If someone opened accounts in your name, the Fair Credit Reporting Act requires credit bureaus to block that fraudulent information from your report within 4 business days of receiving your identity theft report (15 U.S.C. § 1681c-2). Furnishers must stop reporting the fraudulent accounts once notified. When they don't follow through, and they frequently don't, you may have grounds for an FCRA lawsuit. An FCRA attorney can file suit at no cost to you.
You pull your credit report and find accounts you never opened. A credit card from a retailer you've never shopped at. A car loan in your name. A medical bill from a hospital you've never visited. Your heart sinks. Identity theft.
The damage is real. Your credit score plummets. Lenders see the fraud and deny you a mortgage or car loan. Collections agencies call about debts that aren't yours. The bureaus tell you to file a dispute. You do. Nothing changes. The fraudulent accounts stay on your report for months.
This shouldn't happen. The Fair Credit Reporting Act has specific rules for identity theft. The bureaus must block the fraudulent information. The companies that reported it must stop. When they fail to do either, you have legal options. Here's what the law actually requires and what to do when the system doesn't work.
How to Know If Identity Theft Is Affecting Your Credit Report
Identity theft often hides in plain sight on your credit report. You might not discover it until you apply for a loan or check your score out of habit. Watch for these red flags.
Accounts you never opened. This is the most obvious sign. A credit card, auto loan, or personal loan in your name that you don't recognize. The account may be recent or years old. The fraudster may still be using it, or it might have been abandoned.
Addresses you've never lived at. Your credit report lists where creditors have reported you live. If an address appears that you don't recognize, it may indicate someone opened an account using a stolen identity and their own address.
Hard inquiries you didn't authorize. A "hard inquiry" happens when a lender checks your credit in response to a credit application. Too many hard inquiries in a short time signal that someone may be applying for credit in your name.
Collections accounts for debts that aren't yours. Medical collections, credit card collections, or utility bills in collections can appear on your report even if you never incurred the debt. Collection agencies sometimes report to the bureaus before verifying the account owner is actually the person they're after.
The moment you spot any of these, pull all three of your credit reports (Equifax, Experian, TransUnion) from annualcreditreport.com, where federal law entitles you to one free report per bureau each year. Check each report against the others. Fraudulent accounts may appear on only one or two bureaus, not all three.
The Steps the Law Expects You to Take
Once you confirm identity theft, the Fair Credit Reporting Act and FTC guidelines establish a clear timeline for action. Follow these steps methodically. Each one generates documentation you'll need later if the bureaus or furnishers don't cooperate.
File an FTC identity theft report. Go to IdentityTheft.gov and file a report. Don't call, don't email, don't mail it in. The FTC online portal generates an official identity theft report with a case number. This document is crucial. The credit bureaus use it to verify that your disputes are legitimate identity theft claims, not just disagreements about debt. The report takes about 10 minutes to complete. You'll list the fraudulent accounts, when you discovered them, and steps you've already taken.
File a police report. Contact your local police department and file a report for identity theft. Give them the details from your FTC report and the police report number. Furnishers and bureaus take police reports seriously. A police report on file proves you reported the crime and didn't just ignore it. Some furnishers won't even investigate identity theft claims without one.
Send dispute letters with your identity theft report attached. Write to each credit bureau (Equifax, Experian, TransUnion) and dispute each fraudulent account. Include a copy of your FTC identity theft report with each letter. Under the FCRA, the bureau has 30 days to investigate. But when you're claiming identity theft, the rules change. The bureau should block the fraudulent information immediately, not wait for an investigation to finish.
Consider a fraud alert or credit freeze. You can place a fraud alert on your credit file at one bureau, and they'll notify the other two. A fraud alert lasts one year and tells creditors to verify your identity before extending credit. A credit freeze is stronger. It blocks anyone, including you, from accessing your credit report without you lifting the freeze first. Freezes last indefinitely and are free.
What the Bureaus Are Required to Do Under the FCRA
This is where the law gets sharp. The FCRA gives you specific rights and gives the bureaus specific obligations. Section 1681c-2 is the linchpin of identity theft protection.
Block fraudulent information within 4 business days. Under 15 U.S.C. § 1681c-2, once a bureau receives your FTC identity theft report, it must block the fraudulent information from your credit report within 4 business days. Not 30 days. Not after an investigation. Four business days. This is a hard deadline. The bureau can't remove the account from its records, but it must block it from showing up on your report. If Equifax gets your identity theft report on a Monday, the blocked account must not appear on reports pulled on Thursday or later.
Notify the furnisher of the block. When a bureau blocks fraudulent information, it must notify the entity that reported it (the furnisher) that the information has been blocked and why. The furnisher then has its own obligations. This step is critical because it triggers the furnisher's duty to stop reporting.
Prevent reinsertion of the fraudulent information. Even after blocking, a furnisher might try to re-report the fraudulent account weeks or months later. The FCRA says the bureau must not allow blocked information to be reinserted. The furnisher can't update the account and sneak it back onto your report.
When a bureau receives your identity theft report and does nothing within the four-day window, or when it blocks the account only to have it reappear later, that's a violation of federal law and grounds for a lawsuit.
What Furnishers Are Required to Do
A furnisher is any company that reports information to the credit bureaus. It could be the creditor (the credit card company) or a debt collector or debt buyer that purchased the account. Once a furnisher receives notice of identity theft, the law is explicit about what it must do.
Stop reporting accounts after identity theft notice. When the bureau notifies the furnisher that an account has been blocked for identity theft, the furnisher must stop reporting it. The furnisher should not attempt to collect on the account, should not report updates to it, and should not sell it to another collector. The account is off-limits.
Investigate and not re-report blocked information. If the furnisher receives a direct dispute from you (a dispute letter) that includes your identity theft report, the furnisher must investigate. Investigation doesn't mean a deep dive. It means the furnisher reviews the account and confirms it was actually fraudulent or decides it can't verify that you opened it. Either way, once the furnisher knows the account is blocked for identity theft, it can't turn around and re-report it.
Reality check: Furnishers frequently violate these rules. A collector buys an account in bulk, reports it to the bureaus, and when notified of the block, simply ignores the notification and keeps reporting. Months later, the account reappears on your credit report. This is a federal violation and creates liability for the furnisher.
When the System Fails and What to Do Next
In a functioning system, here's what happens: You file your FTC identity theft report. The bureau blocks the fraudulent accounts within four days. The furnisher stops reporting. Your credit report is clean again within weeks. Reality is messier.
The bureau doesn't block within four days. You send your dispute letter with the identity theft report. Days pass. A week. Two weeks. The account is still on your report. You call the bureau. They tell you the investigation is ongoing. But the law doesn't say "within 30 days if you investigate." It says four business days. No exceptions. If the bureau missed the deadline, it's already in violation.
The furnisher keeps reporting after notice. The bureau blocks the account. Two weeks later, your credit report refreshes and the account is back. The furnisher re-reported it. This happens frequently with aggressive debt collectors who never received the bureau's notification, or who ignore it. The account should stay blocked. If it reappears, the furnisher violated the FCRA.
The fraudulent accounts stay for months despite your efforts. Your credit score is still wrecked. Lenders still deny your applications. You're past the point where disputes alone will fix this. The system has broken down. Now you need legal action.
Consult an FCRA attorney. When the bureaus and furnishers don't follow the law, FCRA attorneys can file suit on your behalf. The FCRA allows you to recover statutory damages (up to $1,000 per violation per person), actual damages (the harm you suffered), and attorney's fees. Many FCRA lawsuits are brought on a contingency basis, meaning you pay nothing upfront. The case is funded by the recovery.
If you've followed the steps above (FTC report, police report, dispute letters) and the fraudulent information is still on your credit report weeks later, or if the bureaus and furnishers have ignored your notices, contact an FCRA attorney. We'll review your credit reports and dispute history and tell you whether you have a case.
Identity theft is devastating, but the law gives you tools to fight back. Use them, and if the bureaus and furnishers don't comply, hold them accountable.
