McMillan Law's office is in Tampa. I represent people in Boca Raton and everywhere else in Florida, and the free case review happens by phone or online, so you don't have to drive anywhere to get started.
Last reviewed October 15, 2026 by Jackson McMillan, Florida attorney
Short answer: If someone opened accounts in your name or your parent\'s, a credit bureau must block them within 4 business days of getting proof of identity, an identity theft report, the list of items, and a signed statement. It may refuse only for narrow reasons and must promptly tell you. A wrongful refusal may support an FCRA claim.
- Office in Tampa. Clients anywhere in Florida.
- Free, confidential review by phone or online.
- Jackson McMillan, Florida Bar No. 1078951
What does identity theft against a Boca Raton retiree look like?
Usually it's quiet. Cards, loans, or phone accounts appear in the name of someone who hasn't applied for credit in years, and nobody notices until a collector calls or a refinance is denied. The fraud may come from a stranger with stolen data or from someone close to the family.
Take a retired schoolteacher in Boca Raton, call her Ruth, age 79. She hasn't applied for credit in a decade. Her daughter in Ohio helps with bills by phone, and one week a collection letter arrives for a home improvement loan Ruth never heard of. The daughter pulls her mother's reports and finds two store cards, a personal loan, and a phone account, all opened in the last six months and all past due.
Retirees are often the last to find out. They rarely apply for new credit, so no lender turns them down and no one looks at the report. A thief can run up balances for months before a collection letter or a denied refinance brings it to light.
Sometimes the thief is a stranger working from stolen data. Sometimes it's someone close enough to know the birth date and Social Security number by heart: a relative, a caregiver, or a helper who handles the mail. Courts have recognized that close family can have easy access to that information. Who did it changes how hard the conversation is, but it doesn't change your rights against the bureaus.
Warning signs worth checking on an older parent's report:
- Accounts opened recently, when your parent hasn't applied for anything in years.
- A mailing address, phone number, or email that belongs to someone else.
- Hard inquiries from lenders your parent never contacted.
- Collection accounts for services delivered to an address your parent never lived at.
What is an identity theft block, and why ask for one?
A block is a separate tool from an ordinary dispute. Under the Fair Credit Reporting Act (FCRA), the federal law that governs credit reports, a bureau must block fraud items within 4 business days of receiving four things: proof of identity, an identity theft report, the list of items, and the consumer's statement that they aren't his or hers.
The block also reaches the company that reported the fraud account, which the law calls the "furnisher." Once a bureau blocks an item, it must tell the furnisher that the information may come from identity theft and that a report was filed (15 U.S.C. § 1681c-2(b)). After that notice, the furnisher generally may not sell the debt, transfer it for payment, or place it for collection (15 U.S.C. § 1681m(f)). That matters for retirees, because a fraud debt that gets sold can come back under a new collector's name.
The identity theft report can be the one the Federal Trade Commission (FTC) generates at IdentityTheft.gov. The FTC's position is that its report can stand in for a police report in most cases. Be accurate in it, because it becomes part of the record, and list only the accounts that are truly fraud.
Send a regular dispute in the same envelope. A dispute asks the bureau to reinvestigate, which means a fresh look at whether the information is right, and the bureau must forward it to the furnisher within 5 business days. That forwarded dispute is what triggers the furnisher's own duty to investigate, the duty you can enforce in court.
Why would a bureau refuse to block the accounts?
The FCRA lets a bureau decline or lift a block only when it reasonably decides that the block was requested or applied in error, that the request rested on a material misrepresentation, or that the consumer received goods, services, or money from the blocked transaction. If it does, it must notify the consumer promptly.
Those reasons come from 15 U.S.C. § 1681c-2(c). Read the bureau's letter closely, because whatever explanation it gives tells you what to answer. A few patterns:
- "More information is needed." Federal rules let a bureau ask for more detail to judge an identity theft report, generally within 15 days of receiving it. Answer every question in writing, by certified mail, and keep a copy.
- "You benefited from the account." This can come up when a thief had goods shipped to the retiree's own address. Explain who ordered the goods, who actually took them, and how you know.
- "The request was in error." Sometimes the list mixed a real account with fraud ones. Fix the list and send it again rather than arguing for an account your parent did open.
A refused block doesn't end the bureau's other duties. It still has to reinvestigate a dispute, delete what can't be verified, and use reasonable procedures for accuracy (15 U.S.C. §§ 1681e(b), 1681i). A bureau that keeps fraud on a retiree's report after receiving clear proof may be liable for that.
Upload the bureau's letter, the identity theft report, and the list of accounts, and I'll tell you what the denial reason means and what the next letter should say.
Can I handle this for my mother or father?
You can help a lot, but the law expects the dispute and block request to come from the consumer, so the safest letters carry your parent's signature. The FCRA does let a person acting on a consumer's behalf request a fraud alert. If your parent can't sign, ask a lawyer about your authority before sending anything in your own name.
A power of attorney or a guardianship may give you that authority, depending on what the document says. If your parent can sign, sit with them, read each letter aloud, and keep a copy of everything that goes out with the date it was mailed.
Three steps protect a parent while the dispute runs:
- Security freeze. Free at each of the three nationwide bureaus. It keeps most new lenders from seeing the file, which stops new accounts.
- Extended fraud alert. Available with an identity theft report, lasts seven years, and comes with two free reports in the following 12 months.
- A mail and statement check. Watch for new cards, loan checks, and collection letters, and write down the date each one arrives.
When the person responsible is a caregiver or relative, Florida's Department of Children and Families runs the Florida Abuse Hotline, 1-800-96-ABUSE, which takes reports of suspected exploitation of the elderly or a vulnerable adult. Call 911 first if someone is in immediate danger.
Where would a Boca Raton case be heard?
Boca Raton is one of Palm Beach County's 39 municipalities. A federal FCRA case from Palm Beach County belongs to the West Palm Beach Division of the U.S. District Court for the Southern District of Florida, which sits at the Paul G. Rogers Federal Building and U.S. Courthouse on Clematis Street in West Palm Beach.
The FCRA also allows a case in state court. In Palm Beach County that's the Fifteenth Judicial Circuit, and appeals from it go to Florida's Fourth District Court of Appeal. Florida's state courts require a concrete harm just as federal courts do, so the choice of court turns on strategy, not on avoiding that rule.
You don't need to travel for any of this. I represent people in Boca Raton and across Palm Beach County, and the free case review happens by phone or online. That works well when the retiree is in Boca Raton and the adult child helping is in another state, since both of you can join the call.
What could a bureau or creditor owe a retiree?
When a bureau or furnisher negligently leaves fraud on the report after the block request or dispute, the FCRA allows actual damages. For a retiree, those can include a denied refinance or reverse mortgage, a higher rate, money spent on postage and copies, hours on the phone, and real distress over being treated as a debtor.
The losses that count are generally the ones that followed the company's failure, not the thief's original fraud. Keep a simple log: each call, each letter, each denial, and how the stress showed up, such as lost sleep or worry.
A willful violation, which includes reckless disregard of the law, allows statutory damages of $100 to $1,000 in place of actual damages, plus punitive damages if the court allows. Statutory damages are not available for a merely careless mistake. Any lawsuit also needs a concrete harm, such as the fraud account going out on a report to a lender.
The FCRA lets a consumer who wins recover reasonable attorney's fees and costs from the company that violated it. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign. My page on identity theft accounts on your credit report covers the rest of the fraud toolkit.
What deadlines matter after you find fraud accounts?
The bureau's clock starts when your block request or dispute arrives, so mail everything by certified mail and keep the receipt. Most of the deadlines below belong to the bureau. The one that belongs to you is the time limit to sue, which can run out while a family is still sorting out the paperwork.
- 4 business days
The bureau's deadline to block fraud items once it has all four pieces of the request.
- 5 business days
The bureau's deadline to send your parent's dispute and documents on to the furnisher.
- 15 days
The general window for a bureau to ask for more detail about the identity theft report.
- 30 days
The usual limit to finish a reinvestigation, with up to 15 more if you add relevant information during that time.
- 2 years
The time to sue after discovering a violation, and never more than 5 years after it happened.
The two-year clock generally starts with the bureau's or furnisher's failure, such as a mishandled dispute, not with the day the thief opened the account. A new dispute can start a new clock, but don't count on that. Act while the paper trail is fresh.
What should you do this week?
Stop new fraud first, then clean up the old. A freeze and an identity theft report take an afternoon. The block request and dispute come next, signed by the person whose name was used. Keep copies of every page, because a case, if there is one, gets built from them.
- Freeze the credit at Equifax, Experian, and TransUnion. It costs nothing.
- Pull all three reports through AnnualCreditReport.com and mark every account, inquiry, and address that isn't your parent's.
- Create the FTC identity theft report at IdentityTheft.gov, listing only true fraud.
- Mail a block request and a dispute to each bureau by certified mail, signed by the consumer, with ID and the report attached. My guide to disputing credit report errors has a sample letter.
- Keep every bureau letter, especially any refusal to block and the reason it gives.
- Don't pay a fraud debt to make the calls stop. Write to the collector instead and say it's identity theft.
- Send it to me. Upload the reports, the identity theft report, and every bureau response for a free case review.
Sources: Fair Credit Reporting Act, 15 U.S.C. §§ 1681c-1, 1681c-2, 1681e(b), 1681i, 1681m(f), 1681n, 1681o, 1681p, 1681s-2(b); 12 C.F.R. § 1022.3; TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Saleh v. Miami Gardens Square One, Inc., 353 So. 3d 1253 (Fla. 3d DCA 2023); Fla. Stat. §§ 26.021, 35.042; Internal Operating Procedures of the U.S. District Court for the Southern District of Florida, IOP 2.01.01(d). Last reviewed October 15, 2026.