If you've reported identity theft to a credit bureau and they failed to block or remove the fraudulent accounts, that may be a violation of 15 U.S.C. § 1681c-2 and § 1681i. The FCRA requires bureaus to block identity theft tradelines within 4 business days of receiving your identity theft report. If they didn't, you may have a legal claim, and it costs you nothing to find out.
You pull your credit report and there it is: a credit card you never opened. A car loan in your name. A medical debt. Your heart sinks. You check your credit score. It's dropped 150 points in six weeks.
You act fast. You file a police report. You get an FTC Identity Theft Report. You send certified letters to Equifax, Experian, and TransUnion disputing each fraudulent account. You include copies of the police report, the FTC report, a police report number, a case number. You do everything the law says to do.
Then you wait. Six weeks pass. The bureaus respond: the accounts are "verified." They're still on your report. Your score is still tanked. Your frustration turns to anger. You did everything right. They didn't.
The law has your back here. The Fair Credit Reporting Act gives you concrete legal remedies when a bureau ignores your identity theft report or fails to properly investigate your disputes. This is how you use them.
You did everything right. Here's why the error is still there.
Credit bureaus process millions of disputes annually. Most are handled by automated systems. You send a dispute letter. It gets scanned. It gets categorized. A computer flags it for a reinvestigation. A junior employee glances at it. The default response: "verified with the data furnisher." Dispute closed.
The furnisher is usually the fraudster's lender, not the original creditor who knows you didn't open the account. The bureau sends an automated request to the data furnisher. The furnisher's system matches the account information and responds: "Account verified." The bureau stamps your dispute "resolved" and sends a response letter.
No human reviewed your identity theft report. No one looked at your police report. No one flagged the account for blocking under the identity theft statute. The process is a machine talking to another machine.
For identity theft victims, this process fails catastrophically. A fraudulent account created in your name will of course be "verified" by the data furnisher—they have the account in their system. Verification doesn't prove the bureau investigated. It proves the data furnisher has a record. That's not the legal standard. That's not reasonable reinvestigation.
What the FCRA requires when you report identity theft
The identity theft blocking statute, 15 U.S.C. § 1681c-2, is direct and mandatory under FCRA law. When you provide a credit bureau with an identity theft report (police report or FTC Identity Theft Report) and supporting documentation, the bureau must:
- Block the fraudulent items from your credit report within 4 business days of receiving the report and documentation
- Notify you that the block has been placed
- Send notices to all data furnishers (the creditors) telling them the accounts are the result of identity theft
- Provide you with a copy of the identity theft report you submitted
This is not a dispute mechanism. This is not a reinvestigation. This is a blocking mandate. The 4-business-day window is not a suggestion. It's the law.
When you file that dispute under § 1681i (the general dispute statute), the bureau must conduct a reasonable reinvestigation. They cannot rely on automated responses. They cannot take the data furnisher's word that the account is legitimate when you've provided an identity theft report showing it's fraudulent.
The combination of these statutes creates a two-track obligation: block within 4 days under § 1681c-2, and reinvestigate properly under § 1681i. Most bureaus do neither.
Why do bureaus ignore identity theft disputes?
Bureaus are not neutral parties. They are data brokers. Their business model depends on having data. Removing accounts reduces their value proposition to lenders and creditors. Keeping disputed accounts on your report longer means more inquiries, more data points, more reports sold.
The incentive structure is broken. A bureau makes money when your report is thick with tradelines—even disputed ones. They lose money when accounts are removed. A properly enforced FCRA would flip that incentive upside down. Right now it doesn't.
Volume compounds the problem. Bureaus receive millions of disputes annually. With thin profit margins, they staff dispute departments leanly. Automated systems are cheaper than trained investigators. A single dispute specialist might review hundreds of cases in a week. The math doesn't support thorough investigation.
For identity theft specifically, bureaus know that investigating properly is costly. Confirming fraud requires real work: contacting the data furnisher's fraud department, obtaining copies of the original application, comparing signatures, reaching out to you for additional information. Stamping "verified" and moving on takes minutes.
Until litigation makes noncompliance more expensive than compliance, many bureaus will keep ignoring the law.
When "verified" doesn't mean verified
Federal courts have consistently held that "verified" does not mean the bureau conducted a reasonable reinvestigation. Verification is an outcome. Reinvestigation is a process. The FCRA requires the process.
In Gorman v. Wolpoff & Abramson, the Fourth Circuit held that a simple data match—the bureau checking whether information exists in a database—does not constitute a reasonable investigation. If the furnisher's database contains the fraudulent account, of course it will "match." That's tautological. It proves nothing about whether the account is actually legitimate.
In Safeco Insurance Co. v. Burr, the Supreme Court noted that a reasonable investigation must be measured by what a diligent company would investigate. For identity theft accounts, a diligent company would look at whether the applicant actually signed the application, whether the application address matches the victim's known address, whether the account activity is consistent with the victim's pattern.
An automated dispute response doesn't do any of that. An automated system cannot distinguish between a legitimate dispute and a fraudulent account. It just compares data points.
When you report identity theft and the bureau responds "verified," what they're really saying is "the data furnisher has a record of this account." They're not saying "we investigated and confirmed this account is legitimate." Courts understand the difference. Bureaus count on consumers not understanding it.
What you can do when the bureau won't fix your report
First, document everything. Save all letters, all dispute responses, all identity theft reports, all police reports. Screenshot your credit reports before and after. Note the dates you mailed disputes and when responses arrived.
File a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB collects complaints and refers them to credit bureaus for response. A bureau with multiple complaints on file faces regulatory scrutiny. Some bureaus respond more seriously to complaints than disputes.
Send a second round of dispute letters if the first didn't resolve the issue. Include explicit reference to the identity theft statute, § 1681c-2. Quote the 4-business-day blocking requirement. Make clear you understand the law.
Consider consulting an FCRA attorney. Many offer free consultations. An attorney can review the bureau's response and identify legal violations. Some violations are obvious. Others require deeper analysis of the investigation process.
Most importantly: litigation is the enforcement mechanism the FCRA actually uses. Administrative complaints and CFPB reports sometimes work. Sometimes they don't. A lawsuit is the one thing that guarantees a bureau takes your case seriously.
What an FCRA lawsuit looks like for identity theft victims
An FCRA case follows a predictable timeline. You consult an attorney and explain the situation. The attorney reviews your documentation and identifies the legal violations. They send a pre-litigation demand letter to the bureau detailing the violations and requesting removal of fraudulent accounts or settlement.
About 30 percent of demand letters result in settlement. The bureau agrees to remove the accounts, often with modest damages. If the bureau refuses, litigation begins.
Most FCRA cases are filed in federal district court. The attorney files a complaint, and the bureau has 21 days to respond. Discovery follows: both sides exchange documents and data about how the bureau handles identity theft disputes. Depositions are rare in FCRA cases but not unheard of.
Many FCRA cases settle after discovery when the bureau sees the volume of evidence showing systemic failures. Bureaus often realize their dispute response process is indefensible and choose to settle rather than risk trial.
If the case goes to trial, damages are available under multiple categories. Actual damages cover all harm from the fraudulent accounts: the drop in credit score, denial of credit, higher interest rates, emotional distress. Statutory damages under the FCRA range up to $1,000 per violation. Punitive damages are available if the bureau's conduct was willful—meaning knowing or reckless disregard for the law.
The best part: the FCRA includes a fee-shifting provision. If you win, the bureau pays your attorney's fees and costs. Most FCRA cases are handled on contingency—you pay nothing upfront. The bureau pays the attorney if you win.
For identity theft victims with multiple fraudulent accounts and a bureau response of "verified," willfulness is often apparent. Ignoring the 4-business-day blocking deadline. Sending form-letter responses to identity theft disputes. Relying on automated systems when the case requires human judgment. These are the facts that support punitive damages.
Day 1: You submit identity theft report + supporting documentation (police report or FTC report) to credit bureau
Within 4 business days: Bureau must block fraudulent accounts from your credit report
Within 4 business days: Bureau must notify you that blocks are in place
Within 4 business days: Bureau must send notices to data furnishers instructing them to delete the accounts
If the bureau misses any deadline: This is a violation of the FCRA and grounds for legal action.
You did everything right. You reported the identity theft. You documented it. You disputed the fraudulent accounts. The bureau's job was clear and unambiguous. Block the accounts. Investigate properly. When they fail, you have specific identity theft rights under the FCRA. It's time to use them.
