Identity Theft and Your Credit Report: Your FCRA Remedies

Under 15 U.S.C. § 1681c-2, when you identify information on your credit report as resulting from identity theft, a consumer reporting agency must block that information within four business days of receiving your request—provided you supply four specific items in writing. “Block” means the information disappears from your file and cannot be furnished to anyone pulling your report. This is not a request for investigation. It is a statutory mandate. The bureau’s obligation does not depend on whether it agrees with your claim; it depends on whether you have submitted the required documentation. Bureaus that miss the deadline, improperly refuse to block, or wrongfully rescind a block they already placed are civilly liable under § 1681n and § 1681o.

The Four-Business-Day Block Under § 1681c-2

The standard dispute process under § 1681i gives a consumer reporting agency up to 30 days—extendable to 45 days under some circumstances—to complete a reinvestigation. Identity theft victims get a shorter, categorically different remedy.

Section 1681c-2(a) requires a bureau, upon receipt of a proper request, to block reporting of any consumer file information the consumer identifies as resulting from “alleged identity theft” not later than four business days after the date of receipt. The word “alleged” is significant. You do not have to prove the theft occurred or wait for a creditor to confirm it. You allege it, you supply the documentation, and the obligation attaches.

The block covers whatever specific tradelines or pieces of information you identify—fraudulent credit card accounts, installment loans you never signed for, addresses a thief used that now appear in your personal information section. Once blocked, those items cannot appear in reports furnished to lenders, landlords, employers, or any other permissible-purpose user.

A § 1681c-2 block is legally distinct from a deletion through the § 1681i reinvestigation process. A bureau that conducts a reinvestigation and confirms the account is accurate will leave it on your report. A § 1681c-2 block does not require the bureau to determine accuracy first. It requires the bureau to act on your identification of the information and your identity theft report. That procedural asymmetry is the point of the statute.

What Your Block Request Must Contain

The four-business-day clock does not start until the bureau receives a request containing all four required components. A request missing any one element does not trigger the deadline.

Proof of identity. The bureau must be able to confirm you are the consumer whose file it holds. A legible copy of a government-issued photo ID and a document connecting you to your current address—a utility bill, bank statement, or lease—is the standard combination. Each bureau may specify its own acceptable documents; check their identity theft dispute instructions before submitting.

An identity theft report. Under § 1681a(q)(4), an identity theft report is one that alleges identity theft, is filed with an appropriate federal, state, or local law enforcement agency, and exposes the filer to criminal liability for false statements. The FTC identity theft report, completed at identitytheft.gov, satisfies this definition. A local police report also qualifies and provides an additional official record, but it is not required by the FCRA.

Specific identification of the information you want blocked. List each tradeline by creditor name and, where you have it, account number. Do not submit a general objection to “all inaccurate information.” The bureau’s obligation under § 1681c-2 is tied to the specific information you identify, and an imprecise request gives it grounds to do nothing.

A written statement that the information does not relate to any transaction by you. This is a sworn-like representation. You are affirming in writing that you did not open the account, make the charge, or receive the proceeds. Keep a dated copy.

Send the entire package by certified mail with return receipt to the address each bureau designates for identity theft disputes—a separate address from the general dispute address. Retain the tracking number. Photograph or scan everything before it leaves your hands. The date the bureau receives the package is the date the four-business-day period begins.

Fraud Alerts: A Complementary Mechanism Under § 1681c-1

A § 1681c-2 block removes specific fraudulent items already in your file. A fraud alert under § 1681c-1 adds a protective flag going forward, making it harder for a thief to open additional accounts in your name. The two tools serve different functions and should be used together.

Initial fraud alert. Under § 1681c-1(a), any consumer—not just identity theft victims—may place an initial fraud alert by contacting any one of the three major bureaus. That bureau must notify the other two. The alert lasts one year and requires any creditor who uses your report to take reasonable steps to verify your identity before extending credit.

Extended fraud alert. Under § 1681c-1(b), a consumer who has an identity theft report may place an extended alert lasting seven years. The obligations on creditors are more demanding: they must contact you directly at a telephone number you designate, or take other reasonable steps the Bureau may prescribe, before extending credit in your name. You are also entitled to two free credit report disclosures from each of the major bureaus within the twelve-month period following placement.

An extended fraud alert also removes you from prescreened credit offer lists for five years under § 1681c-1(b)(1)(B). Prescreened offers are a vector through which some identity theft occurs when mail is intercepted.

Place the fraud alert at the same time you submit your block requests. The block cleans up the existing fraudulent tradelines; the alert limits what a thief can add going forward.

When a Bureau Can Decline or Rescind a Block

Section 1681c-2(b) limits the circumstances under which a bureau may legally decline to block or rescind a block already placed. There are three grounds. Each requires the bureau’s own reasonable determination—not a furnisher’s say-so passed along without scrutiny.

Material misrepresentation by the consumer. If the bureau has actual evidence that you fabricated the identity theft claim, it may decline. A furnisher’s assertion that the account is valid is not by itself evidence of consumer misrepresentation.

The consumer obtained goods, services, or money from the transaction. This is the statutory carve-out for the consumer who attempts to escape a legitimate debt by falsely claiming fraud. If evidence shows you received the proceeds, the bureau may decline.

The block was made in error. This is the broadest exception and the one most frequently invoked improperly. Some bureaus treat a furnisher’s dispute of the block as a sufficient basis to rescind. It is not. The statute requires the bureau’s own determination that the block was in error—not deference to the entity whose account is at issue.

When a bureau rescinds a block, § 1681c-2(c) requires it to promptly notify the consumer in writing and explain the basis for the rescission. A rescission without notice is an independent violation of the statute.

Improperly declining or rescinding a block can be willful noncompliance under § 1681n. Courts consider whether the bureau acted in reckless disregard of a plainly applicable legal obligation—a standard the Supreme Court addressed in the context of FCRA liability in Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007). A bureau that receives a facially complete § 1681c-2 request and ignores the four-day deadline faces serious exposure under that standard.

Furnishers and the Re-Insertion Risk

Even after a bureau blocks a fraudulent tradeline, the furnisher—the bank, lender, or collection agency that reported the account—can disrupt the block through a formal dispute mechanism or cause the problem to resurface by reporting the same account to a different bureau.

Under § 1681c-2(f), a furnisher notified that information has been blocked may submit to the bureau a notice that the information is accurate. If the bureau finds that notice credible and based on the furnisher’s own investigation, it may unblock. This creates a predictable pressure point: furnishers sometimes submit accuracy certifications without conducting a real investigation, and some bureaus treat those certifications as conclusive.

Section 1681s-2(a)(6)(A) addresses the furnisher’s independent obligation. It prohibits any furnisher from reporting to a consumer reporting agency “any information that the furnisher knows or has reasonable cause to believe results from identity theft.” Once a furnisher has been notified through the block process—or through any other channel—that an account is alleged to be fraudulent, continued reporting of that account implicates this provision directly.

The risk compounds when charged-off fraudulent accounts are sold to debt collectors. The sale does not extinguish the fraudulent nature of the debt. If the original furnisher had notice that the account resulted from identity theft before selling it, the buyer takes on the reporting prohibition with the account. A debt buyer that receives a fraudulent account and then reports it as a valid collection tradeline may violate § 1681s-2(a)(6) independently.

In practice, this means identity theft victims often need to send block requests to each bureau, monitor all three reports for re-insertion, and be prepared to address both the original creditor and any downstream collector separately. A single block at one bureau does not immunize the other two from reporting the same fraudulent account.

Civil Liability When the FCRA Is Violated

The FCRA creates a private right of action that consumers bring in federal district court. The statute of limitations under § 1681p is two years from the date the consumer discovered the violation, but no longer than five years from the date the violation occurred. Both periods are subject to equitable tolling arguments in appropriate circumstances.

Willful violations — § 1681n. A consumer reporting agency or furnisher that willfully fails to comply with any FCRA requirement is liable for the greater of: actual damages sustained, or statutory damages between $100 and $1,000 per violation. Additionally, the court may award punitive damages and must award attorney fees and costs to a prevailing plaintiff. The willfulness standard reaches both knowing violations and those taken in reckless disregard of the law’s requirements.

Negligent violations — § 1681o. Negligent noncompliance entitles a consumer to actual damages and attorney fees. Statutory damages and punitive damages are not available under § 1681o, which is why establishing willfulness matters in litigation.

Actual damages in identity theft cases are not limited to denied credit applications. Courts have recognized damage categories including: interest rate increases on loans the consumer did obtain after the fraudulent account appeared, reputational harm, emotional distress supported by medical or other evidence, and documented out-of-pocket costs—postage, time off work, copying and notary fees—incurred pursuing the bureaus and furnishers. Each category requires evidence; a bare assertion of distress without supporting facts generally does not carry a jury.

The FCRA’s fee-shifting provision in § 1681n and § 1681o is part of the statute’s enforcement structure. Because a successful plaintiff recovers attorney fees, FCRA identity theft cases are typically litigated on contingency, meaning a consumer without funds to hire a lawyer can still obtain representation if the facts support a claim. The fee provision converts what might otherwise be individually uneconomical cases into enforceable rights.

One procedural point: filing a § 1681c-2 block request creates a paper trail that is essential in later litigation. A certified mail receipt, a copy of the request with all four required components, and documentation of the bureau’s response—or nonresponse—are the foundation of any claim. Consumers who skip certified mail and submit requests online or by fax frequently cannot prove the bureau received a complete request on a specific date, which is exactly what the four-business-day deadline turns on.