Identity Theft Is Devastating. The Law Gives You Tools to Fight Back.
Discovering that someone has stolen your identity is one of the most unsettling experiences a person can have. Fraudulent credit cards opened in your name, bank accounts drained, loan applications filed by strangers -- the financial and emotional toll can be enormous. But federal law provides identity theft victims with powerful rights and a clear path to recovery.
The Fair Credit Reporting Act (15 U.S.C. § 1681) includes specific provisions designed to help identity theft victims clean up their credit reports and hold credit bureaus accountable when they fail to act. This guide walks you through the immediate steps you should take and explains your legal rights at every stage.
Immediate Steps: The First 48 Hours
If you discover that you are a victim of identity theft, time matters. Here is what to do immediately:
- Place fraud alerts with all three credit bureaus. Contact one of the three major bureaus -- Equifax, Experian, or TransUnion -- and request an initial fraud alert. That bureau is required to notify the other two. An initial fraud alert lasts one year and requires creditors to take reasonable steps to verify your identity before opening new accounts. You may also request an extended fraud alert, which lasts seven years and requires you to provide an identity theft report.
- File a report with the FTC at IdentityTheft.gov. The Federal Trade Commission's IdentityTheft.gov website is the official federal resource for identity theft victims. When you file a report, the system generates a personalized recovery plan and produces an FTC Identity Theft Report, which serves as an official document you will need for subsequent steps.
- File a police report. Contact your local police department and file a report. Bring your FTC Identity Theft Report, any evidence of fraudulent accounts or transactions, and a government-issued ID. A police report strengthens your position significantly when dealing with credit bureaus and creditors.
- Request a credit freeze. A credit freeze prevents anyone from opening new credit accounts in your name. Unlike a fraud alert, which is a warning to creditors, a freeze is a hard block. Under federal law, credit bureaus must place a freeze within one business day of your request and lift it within one hour when you request removal. Credit freezes are free.
If you have just discovered identity theft, do these four things today: (1) place a fraud alert by calling any one of the three credit bureaus, (2) go to IdentityTheft.gov and file an FTC report, (3) file a police report with your local department, and (4) request a credit freeze with all three bureaus. These steps cost nothing and can be completed in a few hours.
Your Rights Under the FCRA When Fraudulent Accounts Appear
Once fraudulent accounts are on your credit report, the FCRA gives you specific rights to get them removed. These rights go beyond the standard dispute process available to all consumers.
Under FCRA § 605B (codified at 15 U.S.C. § 1681c-2), when you notify a credit bureau that you are a victim of identity theft and provide an identity theft report, the bureau is required to block the fraudulent information from your credit report within four business days. This is not a 30-day investigation like a standard dispute. It is an accelerated process specifically designed for identity theft victims.
To invoke this right, you must provide the credit bureau with:
- A copy of your identity theft report (from IdentityTheft.gov or your police report)
- Proof of your identity
- A clear identification of which information on your report is fraudulent
The Identity Theft Affidavit Process
An identity theft affidavit is a sworn statement declaring that you are a victim of identity theft and that specific accounts or transactions on your credit report are fraudulent. The FTC provides a standardized Identity Theft Affidavit form at IdentityTheft.gov. You should complete this affidavit and send copies to:
- Each of the three credit bureaus
- Each creditor or company where a fraudulent account was opened
- Any debt collector that has contacted you about a fraudulent debt
When you send an identity theft affidavit to a creditor, the creditor must cease reporting the fraudulent account to the credit bureaus and must not attempt to collect on the fraudulent debt. The creditor is also required to provide you with copies of any application or transaction records related to the fraudulent account, which can help identify the thief.
When Credit Bureaus Fail to Remove Fraudulent Accounts
Despite the clear legal requirements, credit bureaus do not always act as the law requires. You may encounter situations where:
- The bureau fails to block fraudulent information within the required four business days
- Fraudulent accounts are removed but then reappear on a later report
- The bureau conducts a superficial investigation and "verifies" the fraudulent account as accurate
- The bureau demands documentation beyond what the law requires before acting
Each of these failures may constitute a violation of the FCRA. When a credit bureau's inaction allows fraudulent accounts to remain on your report, the consequences can be severe: denied credit applications, higher interest rates, lost housing opportunities, and significant emotional distress.
Damages Available for Identity Theft Victims Under the FCRA
If a credit bureau fails to comply with its obligations under the FCRA's identity theft provisions, you may be entitled to:
- Actual damages: Compensation for all provable harm, including financial losses from denied credit, higher interest rates, lost housing or employment opportunities, and the emotional distress of dealing with unresolved identity theft
- Statutory damages: Up to $1,000 per violation for willful noncompliance
- Punitive damages: Additional damages for willful violations, intended to punish particularly egregious conduct
- Attorney's fees and costs: If you prevail, the credit bureau is required to pay your reasonable attorney's fees, meaning you pay nothing out of pocket for legal representation
Practical Tips for Ongoing Protection
Identity theft recovery is not a one-time event. Once your information has been compromised, ongoing vigilance is essential:
- Monitor your credit regularly. Pull your free credit reports from AnnualCreditReport.com. Consider staggering your requests so you are checking one bureau every four months throughout the year.
- Keep your credit freeze in place. Only lift it temporarily when you need to apply for new credit, and freeze it again immediately afterward.
- Use strong, unique passwords for every financial account. Consider a reputable password manager to keep track of them.
- Enable two-factor authentication on every account that offers it, especially banking and email accounts.
- Be cautious with personal information. Do not provide your Social Security number unless absolutely necessary, and question any entity that asks for it.
- Review bank and credit card statements monthly. Report unauthorized transactions immediately.
You should consider speaking with a consumer protection attorney if any of the following apply:
- You submitted an identity theft report to the credit bureaus and they have not blocked the fraudulent information within four business days
- Fraudulent accounts keep reappearing on your credit report after being removed
- A credit bureau verified a fraudulent account as "accurate" despite your identity theft report
- You were denied credit, housing, or employment because of fraudulent information on your credit report
- A debt collector is pursuing you for a debt created by an identity thief
Under the FCRA's fee-shifting provision, the credit bureau pays your attorney's fees if you prevail. This means there is no cost to you for legal representation in most identity theft cases.