Identity Theft and Your Credit Report: How the FCRA Protects Victims

What Identity Theft Looks Like on Your Credit Report

Many victims of identity theft first learn that they have been targeted when they check their credit report and find accounts they never opened. Sometimes the victim is checking his or her credit report in the regular course. Other times, they are prompted to look at the report after receiving a denial letter for credit never applied for, or notice that a loan that should have been approved has been denied due to credit reporting issues (e.g., “delinquent accounts”).

Reporting of fraudulent accounts are a common symptom: credit cards, personal loans, auto loans, or utility accounts opened by someone using your stolen personal information, now appearing on your report as though they are yours. You may also see unauthorized hard inquiries from lenders you never contacted, which indicate someone submitted credit applications in your name. Unfamiliar addresses, employers, or aliases attached to your credit file are another hallmark — identity thieves often change the address on file to intercept mail and prevent the real account holder from discovering the fraud.

In many cases, the first sign is not the credit report itself but its consequences: a debt collector calling about a balance you don’t owe, a denial letter for a mortgage or credit card based on accounts you’ve never seen, or a sudden unexplained drop in your credit score. By the time you realize what has happened, the fraudulent accounts may have been reporting for months.

If any of this sounds familiar, you are not alone — and you have legal rights designed specifically to address this problem.

How Identity Theft Damages Real People — And How It Gets Resolved

Consider a scenario our firm sees regularly: a consumer applies for a mortgage and is unexpectedly denied. She pulls her credit reports and discovers three credit card accounts she never opened, all carrying substantial balances, all reported as delinquent. She files disputes with all three credit bureaus, provides a police report and an FTC identity theft report, and explains that these accounts are fraudulent.

The bureaus send her dispute to the creditors through their automated system. The creditors check their own records, see a matching name and Social Security number, and report back that the accounts are “verified.” The bureaus close the disputes. The fraudulent accounts remain. The mortgage is still denied.

The consequences can be devastating. Hard earned credit destroyed. Years of patient and steady financial management thwarted by misreporting that makes the consumer appear to be a bad credit risk, when the opposite is true.

This is the point where legal representation changes the outcome. Schlanger Law Group regularly represents consumers in these situations as the core focus of our practice. Although every case is different (and no outcome can ever be guaranteed), we have regularly achieved outstanding, six-figure settlements for clients in these situations. In addition to monetary compensation, we are regularly able to negotiate removal of the offending, incorrect information from our clients’ credit reports. For more on our firm’s track record, see our case results page.

Your Legal Rights When Identity Theft Hits Your Credit Report

The Fair Credit Reporting Act provides several layers of protection for identity theft victims. Some of these provisions apply to all consumers with credit report errors; others are unique to identity theft. Understanding both is important, because they form the basis of any legal claim if the credit bureaus or furnishers fail to do their jobs.

The Bureau’s Duty to Reinvestigate Your Dispute (§ 1681i). When you dispute a fraudulent account, each credit bureau must conduct a reasonable reinvestigation. In the identity theft context, this obligation carries particular weight: you are not merely claiming a balance is wrong or a payment was misreported — you are telling the bureau, often with an identity theft report and police report in hand, that the account does not belong to you at all. Despite this, bureaus routinely process identity theft disputes through the same automated system they use for everything else. The dispute gets reduced to a standardized code, transmitted electronically to the furnisher, and the furnisher’s “verified” response is accepted without meaningful scrutiny. A bureau that rubber-stamps a furnisher’s verification when the consumer has provided documentary evidence of identity theft has not conducted a reasonable reinvestigation. This is the most common basis for FCRA litigation in identity theft cases.

The Furnisher’s Duty to Investigate (§ 1681s-2(b)). Once a furnisher — the bank, credit card company, or debt collector reporting the account — receives notice of your dispute from a credit bureau, it must conduct its own reasonable investigation. At the heart of most § 1681s-2(b) claims is improper verification: in practice, most furnishers rubber-stamp their original reporting without conducting any meaningful investigation. Rather than examining whether the person who opened the account is actually the person disputing it, the furnisher simply confirms the account exists in its records and reports back “verified.” Furnishers often have the information needed to resolve the question: the original application, the IP address used to apply online, the delivery address for the card, the phone number on file. When none of these match the consumer’s actual information and the furnisher continues reporting after notice of the dispute, that failure to investigate is itself an FCRA violation. Along with § 1681i claims against bureaus, § 1681s-2(b) claims against furnishers are a primary vehicle in identity theft FCRA litigation.

The Identity Theft Block (§ 1681c-2). This provision is unique to identity theft victims. If you submit an identity theft report, credit bureaus must block the fraudulent information within four business days. Blocking is stronger than a standard dispute — it requires the bureau to remove the information and prevent the furnisher from continuing to report it. Furnishers who receive notice of a block may not sell or transfer the blocked debt. In practice, bureaus frequently fail to implement blocks correctly, impose requirements not found in the statute, or allow blocked information to reappear.

Your Right to Account Documentation (§ 1681g(e)). Also unique to identity theft victims: you have the right to request copies of the fraudulent application, transaction records, and other account documentation from the business where the fraud occurred. The business must provide these records within 30 days of your request. This is a powerful investigative tool — the documents often reveal that the application was submitted from a different state, listed a different phone number, or used an employer the real consumer has never worked for.

Reinsertion and Reasonable Procedures (§ 1681e(b)). A related problem arises when a fraudulent account is successfully deleted or blocked but later reappears on the consumer’s credit report. Reinsertion of identity theft accounts can implicate the bureau’s overarching duty under § 1681e(b) to follow reasonable procedures to assure maximum possible accuracy. When a bureau’s systems allow previously blocked or deleted fraud accounts to be reinserted — sometimes by the same furnisher, sometimes through a debt buyer who purchased the fraudulent account — it points to a systemic failure in the bureau’s procedures, not merely an isolated error.

Beyond the FCRA, identity theft victims may have claims under complementary federal statutes. The Fair Credit Billing Act (§ 1666) and Truth in Lending Act (§ 1643) limit liability for unauthorized credit card charges to $50. The Electronic Fund Transfer Act provides similar protections for unauthorized debit card and bank account transactions. These statutes address the unauthorized charges themselves; the FCRA addresses how those charges are reported to the credit bureaus. For a broader overview of the FCRA framework, see our credit report errors hub page.

What to Do When You Discover Identity Theft on Your Credit Report

If you’ve found fraudulent accounts or other signs of identity theft on your credit report, taking the right steps in the right order matters. Each action below builds on the last, and several of them trigger specific legal protections.

Secure your existing financial accounts immediately. Before anything else, make sure your existing bank accounts and credit cards are safe. Contact your banks and credit card companies, alert them to the identity theft, and confirm that no unauthorized transactions have occurred. Change your passwords, PINs, and security questions. If any accounts have been compromised, work with the financial institution to close them and open new ones. This step comes first because the immediate priority is stopping the bleeding — preventing the thief from doing further damage with access they may already have.

File an identity theft report at IdentityTheft.gov. The FTC’s identity theft report is the document that triggers your § 1681c-2 blocking rights and your § 1681g(e) right to demand account documentation from creditors. Without it, you still have dispute rights, but you lose access to the stronger protections available only to identity theft victims.

Place a fraud alert or credit freeze. One call to any credit bureau triggers a fraud alert at all three. A fraud alert requires creditors to take reasonable steps to verify your identity before opening new accounts in your name. A credit freeze goes further — it blocks new credit inquiries entirely until you lift the freeze. Both are free. A freeze is stronger protection; a fraud alert is easier to manage if you are actively applying for credit yourself.

File a police report. Some creditors and credit bureaus still require a police report in addition to the FTC report. It also strengthens your documentation if the case later requires litigation.

Request your credit reports from all three bureaus. You can obtain free reports through AnnualCreditReport.com. As an identity theft victim, you are entitled to additional free reports beyond the standard annual allotment. Review each report carefully for fraudulent accounts, unauthorized inquiries, and unfamiliar personal information.

Send written disputes to each credit bureau. Use certified mail with return receipt requested. Include your identity theft report, your police report if you have one, and a specific description of each fraudulent item. Reference § 1681c-2 explicitly and request that the fraudulent information be blocked.

Request account documentation from the fraudulent creditors. Under § 1681g(e), the business where the fraud occurred must provide copies of the application and transaction records within 30 days.

Document everything. Keep copies of every letter you send, every response you receive, and a log of every phone call. If this becomes a lawsuit, your documentation is your evidence.

When putting together your disputes, take advantage of the many online resources available to follow best practices. For more on the dispute process, see our guide to disputing credit report errors. For a comprehensive resource on your rights, download our free e-book on identity theft, credit reporting errors, and unauthorized charges. If the dispute process does not resolve the problem, speak promptly with a consumer protection lawyer. An experienced identity theft lawyer can evaluate what has already happened, identify FCRA violations that may have occurred during the dispute process, and advise you on your legal options before time-sensitive deadlines pass.

Why the Credit Bureaus Often Fail Identity Theft Victims

If you’ve followed the steps above and the fraudulent accounts are still on your credit report, you are not alone. The credit bureau dispute process fails identity theft victims not because of isolated mistakes, but because of structural features of how the bureaus operate.

The process handles tremendous volume and is highly automated. When you file a dispute, the bureau transmits it to the furnisher through an electronic system called e-OSCAR, which converts your detailed explanation into a standardized two-digit code. An identity theft case — potentially involving forged applications, stolen Social Security numbers, and multiple fraudulent accounts — gets reduced to the same abbreviated format as a dispute over a late payment date. The furnisher receives the code, checks its records, sees a matching name and Social Security number, and reports back that the account is “verified.” The bureau closes the investigation.

Errors in coding are common. Because of the compression into standardized codes, the substance of the consumer’s dispute — and the supporting documentation — is frequently miscoded or lost entirely. The furnisher may receive a code that does not even communicate that the dispute involves identity theft, let alone convey the specific evidence the consumer provided.

Human review is limited and too cursory. To the extent a human being reviews the dispute at all, the review is brief and superficial. The system is designed for throughput, not for the kind of careful, individualized analysis that identity theft cases demand.

Many bureaus outsource the dispute process to overseas and/or third-party vendors. These vendors may have even less context, training, and authority — and their employees are often being assessed on speed rather than accuracy or thoroughness.

Economic incentives may favor denial. The economic arrangements between bureaus and the lenders who furnish data may incentivize erring on the side of denying disputes. The cost of extending credit to someone who is not creditworthy can be very high — so there is systemic pressure to leave reported accounts in place rather than remove them, even when the consumer has presented compelling evidence of fraud.

Reinsertion compounds the problem. Even when a fraudulent account is removed, it can reappear — sometimes because the original furnisher re-reports it, sometimes because the fraudulent debt has been sold to a debt buyer who begins reporting it as though it were new. When the same information the bureau already determined was fraudulent shows up again on the consumer’s report, it reflects a breakdown in the bureau’s procedures.

The FCRA’s private enforcement mechanism — the right of individual consumers to sue — exists precisely because this pattern is so common. When the dispute process fails, litigation is often the only path to a permanent correction and to compensation for the harm the errors have caused. For more on when credit report errors become legal violations, see our article on when disputes become FCRA violations.

Related Practice Areas

• → Identity Theft on Your Credit Report
• → Student Loan Credit Report Errors
• → Mixed Credit Reports
• → Erroneously Reported as Deceased
• → Inaccurate Account Information
• → FCRA Lawyer — Full Overview

How Schlanger Law Group Helps

Schlanger Law Group is a consumer protection firm focused on credit reporting litigation, identity theft, and unauthorized charges. This is not one practice area among many — it is what we do. The firm has represented consumers in FCRA cases since 2007, and our attorneys bring the depth that comes from nearly two decades of concentrated experience in this area of law.

For identity theft clients specifically, our work includes structuring disputes to trigger and preserve every statutory protection available, filing federal lawsuits against credit bureaus and furnishers who fail to block or remove fraudulent accounts, and pursuing the full range of FCRA remedies: actual damages for credit denials, higher interest rates, emotional distress, and lost time; statutory damages for willful violations; and punitive damages where the evidence supports them.

Schlanger Law Group typically handles identity theft cases on a contingency basis with no upfront cost to the client. The FCRA’s fee-shifting provision means that when consumers prevail, the defendant pays the attorney’s fees — not the client. Schlanger Law Group, LLP represents victims of identity theft in New York, New Jersey and nationwide.

If identity theft is affecting your credit report and the dispute process has not resolved it, contact Schlanger Law Group for a free consultation. You can also learn more about what an FCRA lawyer does and how we approach these cases.

Frequently Asked Questions About Identity Theft and Your Credit Report

How do I report identity theft to the credit bureaus?

Send written disputes to each credit bureau — Equifax, Experian, and TransUnion — identifying the fraudulent accounts and providing your supporting documentation, including your FTC identity theft report. For more information on how to file a written dispute, click here.

Can you sue for identity theft?

Yes. There are several federal statutes that are relevant here. Under the FCRA, you can sue credit bureaus that fail to conduct a reasonable reinvestigation of your dispute and furnishers that fail to investigate whether an account is actually yours. It is important to understand that the practical target in most identity theft FCRA cases is not the identity thief — who is typically judgment-proof — but the credit bureaus and creditors whose failures allowed the fraud to persist on your credit report. In addition to the FCRA, be sure to consider your rights under the Electronic Fund Transfer Act, the Fair Credit Billing Act, the Truth in Lending Act, and state law.

How much does an identity theft lawyer cost?

Most FCRA attorneys, including Schlanger Law Group, handle identity theft cases on a contingency basis, meaning there is no upfront cost to you. The FCRA provides for attorney’s fee shifting: if you prevail, the defendant — not you — pays your legal fees. The FCRA’s fee-shifting provisions make these claims financially viable for many consumers who would otherwise struggle to find counsel.

What damages can I recover in an identity theft FCRA case?

The FCRA provides for actual damages (including credit denials, higher interest rates, emotional distress, and the time you spent trying to resolve the problem), statutory damages of $100 to $1,000 per willful violation, and punitive damages in appropriate cases. Attorney’s fees and litigation costs are also recoverable. For a more detailed explanation, see our article on FCRA damages.

What is the difference between a fraud alert and a credit freeze?

A fraud alert notifies creditors that they should take additional steps to verify your identity before opening new accounts. An initial fraud alert lasts one year; an extended fraud alert, available to identity theft victims who file an FTC report, lasts seven years. A credit freeze is stronger — it blocks all new credit inquiries until you lift the freeze. Both are free. A freeze provides better protection against new fraudulent accounts; a fraud alert is more practical if you are actively applying for credit.

How long does it take to resolve identity theft on your credit report?

The dispute process itself requires bureaus to respond within 30 days (45 days in some circumstances). Cases that proceed to litigation vary widely, but many resolve within 6–12 months. For more detail, see our article on credit reporting dispute timelines.

If identity theft is affecting your credit report, contact Schlanger Law Group for a free consultation.