There's a Fraudulent Account From Identity Theft on My Report

A fraudulent account opened by an identity thief showing up on your credit report is a federal Fair Credit Reporting Act problem. The FCRA gives you a specific legal tool — not just a general dispute — designed exactly for this situation. Whether that tool works in your favor depends almost entirely on whether you follow the right process with the right documents.

What the FCRA Actually Requires Bureaus to Do

Congress addressed identity theft accounts directly in 15 U.S.C. § 1681c-2. The rule is clear: if you submit a written request to a credit bureau along with a valid identity theft report and proof of your identity, the bureau must block the fraudulent information from appearing on your report. The blocking deadline is four business days from receipt of your complete request.

This is not the same as a standard reinvestigation under § 1681i, which gives bureaus up to 30 days to investigate and resolve a dispute. The § 1681c-2 block is faster and more direct — the bureau is not weighing evidence of accuracy; it is honoring your assertion that the account is not yours.

After blocking, the bureau must also notify the furnisher — the bank, lender, or debt collector that reported the account — that the information has been blocked. This matters because the furnisher cannot then re-report the blocked account to any other bureau.

What Counts as a Valid Identity Theft Report

The term “identity theft report” has a specific meaning under the FCRA. It includes a report filed with a federal, state, or local law enforcement agency. It also includes the complaint form filed at IdentityTheft.gov, which is the FTC’s identity theft reporting portal. The FTC report qualifies on its own — you do not need to file a police report first, though having one strengthens your position significantly.

The report must contain enough detail that a reasonable person would conclude that you are a victim and that the specific account or information at issue is the result of the theft. A vague report that says only “my information may have been compromised” is unlikely to satisfy that standard. Name the specific accounts, creditors, and approximate dates if you know them.

Along with the identity theft report, you must provide proof of your identity. A copy of a government-issued ID and one document showing your current address — a utility bill, bank statement, or lease — is typically sufficient.

How to Send the Block Request Correctly

Your written block request must go directly to the credit bureau (Equifax, Experian, TransUnion — whichever is reporting the fraudulent account). Each bureau has a specific address for identity theft disputes that is separate from its general dispute address. Send by certified mail, return receipt requested, so you have evidence of the date the bureau received your package.

The request should identify: (1) the specific account or accounts you want blocked, (2) that the information is the result of identity theft, (3) the identity theft report you are enclosing, and (4) the proof of identity you are enclosing. Keep copies of everything.

If the bureau receives your complete request and does not block within four business days, it is in violation of § 1681c-2. The clock starts on the day they receive the package, not the day you mailed it — which is one reason the return receipt matters.

For a broader look at how credit bureau dispute rights work under federal law, see our guide on your rights under the FCRA.

When a Block Request Can Be Denied or Rescinded

The bureau is not required to block in every case. Under § 1681c-2(c), it may decline or rescind a block if it reasonably determines that:

• The block request was based on a material misrepresentation of fact made by you;
• You obtained goods, services, or money from the account in question (meaning the debt might actually be yours);
• The information is not the result of identity theft.

If the bureau rescinds a previously granted block, it must notify you in writing before the rescission takes effect. It must also tell you that you can dispute the information through the standard § 1681i reinvestigation process if you believe the rescission was wrong.

Bureaus sometimes rescind blocks improperly — for example, because a furnisher pushes back and asserts the account is valid without providing any real evidence. An improper rescission is its own FCRA violation and creates additional legal exposure for the bureau.

What Makes a Strong Claim vs. a Weak One

Strong identity theft FCRA claims share certain characteristics. The consumer filed an FTC identity theft report or police report promptly after discovering the account. The identity theft report specifically identifies the fraudulent accounts. The bureau received a complete, properly formatted block request with all required documentation. The bureau either failed to block within four business days, or blocked and then rescinded without a valid legal basis.

Weaker positions arise when the documentation is incomplete or vague, when there is any evidence the consumer actually authorized the account (even indirectly, such as by giving someone permission to apply on their behalf), or when the bureau did block and the consumer is disputing the rescission without specifics about why it was improper.

One common mistake: disputing through the bureau’s online portal without attaching the identity theft report. Online portals often strip attachments or route the submission through a general dispute process rather than triggering the § 1681c-2 block procedure. Written mail gives you a cleaner record of exactly what you sent and when.

What the Furnisher Must Do After a Block

When the bureau notifies a furnisher that an account has been blocked as identity theft, the furnisher cannot re-report that account to any credit reporting agency. If a creditor or collector receives that notice and continues reporting the account — to the same bureau or to a different one — it violates § 1681s-2(b).

Furnishers have their own dispute obligations under § 1681s-2(b) as well. If you send the furnisher direct written notice that the account is fraudulent and not yours, it must investigate and, if the information cannot be verified, stop reporting it. The FTC and CFPB have authority to take enforcement action against furnishers that ignore these obligations.

In practice, when a furnisher continues to report after a bureau block or after receiving written notice of identity theft, that conduct — combined with the bureau’s failure to permanently suppress the information — creates claims against both parties.

Your Legal Options If the Process Fails

If you followed the § 1681c-2 process correctly and the bureau did not block within four business days, or improperly rescinded a block, you have the right to sue under the FCRA. Under § 1681n, for willful violations, you can recover actual damages or statutory damages between $100 and $1,000 per violation, plus punitive damages and attorney’s fees. Under § 1681o, for negligent violations, actual damages and attorney’s fees are available.

You do not need to prove a specific dollar loss to recover statutory damages. Courts have found that furnishing false information about a consumer — including a fraudulent account — constitutes a cognizable harm under the statute.

Document everything: the date the bureau received your block request, any written response from the bureau, any credit report that continues to show the fraudulent account after the blocking deadline passed. That paper trail is the foundation of any FCRA claim.