Start with an identity theft report
Several of the most useful rights for identity theft victims depend on an "identity theft report." You can create one for free with the Federal Trade Commission (FTC) at IdentityTheft.gov. The site walks you through what happened, lists the accounts involved, and produces an FTC Identity Theft Report you can send to credit bureaus and creditors, along with a personal recovery plan.
A police report is optional, but it can help. Some creditors and collectors ask for one, and it gives you a second official record. Keep copies of everything, and write down who you spoke with and when.
If a thief also took money from your bank account, that is a separate claim with its own deadlines. See bank denied your fraud claim.
Fraud alerts and security freezes
These tools protect you from new fraud. They don't remove accounts already on your report, but they are worth doing right away.
- Initial fraud alert (1 year). Tells lenders to take extra steps to verify your identity before opening new credit. Contact any one of the three nationwide bureaus, and it must pass the alert to the other two.
- Extended fraud alert (7 years). Available once you have an identity theft report.
- Security freeze (free). Keeps most new creditors from seeing your report, which makes it much harder to open accounts in your name. Placing and lifting a freeze is free. You place it separately with Equifax, Experian, and TransUnion.
The identity theft block
For fraud accounts already on your report, the identity theft block is the most direct tool (15 U.S.C. § 1681c-2). A consumer reporting agency must block information that resulted from identity theft within 4 business days after it receives all four of these:
- Proof of your identity.
- A copy of your identity theft report.
- Identification of the information you want blocked.
- Your statement that the information does not relate to any transaction you made.
A bureau can decline or rescind a block in some limited situations, such as when a block was requested in error. That is one more reason to be precise: list only the accounts and inquiries that are truly fraud.
A regular dispute and a block request are different. When you write to a bureau about identity theft accounts, say that you are requesting a block under 15 U.S.C. § 1681c-2 and include all four items. The 4-business-day deadline runs from when the bureau receives them.
Disputes, and what creditors must do
You can also dispute fraud accounts through the regular dispute process, and you can send a dispute and a block request in the same letter. The bureau must conduct a reasonable reinvestigation, generally within 30 days, notify the creditor within 5 business days, and delete or correct anything that is inaccurate or can't be verified (§ 1681i).
When a bureau forwards your dispute, the creditor or collector that reported the account (the "furnisher") must investigate, review the information you sent, and correct or delete information that is wrong (§ 1681s-2(b)). A dispute sent only to the creditor does not trigger that duty, so always dispute through the bureaus too. My step-by-step dispute guide explains how and includes a sample letter.
When the account keeps coming back
A deleted fraud account can reappear for a few reasons. The creditor reports it again, the bureau's system puts it back, or the debt is sold to a collector that reports it as a new collection account.
The law limits reinsertion. A bureau can't put deleted information back unless the furnisher certifies that it is complete and accurate, and the bureau must notify you within 5 business days after reinserting it (§ 1681i(a)(5)(B)). An account that returns without notice, or returns after you proved it was fraud, is a red flag. Here is what to do:
- Pull fresh reports and compare them with your earlier ones.
- Send a new block request and dispute to each bureau showing the account, with your identity theft report attached again.
- Keep every letter, result, and denial in date order.
- Talk to a lawyer. A bureau or creditor that keeps reporting an account after being shown it was fraud may be liable under the FCRA.
If a debt collector contacts you
Tell the collector in writing that the debt is the result of identity theft, and send a copy of your identity theft report. Federal and Florida debt collection laws limit what collectors can do, and pursuing you for a debt you don't owe can raise separate legal issues. Get advice before paying anything on a debt that isn't yours, and never ignore a lawsuit.
Damages, fees, and deadlines
The Fair Credit Reporting Act (FCRA) allows actual damages, such as a denied loan, a higher interest rate, or the stress of dealing with the problem. For willful violations, it also allows statutory damages of $100 to $1,000 and punitive damages. The full damages table is on my credit report errors page.
The FCRA lets a consumer who wins recover reasonable attorney's fees and costs (§§ 1681n, 1681o). You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.
You generally have two years from when you discover the violation to sue, and no more than five years from when it happened (§ 1681p).