When a debt collector contacts someone about a debt an identity thief created, federal law gives that person tools. A consumer may dispute the debt in writing within 30 days of receiving the collector's notice, and the collector must then stop collecting until it sends verification. A collector acting for a creditor must tell it when notified of possible identity theft, and credit bureaus must block identity theft information once the consumer supplies what federal law requires.
A consumer in this situation may be holding a letter, or may have just hung up on a call, about an account they never opened and a balance they never ran up. Some are also seeing that same account on their credit report for the first time. The questions come quickly: whether they have to deal with this collector at all, whether the account will follow them, and what the law actually requires of the companies involved.
This page walks through the two federal statutes that answer those questions, one for the collector and one for the credit report, and explains how each works when the debt is not really yours.
Identity theft, in plain words, is someone else using a consumer's personal or financial information without permission. The FTC's page What To Know About Identity Theft describes it that way. When the thief opens an account and leaves it unpaid, the account can be sold or handed to a collection company. A collection notice then lands on the person whose name was used.
Two federal laws of the United States apply. The Fair Debt Collection Practices Act (FDCPA) governs debt collectors. The Fair Credit Reporting Act (FCRA) governs credit bureaus and the companies that send them information.
Under 15 U.S.C. § 1692a(6), a "debt collector" is a person in any business the principal purpose of which is the collection of any debts, or who regularly collects or attempts to collect debts owed or due or asserted to be owed or due another. The test turns on a business's principal purpose or its regular collection for others. The definition also lists exclusions, including any officer or employee of a creditor while, in the name of the creditor, collecting debts for the creditor, and a person collecting a debt owed or due another to the extent the debt was originated by that person. Under 15 U.S.C. § 1692a(5), a "debt" is "any obligation or alleged obligation of a consumer to pay money arising out of a transaction in which the money, property, insurance, or services which are the subject of the transaction are primarily for personal, family, or household purposes."
State law may add protections, and it differs from state to state.
What the FDCPA Requires When a Consumer Disputes a Debt
Debt validation is the process by which a collector gives a consumer written information about a debt and, after a dispute, verification of it. Under 15 U.S.C. § 1692g(a), within five days after its initial communication, a debt collector generally must send a written notice. Among other items, the notice must state the amount of the debt and the name of the creditor. It must also say that unless the consumer disputes the debt within thirty days after receiving the notice, the collector will assume it is valid. The collector does not have to send it if that information was in the initial communication or the consumer has paid. Regulation F, 12 C.F.R. § 1006.34, adds further required items, including an itemization of the debt.
Under 15 U.S.C. § 1692g(b), a consumer may dispute the debt in writing within that thirty-day period. The collector must then cease collection of the debt, or the disputed portion, until it obtains verification or a copy of a judgment and mails it to the consumer. Under 12 C.F.R. § 1006.38(d)(1), not disputing is not a legal admission of owing the debt. The page on failed debt validation covers this in more detail.
Two broader rules also apply. Under 15 U.S.C. § 1692e, a collector may not use any false, deceptive or misleading representation in connection with collecting a debt. Falsely representing the character, amount or legal status of a debt may violate that section. Under 15 U.S.C. § 1692f, collecting any amount not expressly authorized by the agreement creating the debt or permitted by law may violate the FDCPA. Whether a particular situation violates the FDCPA depends on its facts.
How Identity Theft Affects a Credit Report and What the FCRA Allows
A consumer reporting agency is a company that assembles or evaluates information about consumers and furnishes consumer reports to others; the nationwide credit bureaus are the familiar example. A consumer report is that company's communication about a person's credit standing and related matters. A furnisher is a company, such as a lender or collector, that supplies information about a consumer to a consumer reporting agency.
The first FCRA tool is a fraud alert. Under 15 U.S.C. § 1681c-1(a), a consumer who in good faith suspects being a victim of fraud or identity theft may ask a nationwide consumer reporting agency for one. Once it has appropriate proof of the requester's identity, the agency must keep the alert for not less than one year, unless the consumer asks to remove it earlier, and refer the information to the other nationwide agencies.
The second is a block. According to the CFPB's page on what to do as an identity theft victim, credit reporting companies must block fraudulent information within four business days after receiving a request. They must also tell the furnishers. The CFPB adds that companies can refuse or remove a block if the information provided is not correct or the debt is not from identity theft. The block right is 15 U.S.C. § 1681c-2, under which the four business days run from the agency's receipt of appropriate proof of the consumer's identity, a copy of an identity theft report, the consumer's identification of the information, and a statement by the consumer that the information is not information relating to any transaction by the consumer. The agency may decline to block, or rescind a block, if it reasonably determines that the information was blocked in error or a block was requested in error, that the block was requested on the basis of a material misrepresentation of fact by the consumer, or that the consumer obtained possession of goods, services, or money as a result of the blocked transaction. The topic is covered further in identity theft credit report accounts.
The third is a reinvestigation, meaning the agency's review of information a consumer disputes. Under 15 U.S.C. § 1681i(a), the agency must, unless it reasonably determines the dispute is frivolous or irrelevant, reasonably reinvestigate, free of charge, within 30 days of receiving the dispute. The deadline may extend by up to 15 days if the consumer sends relevant information during that time, but not when the information is found inaccurate or incomplete, or cannot be verified, during the 30 days. Under 15 U.S.C. § 1681s-2(b), a furnisher that receives notice of the dispute from the agency must investigate and report the results to the agency. If a disputed item is found inaccurate or incomplete, or cannot be verified, the furnisher must promptly, as appropriate, modify it, delete it, or permanently block its reporting.
Some FDCPA rules speak to identity directly. The CFPB's page on harassment by a debt collector lists calling without telling the consumer the caller's name as harassment. Under 15 U.S.C. § 1692e, falsely implying that the caller is an attorney may violate the statute, as may representing that nonpayment of a debt will result in arrest or imprisonment unless such action is lawful and the debt collector or creditor intends to take it. A collector that refuses to give its name or a mailing address for disputes is behaving unlike the validation notice Regulation F describes. That notice must include the collector's name and the mailing address at which it accepts disputes.
Contact rules also apply. Under 15 U.S.C. § 1692c(b), a collector generally may not discuss the debt with third parties, subject to the statute's exceptions. Under 15 U.S.C. § 1692c(c), a consumer may notify a collector in writing to stop communicating. After that, the collector may contact the consumer only to say its efforts are ending, or to give notice that it or the creditor may invoke, or intends to invoke, a specified remedy. If the notice is mailed, it is complete on receipt. The CFPB's page What is a debt collector? notes that a stop request does not necessarily stop a lawsuit or credit reporting. Calling patterns are covered in debt collector keeps calling.
Filing a Complaint and the Official Dispute Process
Federal agencies run their own processes alongside the statutory rights. The CFPB's page on what a debt collector is states that a consumer having issues with debt collection may submit a complaint with the CFPB.
For identity theft itself, the CFPB's identity theft guidance says a victim may report it to the FTC at IdentityTheft.gov. It says the victim gets an Identity Theft Report and recovery plan there. The same page says IdentityTheft.gov offers a sample letter for a block request.
The FTC's Credit Freezes and Fraud Alerts page explains that an extended fraud alert lasts seven years. It is available to people who completed an FTC identity theft report or filed a police report. The CFPB's credit freeze page explains that a freeze is free. A nationwide company must place it within one business day of a phone or online request, or three business days after a mailed one.
The FCRA also reaches the collector. Under 15 U.S.C. § 1681m(g), a person acting as a debt collector on behalf of a third party that is a creditor or other user of a consumer report, once notified that information relating to a debt it is attempting to collect may be fraudulent or may be the result of identity theft, must notify that third party. On the consumer's request, it must also provide the consumer all information to which the consumer would otherwise be entitled if the consumer were not a victim of identity theft but wished to dispute the debt under the law applicable to that person. Filing a complaint or report does not determine any particular result.
What Federal Law Makes Potentially Available When Rights Are Violated
Liability under either statute depends on the facts, and not every departure from a rule leads to it. Each statute sets out what a court may award, and each sets conditions.
Under 15 U.S.C. § 1692k(a), a debt collector who fails to comply with the FDCPA with respect to a person is liable for any actual damage the failure caused. It is also liable for additional damages the court may allow, not exceeding $1,000 in an individual action. In a successful action, it is liable for costs and a reasonable attorney's fee as determined by the court. Under 15 U.S.C. § 1692k(b), the court considers factors including the frequency, persistence, nature and intentional character of the noncompliance. A debt collector is not liable if it shows by a preponderance of evidence that the violation was not intentional and resulted from a bona fide error notwithstanding the maintenance of procedures reasonably adapted to avoid any such error (15 U.S.C. § 1692k(c)). Under 15 U.S.C. § 1692k(d), an action must be brought within one year from the date the violation occurs.
Under 15 U.S.C. § 1681n(a), a person who willfully fails to comply with the FCRA is liable for actual damages, or damages of not less than $100 and not more than $1,000. The person is also liable for punitive damages the court may allow, and costs and reasonable attorney's fees in a successful action. The FCRA addresses negligent noncompliance separately. Under 15 U.S.C. § 1681s-2(c), those liability sections do not apply to a violation of subsection (a) of 15 U.S.C. § 1681s-2, which is separate from the furnisher's dispute duties in subsection (b) described above. Broader FDCPA rules appear in illegal debt collection practices.
If You'd Like a Consumer Rights Case Review
Identity theft collection problems tend to sit across two laws at once, which is why the details matter. This page explains the federal framework only; it does not cover bankruptcy or debt settlement.
A reader may request a consumer rights case review through Federal Consumer Rights.
