Identity Theft on Your Credit Report: When the Bureaus Won't Block It

You pulled your credit report and found an account you never opened. A credit card from a bank you have never used. An auto loan in a state you have never lived in. A collection account for a debt that was never yours. Someone used your name, and now the damage is sitting on your file where every lender, landlord, and employer can see it.

Here is what most people do not know. Federal law does not simply ask the credit bureaus to investigate fraudulent accounts. It requires them to block that information from your credit report, and it gives them a deadline measured in days. When a credit bureau or the company that reported the account ignores that obligation, the failure is itself a violation of federal law, and you may be entitled to money damages.

This is the part of identity theft that goes unaddressed. Victims spend months disputing and re-disputing, never realizing the law was already on their side and the clock was already running.

What the law says: your right to have fraud blocked

The Fair Credit Reporting Act contains a provision written specifically for identity theft victims. Under 15 U.S.C. § 1681c-2, a credit reporting agency must block the reporting of any information that a consumer identifies as resulting from identity theft. The block must happen within four business days of the bureau receiving all of the following:

• Appropriate proof of your identity.

• A copy of an identity theft report.

• Identification of the specific information you say is fraudulent.

• A statement from you that the information does not relate to any transaction you made.

Four business days is a much shorter and much harder deadline than the general dispute process most people are steered toward. An ordinary dispute under 15 U.S.C. § 1681i gives the bureau 30 days to reinvestigate, extendable to 45 days if you supply additional information during that window. The identity theft block is a separate and faster right, and it does not depend on the bureau agreeing with you after an investigation. The bureau does keep a narrow ability under § 1681c-2(c) to decline or rescind a block if it reasonably determines the block was made in error, that the request rested on a material misrepresentation, or that you obtained goods, services, or money from the transaction. Complete and accurate paperwork is what keeps that exception from being turned against you.

The term identity theft report is defined in 15 U.S.C. § 1681a(q)(4). It means a copy of an official, valid report that alleges identity theft, that you filed with a federal, state, or local law enforcement agency, and whose filing carries criminal penalties for knowingly false statements. The Identity Theft Report generated at the Federal Trade Commission's IdentityTheft.gov is widely accepted by the nationwide credit bureaus for this purpose, and the FTC provides it so that victims can assert these rights. Be aware, though, that both the statute and the CFPB's implementing rule at 12 C.F.R. § 1022.3 frame the definition around an official report filed with a law enforcement agency, and some furnishers still insist on a police report. File both if you can. Documentation is what turns a frustrating situation into a provable claim.

The obligation does not stop with the bureaus. Under 15 U.S.C. § 1681s-2(a)(6)(B), once you submit an identity theft report to a furnisher at the address that company has specified for receiving such reports, it may not keep furnishing the disputed information to the bureaus. That particular subsection is enforced by the CFPB, the FTC, and state officials rather than through private lawsuits. The furnisher duty you can enforce yourself is the one in 15 U.S.C. § 1681s-2(b), which is triggered when a credit bureau forwards your dispute to the furnisher and then obligates that company to investigate and to correct or delete what it cannot verify. That is why disputing through the bureaus, and not only directly with the creditor, is what preserves your own claim against the company that reported the account.

Florida law reaches further than the federal debt collection statute here. The Fair Debt Collection Practices Act generally applies to third-party debt collectors, not to a creditor collecting its own debt. Florida's Consumer Collection Practices Act at Fla. Stat. § 559.72 does reach original creditors, so a bank pursuing you on an account that was opened in your name by a thief can be answerable under Florida law even where the federal statute would not apply to it.

How to identify a violation

Identity theft alone is not an FCRA claim. The claim arises from how the bureaus and the furnishers respond after you tell them. These are the fact patterns that matter:

1. The block never happened. You sent proof of identity, an identity theft report, and a clear statement that the account was not yours, and the account is still on your report weeks later.

2. The account came back. The bureau blocked or deleted the fraudulent account, then it reappeared on a later report. 15 U.S.C. § 1681i(a)(5)(B) governs re-insertion of deleted disputed information and requires the bureau to notify you in writing within five business days if it puts the item back. Re-insertion of information already established as fraudulent is a serious problem for the furnisher and the bureau alike.

3. The bureau "verified" the fraud. You disputed, and the bureau came back saying the account was verified as accurate. When you have handed over an identity theft report, a response that amounts to nothing more than the furnisher confirming its own records is worth challenging as an unreasonable reinvestigation.

4. The bureau treated your dispute as frivolous. Bureaus have a narrow right under 15 U.S.C. § 1681i(a)(3) to decline disputes they reasonably determine are frivolous or irrelevant, and a documented identity theft claim with supporting paperwork is not one.

5. A collector kept collecting. If a debt collector continues to demand payment on an account after you have told it the debt is the product of identity theft and provided documentation, the conduct can also violate the Fair Debt Collection Practices Act, including its prohibition on falsely representing the character or amount of a debt under 15 U.S.C. § 1692e(2)(A) and its ban on unfair collection means under 15 U.S.C. § 1692f.

6. The mixed file problem. Sometimes the account is real but belongs to someone else with a similar name or a transposed Social Security number. That is not identity theft in the criminal sense, but it is still inaccurate reporting, and we cover it in our guide to a wrong collection account on your credit report.

The common thread is documentation followed by inaction.

What you can recover

The FCRA separates violations into two tiers, and the distinction controls what you can recover.

For willful noncompliance, 15 U.S.C. § 1681n allows you to recover either your actual damages or statutory damages of $100 to $1,000, whichever you elect, plus punitive damages as the court allows, plus your costs and reasonable attorney's fees. Willful does not require proof that anyone set out to harm you. In Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), the Supreme Court held that willfulness under the FCRA reaches reckless disregard of the statute and not only knowing violations. Recklessness is still a real threshold rather than a formality, because the conduct has to carry a risk of violating the law substantially greater than the risk that comes with a merely careless reading.

For negligent noncompliance, 15 U.S.C. § 1681o allows your actual damages plus costs and reasonable attorney's fees. There is no statutory minimum in this tier, which is why documenting real harm matters.

Actual damages in identity theft cases are often more substantial than people expect. A denied mortgage, a higher interest rate, a lost apartment, a withdrawn job offer, and the hours you spent on the phone all count. Courts also recognize emotional distress as a component of actual damages under the FCRA.

Two features of the statute deserve emphasis. First, attorney's fees shift to the defendant when you prevail, which is what makes these cases economically possible for ordinary consumers. Second, the deadline is short. Under 15 U.S.C. § 1681p, you must file within two years after you discover the violation, or within five years after the violation occurred, whichever comes first. Waiting is the most common way a good claim is lost.

Florida law adds a criminal dimension. Under Fla. Stat. § 817.568, the fraudulent use of another person's personal identification information is a felony. A criminal case against the thief is separate from your civil claim against the bureaus and furnishers, and it does not substitute for one.

How to act: the steps that protect your claim

Everything below serves two purposes at once. It limits the damage, and it builds the record you would need if the bureaus fail to do their job.

1. Place a fraud alert and a security freeze. Under 15 U.S.C. § 1681c-1 you are entitled to an initial one-year fraud alert, and to an extended seven-year fraud alert once you submit an identity theft report. Security freezes at all three nationwide bureaus have been free for every consumer since September 2018. A freeze is stronger than an alert because it blocks new credit from being opened at all.

2. File the FTC Identity Theft Report at IdentityTheft.gov. This is the document the statute is built around. Save the PDF.

3. File a police report where you live. Some furnishers insist on one, and it costs you nothing but time.

4. Send the block request in writing to all three bureaus. Include proof of identity, the identity theft report, a list of every fraudulent item by account number and creditor name, and an express statement that none of it relates to any transaction you made. Send it by certified mail with return receipt and keep the green card. That receipt is what starts the four-business-day clock in provable form.

5. Notify each furnisher directly, and dispute through the bureaus as well. The bank or collector that reported the account has its own obligation once it is on notice, and if it has published an address for receiving identity theft reports, send yours there. Do not stop at direct notice, though. It is the dispute you file with the credit bureaus that obligates them to pass it to the furnisher, and that step is what preserves your claim against the company that reported the account.

6. Pull fresh reports from all three bureaus and keep every version. The before-and-after comparison is your evidence, and a reappearing account is only provable if you kept the earlier report.

7. Keep a written log. Dates, names, reference numbers, and what was said on every call. Contemporaneous notes carry weight.

Do not dispute fraudulent accounts by phone alone, and be cautious about disputing only through a bureau's online portal. Neither reliably preserves the paper trail that makes a violation provable later.

When to retain an attorney

Plenty of identity theft situations resolve on their own. You send a documented block request, the bureaus comply, the accounts come off, and the matter is finished. If that describes your case, you do not need a lawyer.

It is worth talking to a consumer attorney when any of these are true:

• You submitted an identity theft report and proof of identity, and the fraudulent information is still being reported well past four business days.

• An account you already got removed has come back onto your file.

• A bureau responded that the fraudulent account was verified as accurate.

• A collector is still pursuing you on a debt you have documented as identity theft.

• The reporting has already cost you something concrete, such as a denied loan, a lost housing application, or a rescinded job offer.

• You are approaching two years from when you first discovered the problem.

On the practical question of cost: consumer FCRA cases are generally handled on a contingency basis, and because the statute shifts attorney's fees to the defendant when the consumer prevails, pursuing a claim does not usually require money out of pocket. That fee-shifting provision exists precisely because Congress wanted individual consumers to be able to enforce the statute against national credit bureaus.

Bring your paperwork to the first conversation. Your credit reports, the identity theft report, your certified mail receipts, the bureaus' written responses, and your call log will tell an attorney within minutes whether you have a claim worth filing.

You did not create this problem

Identity theft is something done to you. The law recognizes that, which is why it puts the burden of fixing your credit report on the bureaus and the companies that reported the fraudulent account, not on you. When they fail to carry that burden, the failure has consequences that you can enforce.

If a fraudulent account is still on your credit report after you have reported the theft, or if a collector is still calling about a debt that was never yours, we can look at your documents and tell you where you stand. Request a free case review and we will review your reports and your correspondence at no cost to you.