What Identity Theft Does to a Credit Report
Identity theft typically produces a cluster of unfamiliar items on a credit report: new accounts opened in your name that you never authorized, hard inquiries from lenders you never applied to, collection accounts for balances you never incurred, address variations showing places you never lived, and sometimes a new Social Security number or date of birth variant. Each one drops the score and — more importantly — locks you out of legitimate credit until cleaned up.
Most victims don't discover identity theft for months. The thief usually opens a few accounts, runs them up, and moves on. You find out when a collection notice arrives for an account you never opened, when a card application is declined, or when the bureaus mail a free annual report showing tradelines you don't recognize.
⚖️ Your Rights Under the FCRA as an Identity Theft Victim
Identity theft victims have significantly stronger rights than ordinary dispute filers. The Fair Credit Reporting Act gives you these specific tools:
- FCRA §605B: Once you submit an identity theft report, the bureau must BLOCK the fraudulent information within four business days — not just investigate, block
- FCRA §605A: You can place a free one-year fraud alert on your file, extendable to seven years with an identity theft report
- FCRA §609(e): Identity theft victims can demand, at no cost, all application and transaction records from any creditor whose account is on their report
- FCRA §611: The standard 30-day dispute investigation still applies for any item not blocked under §605B
- Under FCRA §623(a)(6), furnishers must stop reporting fraudulent information once notified
The federal IdentityTheft.gov portal generates the identity theft report that unlocks the §605B block right.
The Five Steps Every Identity Theft Victim Should Take
Step 1 — File a Report at IdentityTheft.gov
The FTC's IdentityTheft.gov site walks you through an official Identity Theft Report (ITR) in about 15 minutes. This report is the single most important document in the entire process. It unlocks the bureau's FCRA §605B block, it establishes the 7-year extended fraud alert, and it satisfies the "sufficient documentation" requirement most creditors impose before removing a fraudulent account.
Step 2 — Place a Fraud Alert
Contact any one of the three bureaus (Equifax, Experian, or TransUnion) and request a fraud alert. That bureau is legally required to notify the other two. A fraud alert requires any new creditor to take reasonable steps to verify your identity before opening new credit — effectively stopping the thief in their tracks.
Step 3 — Consider a Security Freeze
A security freeze is stronger than a fraud alert. It locks your credit file entirely; no new account can be opened without you lifting the freeze with a PIN. Freezes are free at all three bureaus under federal law (FCRA §605A(i)). Freezes do not affect your credit score and do not block pre-existing lenders from viewing your file.
Step 4 — File the FCRA §605B Block Request
Send each bureau a written block request by certified mail that includes: a copy of your Identity Theft Report, a copy of your government-issued ID, proof of address (utility bill or lease), and a clear list of every fraudulent item being blocked. Under §605B, the bureau has four business days from receipt to block the information. They cannot require the furnisher to "verify" first — the block is automatic.
Step 5 — Send Fraud Affidavits to Each Creditor
For every fraudulent account, send the creditor a written fraud affidavit (the IdentityTheft.gov site provides a free template) along with a copy of your ID, your Identity Theft Report, and a demand for records under FCRA §609(e). Creditors typically close the account as fraud and stop reporting within 30 to 60 days.
The Extended Fraud Alert
An ordinary fraud alert lasts one year. Once you have filed an official Identity Theft Report, you qualify for an extended fraud alert that lasts seven years and gives you two additional free credit reports per year from each bureau. Most victims should request the extended alert — the administrative burden is minimal and the protection runs for years.
What to Do With Existing Accounts
If your real accounts were compromised (card numbers stolen, bank drafts skimmed), notify those creditors immediately and get replacement account numbers. File a police report if possible — some creditors require one before refunding unauthorized charges. Under federal law, your liability for unauthorized credit card charges is capped at $50 (and is zero for most major issuers); liability for unauthorized debit card charges is capped at $50 if reported within two business days, $500 if reported within 60 days, and unlimited after that.
Common Mistakes to Avoid
- Calling the creditor to "sort it out" before filing the ITR. The Identity Theft Report unlocks rights that ordinary customer service calls don't.
- Skipping the security freeze. A fraud alert is a warning; a freeze is a lock.
- Not pulling all three bureau reports. Fraudsters often target a single bureau; items appearing on only one report are easily missed.
- Treating §611 dispute as the same as §605B block. §605B is faster and doesn't require investigation.
- Missing the police report. Some creditors require a local police report before issuing refunds.
Ready to Clean Up Identity Theft Damage?
Call for a free evaluation. We'll walk you through the FTC identity theft report, bureau blocks, and creditor fraud affidavits.
📞 (832) 696-0755 Free ConsultationThis article is provided for educational purposes and is not legal advice. For questions about your specific situation, consult a licensed attorney or a credentialed credit counselor.