Identity Theft on Your Credit Report: Freezes, Fraud Alerts, and the Four-Day Block

People usually learn about identity theft secondhand. A lender denies an application you didn't submit, a collector calls about a card you never opened, or an unfamiliar account appears on your credit report. The Fair Credit Reporting Act has tools written specifically for this situation, and several of them are faster and stronger than the ordinary dispute process.

This is the order we'd generally suggest working through them.

1. Get an identity theft report

Several FCRA rights depend on having an "identity theft report." The simplest way to get one is through the FTC at identitytheft.gov, which produces an official report and a recovery plan. A police report can also serve the purpose. Save a PDF copy before you do anything else.

2. Freeze your credit at all three bureaus

A security freeze stops a bureau from releasing your report to a new lender, which shuts down most new-account fraud. Under 15 U.S.C. § 1681c-1(i), placing and removing a freeze is free, and when you ask online or by phone, the bureau has to place it within one business day. A freeze doesn't affect your existing accounts or your credit score. You'll need to contact Equifax, Experian, and TransUnion separately, and lift the freeze temporarily when you apply for credit yourself.

3. Consider a fraud alert

Fraud alerts, covered by § 1681c-1, can be used alongside a freeze. Contact any one bureau and it must notify the other two. An initial alert lasts one year and requires businesses to take reasonable steps to verify your identity before extending credit. An extended alert lasts seven years, requires an identity theft report, entitles you to two free reports from each bureau within twelve months, and removes you from prescreened credit offers for five years.

4. Demand that the fraudulent items be blocked

This is the step most people miss. Under 15 U.S.C. § 1681c-2, a credit bureau must block information in your file that resulted from identity theft within four business days after it receives four things from you:

• appropriate proof of your identity,
• a copy of your identity theft report,
• identification of the specific information that resulted from the theft, and
• a statement that the information doesn't relate to any transaction you made.

A block isn't an investigation. The bureau doesn't get thirty days to check with the furnisher first. It has to block the information, then notify the furnisher that the information may be the result of identity theft. The bureau can decline or rescind a block only in limited situations, such as where the request was made in error, was based on a material misrepresentation, or you actually received goods or services from the transaction.

Send each bureau its own block request, with all four items, by certified mail.

5. Get the thief's paperwork

Under § 1681g(e), a business that opened an account or extended credit to someone using your identity must give you copies of the application and transaction records on request, free, within thirty days. Those records show what information the thief used, including addresses, phone numbers, and documents, which can help with everything else you're trying to fix. Businesses sometimes resist these requests. The statute is clear that they have to comply.

6. Deal with collectors

If a collector is pursuing a fraudulent account, § 1681m(g) requires it, once notified that the debt may result from identity theft, to tell the creditor and to give you information about the debt on request. Section 1681m(f) restricts selling or transferring a debt after a company has been notified it resulted from identity theft. Combined with the validation and dispute rights under the Fair Debt Collection Practices Act, this gives you real leverage over accounts that were never yours.

When a company doesn't follow the rules

A bureau that won't block, a furnisher that re-reports blocked information, or a business that won't hand over records may be liable under the FCRA. Willful violations carry actual damages or statutory damages of $100 to $1,000, plus punitive damages and attorney's fees under § 1681n. Negligent violations carry actual damages and fees under § 1681o. In identity theft cases, actual damages often include lost time, out-of-pocket costs, denied credit, and emotional distress.

Keep a log of every letter you send, every response you get, and every call you make. It will matter.