A typical case starts with a denial letter. A Palm Beach County homeowner applies to refinance and learns her file shows a $6,200 store card and a cell phone account in collections. She opened neither. She files a police report, sends it to all three bureaus, and waits. Six weeks later, one bureau writes back that the accounts were "verified as accurate."
When a credit bureau won't remove identity theft accounts, the law has already answered the question. The Fair Credit Reporting Act requires the bureau to block fraudulent accounts within 4 business days after it receives your identity theft report, proof of identity, and a statement that the accounts are not yours. A block is not a dispute. The bureau does not get to ask the creditor first.
That distinction is where most of these cases are won or lost.
What should you do first when someone opens accounts in your name?
Freeze your credit at Equifax, Experian, and TransUnion, then place a fraud alert. A freeze is free. The bureau must place it within 1 business day of a phone or online request, or 3 business days if you mail it. It stops new accounts from being opened on your file.
A fraud alert tells lenders to verify your identity before extending credit. The initial alert lasts one year, and the bureau you call must pass it to the other two. If you file an identity theft report, you can upgrade to an extended alert that lasts seven years and keeps you off prescreened credit offer lists for five.
Neither tool removes anything already on your report. For that you need the block.
How does the identity theft block work?
You send each bureau four things: proof of your identity, a copy of an identity theft report, a list of the accounts that are not yours, and a signed statement that you did not make those transactions. The identity theft report is a report filed with a law enforcement agency. Most people file it with the FTC at IdentityTheft.gov or with their local police.
Once the bureau has those, it has 4 business days to block the accounts. That is 15 U.S.C. § 1681c-2. The bureau must then notify the creditor that the information may be the result of identity theft and that a block is in place. A creditor that gets that notice generally may not sell the debt or send it to a collector.
Label the letter as a block request under § 1681c-2. Send it by certified mail and keep the receipts. A request that reads like an ordinary dispute tends to get treated like one.
Can the credit bureau refuse to block the accounts?
Only for three reasons. The bureau can decline or rescind a block if it reasonably determines that the block was requested in error, that you made a material misrepresentation of fact, or that you received goods, services, or money from the transaction.
"The creditor says the account is yours" is not on that list. Neither is "we were unable to verify your request." The most common failure is the bureau that routes a block request through its regular dispute system, sends the creditor a code, gets back a "verified," and mails a form letter. That process skips the step the statute requires. The bureau has your police or FTC report in hand and has to make its own reasonable determination.
The second common failure is reinsertion. The account disappears in March and comes back in June after the creditor reports it again. A bureau that blocked an account and then lets it back on without a reasonable determination under the statute has another problem.
What if you dispute the accounts instead?
Then you get the regular dispute process, which is slower but still enforceable. The bureau must forward your dispute to the creditor within 5 business days and finish a reasonable reinvestigation within 30 days. It can extend to 45 days if you send relevant information during the first 30.
You can also send your identity theft report directly to the creditor. Use the address the creditor lists for disputes. Under the FCRA, a creditor that receives it may not keep reporting the account unless it later learns the information is correct. Do both. The block goes to the bureaus, and the report goes to the creditor.
What can you recover when the bureau gets it wrong?
If a bureau or creditor willfully violates the FCRA, you can recover your actual damages or statutory damages between $100 and $1,000, plus punitive damages the court allows and your attorney's fees and costs. That is 15 U.S.C. § 1681n. Actual damages in identity theft cases often include a denied or more expensive mortgage, a higher interest rate on a car loan, lost time, and the stress of months of letters that went nowhere.
You must sue within two years after you discover the violation and no later than five years after it happens. Start the clock on the date of the bureau's refusal letter, not the date the fraud began.
I handle credit report error cases for consumers across South Florida, in the Southern and Middle Districts of Florida and in state court. If a bureau has kept accounts on your report after you sent an identity theft report, save every letter and envelope it sent you. Then call or email Newhart Legal, P.A. Darren Newhart is a consumer protection attorney in Loxahatchee, Florida, and the consultation costs nothing.
Questions people ask
How long does a credit bureau have to remove identity theft accounts?
Four business days. Once the bureau receives proof of your identity, an identity theft report, the list of accounts, and your statement that they are not yours, the FCRA requires it to block those accounts within 4 business days.
Is an FTC report from IdentityTheft.gov enough for the block?
It is the most common way to get an identity theft report. The FCRA requires a report filed with a law enforcement agency, and the FTC report filed online is the version most people use. A police report works too.
Does a credit freeze remove fraudulent accounts?
No. A freeze stops new accounts from being opened on your file. It does nothing about accounts already there. To remove those, send each bureau a block request with your identity theft report.