Identity theft occurs when someone uses your personal identifying information, such as your name, Social Security number, or date of birth, to open fraudulent accounts, make unauthorized purchases, or commit other forms of fraud in your name. Under the Fair Credit Reporting Act (FCRA), identity theft victims have enhanced rights to dispute and block fraudulent information from their credit reports, including the right to have credit bureaus block fraudulent accounts within four business days under Section 605B, codified at 15 U.S.C. § 1681c-2.
Identity theft is one of the fastest-growing consumer crimes in the United States. According to the Federal Trade Commission, millions of Americans are affected by identity theft each year, and the consequences can be devastating: damaged credit scores, denied loans and housing applications, lost employment opportunities, and months or years spent trying to restore a clean credit record. The FCRA provides identity theft victims with specific tools and rights to recover from these harms.
Immediate Steps to Take
If you discover that you are a victim of identity theft, taking the following steps as quickly as possible is critical to limiting the damage and preserving your legal rights:
- Place a fraud alert on your credit files. Contact any one of the three major credit bureaus (Experian, Equifax, or TransUnion) to request an initial fraud alert. Under 15 U.S.C. § 1681c-1(a), the bureau you contact is required to notify the other two bureaus, and each must place the alert on your file. An initial fraud alert lasts one year and requires creditors to take reasonable steps to verify your identity before opening new accounts in your name. Identity theft victims who have filed an identity theft report may request an extended fraud alert lasting seven years under 15 U.S.C. § 1681c-1(b).
- File an identity theft report with the FTC. Go to IdentityTheft.gov and complete the FTC's Identity Theft Report. This report serves as a key document for exercising your rights under the FCRA, including the Section 605B blocking right. The FTC will also generate a personalized recovery plan for your situation.
- File a police report. Contact your local law enforcement agency and file a police report documenting the identity theft. Bring copies of your FTC Identity Theft Report, any evidence of the fraudulent accounts, and proof of your identity. A police report, combined with the FTC report, constitutes an "identity theft report" under the FCRA, which triggers your enhanced blocking rights.
- Place a credit freeze. Under 15 U.S.C. § 1681c-1(i), you have the right to place a free security freeze on your credit file with each of the three major bureaus. A credit freeze restricts access to your credit file, preventing new accounts from being opened in your name. Unlike a fraud alert, a freeze remains in place until you choose to lift it. Placing and lifting freezes is free for all consumers.
- Review your credit reports. Under 15 U.S.C. § 1681j, identity theft victims are entitled to additional free credit reports beyond the standard one-per-year allotment. Request your reports from all three bureaus and identify every account, inquiry, and address that is not yours.
- Dispute fraudulent information. File disputes with each credit bureau reporting fraudulent accounts. Include your identity theft report and clearly identify each item that resulted from the identity theft.
What Section 605B Covers: The Blocking Right
FCRA Section 605B, codified at 15 U.S.C. § 1681c-2, provides identity theft victims with a powerful remedy that goes beyond the standard dispute process. Under this section, a credit reporting agency must block the reporting of any information in a consumer's file that the consumer has identified as resulting from identity theft, provided the consumer submits:
- An identity theft report (FTC report plus police report)
- Proof of identity (such as a copy of a government-issued ID)
- A specific identification of the information that resulted from identity theft
The credit bureau must block the fraudulent information within four business days of receiving these items. Once blocked, the information may not be reported to any creditor, employer, or other party that requests the consumer's credit report.
Additionally, under 15 U.S.C. § 1681c-2(b), the credit bureau must promptly notify the furnisher of the blocked information that the information may be the result of identity theft, that an identity theft report has been filed, that a block has been placed, and that the block took effect on a specific date. The furnisher is then prohibited from re-reporting the blocked information.
Common Violations
Despite the clear requirements of Section 605B and the broader FCRA, credit bureaus and furnishers frequently fail to properly handle identity theft disputes. Common violations include:
- Failure to block within four business days: Credit bureaus that do not block fraudulent information within the statutory four-business-day period after receiving a complete identity theft report, proof of identity, and identification of the fraudulent items.
- Reinsertion of blocked information: Some bureaus block the fraudulent accounts initially but later allow the information to reappear on the consumer's credit report, often after the furnisher re-reports the account.
- Requiring unnecessary documentation: Demanding documentation beyond what Section 605B requires, such as insisting on additional affidavits, notarized documents, or specific police report formats not mandated by the statute.
- Treating identity theft disputes as standard disputes: Processing an identity theft dispute through the standard 30-day investigation process instead of the four-business-day blocking procedure required by Section 605B.
- Failure to notify furnishers: Not notifying the furnisher that the information has been blocked as a result of identity theft, which leads to the furnisher continuing to report the fraudulent account.
- Creditor failure to investigate: When a creditor or furnisher receives notice from a credit bureau that information has been blocked due to identity theft and continues to report the fraudulent account anyway, or when a creditor fails to conduct a proper investigation after receiving a direct dispute from the identity theft victim.
- Continued collection on fraudulent accounts: Debt collectors or creditors continuing to pursue collection on accounts that the consumer has identified as resulting from identity theft, particularly after proper documentation has been provided.
Your Rights as an Identity Theft Victim
- Right to block fraudulent information. Credit bureaus must block fraudulent accounts within four business days of receiving your identity theft report and supporting documentation (15 U.S.C. § 1681c-2).
- Right to place fraud alerts. You may place an initial fraud alert (one year) or an extended fraud alert (seven years) on your credit files. The bureau you contact must notify the other two (15 U.S.C. § 1681c-1).
- Right to a free credit freeze. You may freeze and unfreeze your credit files at no cost (15 U.S.C. § 1681c-1(i)).
- Right to additional free credit reports. Identity theft victims are entitled to free credit reports beyond the standard annual allotment (15 U.S.C. § 1681j).
- Right to prevent re-reporting. Once fraudulent information is blocked, the furnisher may not re-report it (15 U.S.C. § 1681c-2(b)).
- Right to information about fraudulent accounts. Under 15 U.S.C. § 1681g(e), identity theft victims may request that a business provide copies of applications and business transaction records related to the fraudulent accounts.
- Right to sue. You may bring a private lawsuit under 15 U.S.C. § 1681n (willful violations) or § 1681o (negligent violations) against any party that fails to comply with the FCRA's identity theft provisions.
The Identity Theft Affidavit
An identity theft affidavit is a sworn statement declaring that you are a victim of identity theft and that specific accounts or transactions were not authorized by you. The FTC provides a standardized Identity Theft Affidavit as part of its report process at IdentityTheft.gov. This affidavit can be submitted to creditors, debt collectors, and credit bureaus as part of your identity theft report.
When submitting an identity theft affidavit to a creditor or furnisher, include copies of your government-issued identification, your FTC Identity Theft Report, your police report, and a clear list of the specific accounts that resulted from the identity theft. Keep copies of everything you send and mail documents by certified mail with return receipt requested.
Damages Available
Identity theft victims whose FCRA rights have been violated may recover the same categories of damages available for other FCRA claims:
| Damage Type | Amount |
|---|---|
| Actual damages | Proven financial losses, including costs of identity theft recovery, lost credit opportunities, higher interest rates paid, lost wages, and emotional distress |
| Statutory damages (willful) | $100 to $1,000 per violation, at the court's discretion |
| Punitive damages (willful) | Additional amount determined by the court; no statutory cap |
| Attorney's fees and costs | The defendant pays the prevailing plaintiff's reasonable attorney's fees and court costs |
Bureau and Creditor Obligations
Credit Bureau Obligations
When a credit bureau receives an identity theft report from a consumer, it must:
- Block the identified fraudulent information within four business days
- Notify the furnisher that the information has been blocked due to identity theft
- Not re-report the blocked information
- Include a notation on the consumer's file indicating that an identity theft report has been filed
- Provide the consumer with free copies of their credit report upon request
Creditor and Furnisher Obligations
When a creditor or furnisher receives notice that an account is the result of identity theft, it must:
- Cease reporting the fraudulent account to credit bureaus
- Cease collection activity on the fraudulent account
- Provide the identity theft victim with copies of business records related to the fraudulent account upon request (15 U.S.C. § 1681g(e))
- Not sell or transfer the fraudulent debt to another entity for collection
How We Can Help
Rausa Russo Law, PLLC represents identity theft victims throughout New York and, through our network of trusted consumer protection attorneys, across the country. Our approach includes:
- Free case evaluation. We review your credit reports, dispute history, and identity theft documentation to assess whether credit bureaus or furnishers have violated your rights under the FCRA.
- Guided recovery process. If you are early in the recovery process, we can help you navigate the fraud alert, police report, FTC report, and credit freeze procedures to build the strongest possible foundation for your legal rights.
- Section 605B demands. We send formal blocking demands under Section 605B to credit bureaus on your behalf, backed by proper documentation, to compel the removal of fraudulent accounts.
- Litigation. When credit bureaus or furnishers fail to honor their obligations under the FCRA, we file lawsuits in federal court to hold them accountable and recover damages on your behalf.
- No out-of-pocket cost. Because the FCRA provides for fee-shifting, we handle most identity theft cases with no upfront cost to the client.
Frequently Asked Questions
Take these steps as quickly as possible: (1) Place a fraud alert on your credit files by contacting any one of the three major credit bureaus, which must notify the other two. (2) File an identity theft report with the FTC at IdentityTheft.gov. (3) File a police report with your local law enforcement. (4) Place a credit freeze on your files with all three bureaus. These steps establish a documented record that activates your enhanced rights under FCRA Section 605B, including the four-business-day blocking requirement.
Under 15 U.S.C. § 1681c-2, a credit bureau must block the reporting of fraudulent information within four business days after receiving your identity theft report, proof of identity, and identification of the specific fraudulent items. This is significantly faster than the standard 30-day dispute investigation timeline. If a bureau fails to block the fraudulent information within this period, it may be in violation of the FCRA.
Yes. If you have provided a credit bureau with an identity theft report and the required supporting documentation, and the bureau fails to block the fraudulent information within four business days, you may have a claim under the FCRA. You may be entitled to actual damages, statutory damages of $100 to $1,000 for willful violations, punitive damages, and attorney's fees and costs. The FCRA's fee-shifting provision means the defendant pays your attorney's fees if you prevail, so pursuing a claim typically costs you nothing out of pocket.
A fraud alert is a notation on your credit file that warns potential creditors to take extra steps to verify your identity before extending credit. An initial fraud alert lasts one year; identity theft victims may place an extended alert lasting seven years. A credit freeze completely restricts access to your credit file, preventing new accounts from being opened in your name. A freeze remains in place until you lift it. Both are free under the FCRA. For maximum protection, we recommend placing both a fraud alert and a credit freeze.
While you do not need a police report to file a basic credit report dispute, having one is strongly recommended. A police report, combined with an FTC Identity Theft Report, constitutes an "identity theft report" under the FCRA, which triggers the enhanced blocking rights of Section 605B and the four-business-day timeline. Without a formal identity theft report, your dispute may be processed under the standard 30-day procedure, which provides weaker protections.