matters, including FCRA and identity theft issues. It is not a law firm, it does not provide legal advice, and it does not represent consumers.
A consumer with questions about identity theft and their credit report may submit an inquiry through this site. An inquiry may be passed to attorneys who decide for themselves whether to respond; an attorney may or may not respond, and submitting an inquiry does not create an attorney-client relationship.
This page covers federal credit reporting law as it applies to identity theft. It does not cover debt-collection lawsuits, bankruptcy, credit repair services, or any state's own identity theft laws, which may add protections and differ from state to state.
Requesting a Consumer Rights Case Review
This page covers federal credit reporting law on identity theft. It does not cover state identity theft law or whether any debt is owed.
A consumer may request a consumer rights case review through Federal Consumer Rights.
