Identity Theft Credit Report Protections Under the FCRA

An identity theft credit report problem often surfaces abruptly: an account the consumer never opened, a collection for a debt never incurred, or an inquiry from a lender the consumer never contacted. The Fair Credit Reporting Act, 15 U.S.C. § 1681, includes provisions written specifically for people in this position.

This post explains what the statute provides. It covers the duties of credit bureaus and the companies that furnish information to them, the tools the FCRA creates for victims, and the remedies available when those duties are not met.

How identity theft appears on a credit report

A credit report is assembled from information that lenders, collectors, and other furnishers send to the bureaus. When someone uses a stolen name, Social Security number, or date of birth to obtain credit, the resulting activity can land in the victim's file as though the victim had done it.

The signs vary from file to file. Common examples include:

What the FCRA requires of bureaus handling an identity theft credit report

The statute's baseline accuracy rule applies to every file, including one affected by fraud. Under § 1681e(b), a consumer reporting agency preparing a report must follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual. An account opened by a thief does not reflect the named consumer's own credit history, which is why such entries raise accuracy questions under that provision.

A hypothetical illustrates the problem. A consumer's Social Security number is used to open a store card in another city. The account goes unpaid, moves to collections, and appears in the consumer's file. A later mortgage underwriter sees the delinquency but not the cause.

Disputes and reinvestigation under § 1681i

When a consumer disputes an item with a bureau, § 1681i generally requires the bureau to conduct a reasonable reinvestigation, forward the relevant information to the furnisher, and consider what the consumer submitted. Information that is inaccurate, incomplete, or cannot be verified is to be deleted or corrected. The bureau must provide the results in writing, and the consumer may add a statement of dispute to the file.

Once a bureau notifies a furnisher of a dispute, the furnisher has its own obligations under § 1681s-2(b). It must investigate, review what the bureau provided, report the results, and correct its reporting to every bureau if the information proves inaccurate or incomplete.

Blocking fraudulent information under § 1681c-2

Section 1681c-2 gives identity theft victims a more specific tool than a standard dispute. When a consumer provides proof of identity, a copy of an identity theft report, identification of the information at issue, and a statement that the information does not relate to any transaction the consumer made, the bureau must block that information from the file. It must also notify the furnisher that the information may result from identity theft.

The FCRA defines an identity theft report in terms that generally involve a report filed with a federal, state, or local law enforcement agency. The block is not unconditional. A bureau may decline or rescind it if it reasonably determines the block was a mistake or was obtained through a material misrepresentation of fact.

Fraud alerts and security freezes under the FCRA

Section 1681c-1 creates two protections that operate before or alongside a dispute. They are often confused, but the statute treats them as distinct.

How a fraud alert works

A consumer who asserts in good faith a suspicion of fraud or identity theft can request a fraud alert in the file. The bureau that places it must notify the other nationwide bureaus. A business that sees the alert when reviewing an application must use reasonable policies and procedures to form a reasonable belief that it knows the identity of the applicant.

The statute also describes extended alerts for consumers who submit an identity theft report, and active duty alerts for service members. A fraud alert does not remove anything from the file. It changes how new creditors are expected to verify who is applying.

How a security freeze differs

A security freeze, also addressed in § 1681c-1, restricts a bureau from releasing the consumer's file to most new creditors without the consumer's authorization. Because many lenders review a report before approving credit, a freeze can make it harder for a thief to open new fraudulent accounts. It does not change what the file already contains, so it works alongside disputes and blocks rather than replacing them.

What furnishers and businesses must do when fraud is involved

Furnishers carry obligations of their own. Under § 1681s-2(a)(6), once a furnisher receives notice from a bureau that information may result from identity theft, it must have reasonable procedures in place to prevent that information from being furnished again. The same provision addresses situations in which a consumer submits an identity theft report directly to the furnisher.

The statute also gives victims a way to learn how the fraud happened. Under § 1681g(e), a business that provided credit, goods, or services to the person who misused the victim's identity must, on proper proof of identity and a claim of identity theft, provide copies of the application and business transaction records. Those records can show what information the thief supplied and how the account was opened.

When an identity theft credit report error leads to an FCRA claim

The FCRA does not make the thief's conduct an FCRA violation. Claims concern what bureaus and furnishers did with the information afterward. Examples include a bureau that keeps reporting a fraudulent account after a proper block request, a reinvestigation that is not reasonable, or a furnisher that re-reports information it was notified resulted from identity theft.

The statute sets out remedies. For a willful violation, § 1681n allows actual damages or statutory damages of $100 to $1,000, and punitive damages may also be available. For a negligent violation, § 1681o allows actual damages. A consumer who succeeds can also recover reasonable attorney's fees and costs.

Under § 1681p, a claim may be brought within 2 years after the consumer discovers the violation and no later than 5 years after the violation occurs. Whether a specific set of facts amounts to a violation depends on the details, including what was reported, what was submitted, and how the bureau or furnisher responded.

Frequently Asked Questions

Does the FCRA provide a way to remove fraudulent accounts from a credit report?

The FCRA provides two routes. A dispute under § 1681i requires the bureau to conduct a reasonable reinvestigation and delete or correct information that is inaccurate or unverifiable. Section 1681c-2 separately requires a bureau to block information a consumer properly identifies as resulting from identity theft, subject to the statute's exceptions.

What is the difference between a fraud alert and a security freeze?

A fraud alert, governed by § 1681c-1, signals to businesses that they must take reasonable steps to verify the identity of an applicant. A security freeze restricts the bureau from releasing the file to most new creditors without the consumer's authorization. Neither one removes information already in the file.

Who can be responsible under the FCRA when fraudulent information stays on a report?

Credit bureaus and furnishers each have defined duties under the statute, including accuracy procedures, reinvestigation, and blocking. A claim generally concerns how one of them handled the information after being notified. The identity thief's own conduct is not the subject of an FCRA claim.

Related Reading

This post is part of a series from Sue Your Credit Report – A Law Firm, based in Hollywood, Florida, that explains how the FCRA works for consumers. The way an identity theft credit report is handled depends on the facts of each file, and the statute's provisions are the starting point for understanding what bureaus and furnishers owe consumers.