Identity Theft and Credit Reporting: FCRA Rights, Disputes, and Remedies

Summary. What the credit reporting statute requires, how a dispute actually works, what identity theft tools exist, and what a violation is worth.

Part I: A file you never opened

You have a file. Several, actually. Assembled without your consent, by companies you have no relationship with, from data supplied by companies that owe you nothing in particular, and sold to landlords, lenders, insurers, and employers who use it to decide things that matter enormously.

You did not consent to its creation and you cannot make it go away. What Congress gave you instead, in the Fair Credit Reporting Act, is a set of procedural rights: to see the file, to dispute what is in it, to require an investigation, to limit who may look at it, and — when the system fails — to sue.

The statute's own statement of purpose in 15 U.S.C. § 1681 is unusually candid: consumer reporting agencies have assumed a vital role, there is a need to ensure they "exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy," and the banking system depends on accurate reporting. The implementing regulation is Regulation V, at 12 C.F.R. part 1022.

The practical structure worth holding in mind: three parties, three sets of duties.

Consumer reporting agencies — the bureaus — assemble and sell reports.
Furnishers — lenders, collectors, landlords, utilities — supply the data.
Users — anyone who pulls a report — must have a permissible purpose and must give notice when they act adversely.

Nearly every dispute in this field is about which of the three failed, and the answer determines what you can do about it.

Part II: Accuracy — the duty and its limits

15 U.S.C. § 1681e requires an agency to "follow reasonable procedures to assure maximum possible accuracy" of the information in a consumer report.

That is a strong phrase, and it does more work than people expect. Three points:

It is a reasonableness standard, not a guarantee. An agency is not strictly liable for every error. The question is whether its procedures were reasonable given what it knew and what the error cost.

"Accurate" includes "not materially misleading." A technically true entry that creates a false impression can violate the duty. A debt reported as "charged off" that was actually discharged in bankruptcy, or an account reported without noting that it is disputed, can be accurate in a narrow sense and misleading in the sense that matters.

The mixed file problem. Agencies match data to consumers by name, address, partial identifiers, and Social Security number fragments. People with common names, junior/senior pairs, and consumers who share addresses get merged. A mixed file — someone else's debts in your report — is one of the most damaging and most persistent errors, precisely because each individual dispute resolves one line while the underlying matching logic keeps re-merging the file.

And a special accuracy rule for a special context: the Supreme Court in Safeco Insurance Co. of America v. Burr addressed adverse action notices in insurance and, more consequentially for the whole statute, defined willfulness to include reckless disregard — a reading that governs the availability of statutory and punitive damages across the Act.

Part III: The dispute — how it actually works

This is the operational core of the statute, and the mechanics matter more than the rights.

15 U.S.C. § 1681i requires that when a consumer disputes the completeness or accuracy of an item, the agency must conduct a reasonable reinvestigation, generally within 30 days, and must forward all relevant information the consumer provided to the furnisher.

**15 U.S.C. § 1681s-2 then imposes duties on the furnisher: not to report information it knows or has reasonable cause to believe is inaccurate, to correct and update, and — critically — to investigate on receipt of a dispute forwarded by an agency.

Here is the rule that decides an enormous number of cases, and that almost no consumer knows:

A dispute sent directly to the furnisher generally does not create a private right of action. The furnisher's investigation duty — the one you can sue over — is triggered by a dispute that comes through a consumer reporting agency.

The statute's enforcement provisions largely exempt the "report accurately in the first place" duties from private suit, leaving them to regulators, while preserving private enforcement of the investigation-after-notice duty. The practical consequence:

Always dispute through the bureaus. Disputing directly with the creditor may feel more sensible and may even work — but it does not preserve the claim. Dispute through the bureaus first, or at minimum in addition.

What a reasonable investigation requires. Courts have generally held that a furnisher must do more than confirm that the data it sent matches the data in its own system. Where the consumer supplies documents contradicting the tradeline, "we verified it" without examining those documents is not a reasonable investigation. This is why the documents you attach to a dispute matter so much: they define what a reasonable investigation would have had to consider.

What happens after. The agency must notify you of the results within five business days of completion, provide a free copy of the revised report, and — on request — send corrections to anyone who received the report in the past six months (two years for employment purposes). Ask for that. It is free, it is rarely requested, and it is how you undo the harm rather than merely stopping it.

If the item is deleted, it may not simply reappear. Reinsertion requires certification by the furnisher that the item is complete and accurate, plus written notice to you within five business days. An item that pops back without that notice is a separate violation.

Part IV: Identity theft — the specific tools

The Fair and Accurate Credit Transactions Act added a set of tools aimed squarely at identity theft, and they are among the most useful and least used provisions in consumer law.

Fraud alerts — 15 U.S.C. § 1681c-1. A one-year initial alert on a good-faith suspicion, a seven-year extended alert with an identity theft report, and an active duty alert for deployed servicemembers. Place it with one bureau and that bureau must notify the others. A user must take reasonable steps to verify identity before extending credit.

Security freeze. A freeze blocks new credit from being opened in your name by preventing access to the report. Federal law made freezes and thaws free at all three nationwide bureaus, and they must be placed and lifted within short statutory deadlines — generally one business day for an electronic request, and one hour for a lift. A freeze is stronger than a fraud alert and it is the single best protective step available. Freeze children's files too where the law provides for it; child identity theft goes undetected for years because nobody checks a nine-year-old's credit.

Block of information resulting from identity theft — 15 U.S.C. § 1681c-2. This is the most powerful tool in the statute and the least known. On receipt of appropriate proof of identity, an identity theft report, identification of the information, and a statement that it does not relate to a transaction by the consumer, the agency must block the information within four business days and notify the furnisher.

A block is not a dispute. A dispute asks for an investigation and may end with "verified." A block is close to automatic on proper documentation. The gateway is the identity theft report — which means the police report or federal identity theft report is not a formality; it is the key to the strongest remedy in the Act.

The parallel right against furnishers and debt collectors: on receipt of the same documentation, a furnisher generally may not continue to report the fraudulent information, and a debt collector must notify the creditor that the information may be fraudulent. You can also demand, from a business, copies of the application and transaction records made in your name by the identity thief — a right that lets you see what the thief actually did, and that businesses routinely resist because almost nobody invokes it.

And the criminal side. 18 U.S.C. § 1028 criminalizes fraud in connection with identification documents, and 18 U.S.C. § 1028A adds a mandatory consecutive two-year sentence for aggravated identity theft. In Dubin v. United States, the Supreme Court narrowed that provision considerably, holding that the use of a means of identification must be at the crux of the offense — the identity itself must be what makes the conduct criminal, not merely an ancillary feature of a billing fraud.

Part V: Who may look at your file

A consumer report may be furnished only for a permissible purpose: in connection with a credit transaction, employment (with the consumer's written authorization and a separate disclosure), insurance underwriting, a legitimate business need in connection with a transaction initiated by the consumer, account review, a court order, or a few other enumerated grounds.

A pull without a permissible purpose is a violation, and it is one consumers can detect: the inquiry section of the report lists who looked. An unexplained hard inquiry from a company you never dealt with is worth a letter.

The employment context has its own rules, and they are strict: a clear and conspicuous standalone disclosure, written authorization, and — before taking adverse action — a pre-adverse action notice with a copy of the report and a summary of rights, giving the applicant a chance to correct errors before the decision is final. Employers get this wrong constantly, usually by burying the disclosure in an application packet. See Employment Law Toolkit.

Adverse action notices more generally: a user who takes adverse action based on a report must tell you, identify the agency, and inform you of your right to a free copy and to dispute. This is how most consumers first learn something is wrong.

Part VI: Remedies

Two liability provisions, and the difference between them is most of the money.

15 U.S.C. § 1681n — willful noncompliance. Actual damages or statutory damages of $100 to $1,000, punitive damages as the court allows, plus costs and reasonable attorney's fees. Under Safeco, willfulness includes reckless disregard — an objectively unreasonable reading of the statute, not merely a knowing violation.

15 U.S.C. § 1681o — negligent noncompliance. Actual damages only, plus costs and fees. No statutory damages and no punitive damages.

Why this matters practically: a negligence case requires proving actual damages, which for a credit reporting error often means denied credit, a higher interest rate, a lost job or apartment, or emotional distress — provable but not automatic. A willfulness case does not. The fee-shifting provision is what makes the statute enforceable at all, since individual damages are frequently modest.

And then there is standing, which has narrowed the field considerably.

In Spokeo, Inc. v. Robins, the Court held that a bare procedural violation, divorced from concrete harm, does not establish Article III standing — a plaintiff must allege an injury that is both particularized and concrete, though intangible harms can qualify.

In TransUnion LLC v. Ramirez, the Court went further: class members whose inaccurate information — a false terrorist-watchlist designation — was never disseminated to a third party lacked standing, because "no concrete harm, no standing." Only those whose reports were actually provided to businesses could sue.

The practical translation for anyone with a credit reporting problem: dissemination is the injury. Document who received the report, when, and what happened. A denied application, a raised rate, a lost apartment, a rescinded job offer — these are the facts that convert a statutory violation into a case. Keep the denial letters.

Part VII: Data breaches

A breach is not, by itself, a Fair Credit Reporting Act violation. The breached company is usually not a consumer reporting agency, and the harm — exposure of data — is not the same as an inaccurate report.

What a breach actually gives you:

State data breach notification statutes in every state, requiring notice and often free monitoring.
State consumer protection claims, and negligence claims where a duty and damages can be established.
Standing problems. After TransUnion, a plaintiff whose data was exposed but not misused faces a real question about concrete harm, and courts have split on how imminent a risk of future identity theft must be.
Practical remedies that beat litigation: freeze your credit at all three bureaus, accept the offered monitoring, and watch your accounts.

The most useful response to a breach notice is not a lawsuit. It is a freeze, placed the same day, which costs nothing and forecloses the most damaging use of the stolen data.

Part VIII: How long things stay

Most negative information may be reported for seven years; bankruptcies for ten. The seven years generally runs from the date of first delinquency that led to the collection or charge-off — not from the date of last payment and not from when a debt buyer purchased it.

This matters because re-aging is a real and recurring abuse. A debt buyer that reports a new "date of first delinquency" restarts a clock that should have been running toward expiration. Compare the reported date across all three bureaus and against your own records. A discrepancy is a strong dispute.

Also: paying an old collection does not restart the reporting clock, though it may affect scoring models differently. And some information — criminal convictions in certain contexts, and reporting for very large transactions — follows different rules.

Part IX: Four files, four problems

Ana, whose report contains a $9,400 medical debt she never incurred

Ana pulled her report after a mortgage pre-approval came back with a rate she did not expect. There, in collections, is a medical debt from a hospital in a state she has never visited.

Two possibilities, and they lead to different remedies.

If it is a mixed file — the debt belongs to another Ana with a similar Social Security number or a shared former address — the remedy is a dispute, and the crucial extra step is to attack the matching, not just the tradeline. Deleting the entry resolves this month; the matching logic will re-merge the file next quarter unless the agency corrects the underlying identifiers. Her dispute should say so explicitly and should identify the personal-information errors — the address she never lived at, the middle initial that is not hers — that are causing the merge.

If it is identity theft — someone used her identity to obtain treatment — she should file an identity theft report and demand a block under 15 U.S.C. § 1681c-2 rather than a mere dispute. A block is near-automatic on proper documentation and must occur within four business days; a dispute can end with "verified."

And she should demand the underlying records from the hospital, which the statute entitles her to: the application and transaction records made in her name. Medical identity theft is uniquely dangerous because the thief's medical information may have been merged into her chart, which is a health and safety problem as well as a credit problem.

Her damages are already documented: the mortgage rate quote. Keep it. That is dissemination and concrete harm, which after TransUnion is the case.

Deshawn, denied an apartment because of a criminal record that is not his

The tenant screening company reported a felony conviction belonging to a different person with the same common name and a different middle name.

Tenant screening companies are consumer reporting agencies. The full accuracy and reinvestigation apparatus applies to them, and the "maximum possible accuracy" standard of 15 U.S.C. § 1681e has been applied with particular force to criminal record matching, because the consequences are severe and the matching is often done on name alone.

What Deshawn does:

Demand the adverse action notice from the landlord identifying the screening company — landlords frequently skip this and it is itself a violation.
Obtain the file from the screening company.
Dispute in writing, attaching his identifiers and pointing out the mismatch — different middle name, different date of birth, a conviction in a county he can prove he did not live in.
Demand that corrected reports be sent to every landlord who received it in the last six months.
Document the lost apartment, the deposit forfeited, the temporary housing, the time.

Why this case is strong: the harm is concrete and immediate, the error is objectively verifiable, and matching a felony to a person on name alone is the paradigm of an unreasonable procedure.

Priya, whose ex-husband opened three credit cards in her name

This is identity theft, but the familiar kind — committed by someone with access to her documents, her mail, and her Social Security number.

The legal analysis is the same as for a stranger. It does not matter that she knew the perpetrator. She is entitled to the identity theft report, the block, the freeze, and the transaction records.

The practical difficulties are different, and worth naming. Creditors and police sometimes treat familial identity theft as a "civil matter" or a "family dispute" and decline to act. Some jurisdictions require a police report that police are reluctant to write. The federal identity theft report exists precisely to give consumers a usable document, and the block remedy runs on that report.

Three additional steps for Priya:

Freeze immediately, because a person with her information will use it again.
Change every account credential and security question, since the answers to "mother's maiden name" and "first pet" are known to an ex-spouse.
Raise it in the divorce or protective order proceeding if one is pending; financial abuse is recognized as a form of domestic abuse in many states, and a court order can help. See Domestic Violence and Protective Orders.

A hard note: she may be asked to state, in writing, that the accounts were opened without her authorization by a named person, and that statement can have consequences for that person. That is her decision to make, deliberately, and it is a reason to talk to a lawyer rather than to guess.

Marcus, whose deleted collection account keeps coming back

Marcus disputed a collection account three times. Each time it was deleted. Each time it reappeared a few months later.

This is the reinsertion rule, and its violation is unusually clean. Once an item is deleted following a reinvestigation, it may not be reinserted unless the furnisher certifies that it is complete and accurate, and the agency must give the consumer written notice within five business days of reinsertion.

So Marcus should ask, in writing: was this item reinserted following deletion? If so, produce the furnisher's certification and the notice you were required to send me. If the answer is that no notice was sent, that is a discrete violation with a documented history.

And the repetition matters for a second reason. Willfulness under 15 U.S.C. § 1681n includes reckless disregard, and an agency that deletes and reinserts the same disputed item three times, without certification or notice, is describing its own recklessness. That converts a case worth actual damages into one worth statutory and possibly punitive damages, plus fees.

Marcus's job is documentary: keep every dispute, every result letter, every report showing the item present and absent, in date order. The pattern is the case.

Part X: What the dispute letter should actually contain

Most disputes fail because they are too short and too vague. A dispute that says "this account is not mine, please remove" invites a thirty-second electronic verification and a "verified" response.

A dispute that works has six parts:

Identification. Full name, current and prior addresses for two years, date of birth, Social Security number, and a copy of a government identification and a utility bill. Agencies reject disputes for insufficient identification more often than for any other reason.
The item, precisely identified. Creditor name as it appears, account number as it appears, the specific field disputed, and the page of the report.
What is wrong, in one sentence. Not a narrative. "This account was never opened by me." "The date of first delinquency is reported as 3/2021; it was 3/2018." "This balance was discharged in bankruptcy on 11/2019."
What the correct information is.
The evidence. This is the part that determines whether the investigation can lawfully be perfunctory. A furnisher that receives contradicting documents and responds "verified" without examining them has not conducted a reasonable investigation — but only if the documents were forwarded, which is why they must be attached to the dispute to the bureau.
The requests. Deletion or correction; a free copy of the revised report; and — the one everyone forgets — that corrected reports be sent to everyone who received the report in the past six months, and two years for employment purposes.

Send it so you can prove you sent it. Certified mail with return receipt, or the online portal with a screenshot and a confirmation number. Online disputes are faster; paper disputes create a cleaner record and allow attachments that portals sometimes truncate. Many consumer lawyers use both.

Keep a dispute log: date sent, method, item, evidence attached, date of response, outcome, and the date the item next appeared. That log is the exhibit in any later case.

Part XI: What to actually do, in order

Get all three reports. They differ. An error on one may not be on the others.
Read every line, including the personal information section — a wrong address is often the first sign of a mixed file or identity theft.
Freeze all three if identity theft is suspected. Free, fast, reversible.
File an identity theft report if the accounts are not yours. It is the key to the block remedy.
Dispute through the bureaus, in writing, with documents attached. Keep proof of mailing.
Request a block, not just a dispute, for identity theft items.
Demand the transaction records from businesses where fraudulent accounts were opened.
Ask for corrected reports to be sent to everyone who pulled in the last six months.
Track dissemination and denials — this is your standing and your damages.
If it is not fixed, see a consumer lawyer. Fee-shifting means these cases are frequently taken on contingency.

Part XII: The other reports you have

"Credit report" usually means the three nationwide bureaus, but the Act reaches far more than that. A consumer report is any communication by a consumer reporting agency bearing on creditworthiness, character, general reputation, personal characteristics, or mode of living, used or expected to be used for credit, insurance, employment, or another authorized purpose.

That definition sweeps in a whole ecosystem of specialty agencies most people have never heard of, each maintaining a file on them:

Tenant screening — rental history, eviction filings (including cases that were dismissed or decided in the tenant's favor), and criminal records. See Handling a Landlord-Tenant Dispute.
Employment screening — criminal records, education and employment verification, sometimes driving records.
Check and bank account screening — account closures and returned items, which can prevent someone from opening a checking account anywhere.
Insurance claims history — property and auto claims, used in underwriting.
Medical information exchanges — used in individual life and disability underwriting.
Utility and telecom histories.
Gig and rideshare platform screening.
Payday and subprime lending databases.

Every one of them is subject to the same regime: you are entitled to your file, you may dispute, they must reinvestigate, and they must follow reasonable procedures to assure maximum possible accuracy.

Why this matters practically. Someone denied an apartment, a bank account, or a job because of an inaccurate specialty report often never learns which company produced it — because the adverse action notice was not given, or was given and ignored. The adverse action notice names the agency. Demand it, then get the file, then dispute.

The eviction-record problem deserves a specific mention. Tenant screening reports routinely include eviction filings without the outcome, so a case that was dismissed, settled, or won by the tenant appears as an eviction. Reporting a filing without its disposition is a strong candidate for a "materially misleading" accuracy claim, and several states have enacted sealing statutes aimed at exactly this. Check both.

Part XIII: Credit repair companies, and the law that governs them

The gap between what the statute provides and what consumers know about it created an industry, and Congress legislated about it directly in the Credit Repair Organizations Act.

What that law requires: a written contract with specified disclosures, a three-day right to cancel, and — most importantly — no advance fees. A credit repair organization may not charge before fully performing the services it promised.

What credit repair companies actually do: send dispute letters. That is the service. It is a service you can perform yourself, for the cost of postage, using the templates in this corpus.

What they cannot do, despite the marketing: remove accurate, timely, verifiable negative information. Nothing legally removes a true and current entry before its reporting period expires. Claims to the contrary are either false or describe a tactic — flooding the bureaus with disputes so an overwhelmed furnisher fails to verify — that produces temporary deletions, later reinsertions, and, in some framings, a false statement to a consumer reporting agency.

The red flags are the familiar ones: advance fees; a promise to "remove all negatives"; advice to dispute accurate information; a suggestion to create a "new credit identity" using an employer identification number in place of a Social Security number, which is a federal crime; and instructions not to contact the bureaus directly.

The legitimate alternatives: nonprofit credit counseling agencies, legal aid, and consumer lawyers who take these cases on contingency because of the fee-shifting provisions in 15 U.S.C. § 1681n and 15 U.S.C. § 1681o. If a report is wrong and it has cost you something, a consumer lawyer will often take the case for nothing up front — which is a far better deal than a monthly fee for letters you could write yourself.

Part XIV: Prevention, honestly assessed

Most advice about protecting yourself from identity theft is either useless or actively counterproductive, so it is worth separating what works from what is theater.

What works, in descending order of value:

1. A security freeze at all three nationwide bureaus. Free, reversible in an hour, and it forecloses the single most damaging category of identity theft — new accounts opened in your name. This is not one option among many; it is the option. Freeze the specialty agencies too where they permit it, and freeze children's files where state or federal law provides for it, because child identity theft is discovered on average about a decade after it starts.

2. Multi-factor authentication on email first, then financial accounts. Email is the master key: whoever controls it can reset everything else. Use an authenticator application or a hardware key rather than text messages, because a SIM-swap defeats text-based codes.

3. Unique passwords, stored in a password manager. The dominant cause of account takeover is not sophisticated attack; it is password reuse across a breached site and a bank.

4. Reading your statements and your reports. You are the only person positioned to notice a charge you did not make or an account you did not open.

What is worth less than it is sold for:

Credit monitoring tells you after the fact. A freeze prevents it. Monitoring is a reasonable supplement and a poor substitute, and the free monitoring offered after a breach is fine to accept and no reason to relax.

Identity theft insurance typically reimburses costs of restoration rather than losses, and the losses in most identity theft are absorbed by the creditor rather than the consumer anyway.

Shredding is genuinely useful for a small and shrinking share of the problem. The data is mostly stolen in bulk from institutions, not from your recycling.

What actually causes most consumer identity theft: institutional breaches you cannot control, phishing that harvests credentials, and — a substantial and under-discussed share — people known to the victim. Which is why the freeze matters more than the shredder.

And the single most useful habit: when a call, text, or email asks you to confirm information or take urgent action about an account, hang up and call the number on the back of your card or on your statement. Every large-scale social engineering scheme depends on the target staying in the channel the attacker chose.

Part XV: Building a case worth bringing

Not every error is a case, and a lawyer's first question is not "what did they do wrong?" but "what did it cost you, and who saw it?" After TransUnion, that framing is not cynicism; it is the doctrine.

The five elements of a strong file:

1. The error, documented over time. Reports from all three bureaus, pulled at intervals, showing the item present, disputed, deleted, and — if it happened — reinserted.

2. The disputes, with proof of delivery and proof of content. What you sent, when, what you attached, and what came back. The attached evidence matters twice: once because it should have changed the outcome, and again because it defines what a reasonable investigation would have had to consider.

3. Dissemination. Who pulled the report. The inquiry section lists them, and the agency must, on request, tell you who received the report in the past six months — two years for employment. Request that list. It is the difference between a procedural violation and a concrete injury.

4. Harm, in specifics. A denial letter. A rate quote before and after. A rescinded job offer. A lost apartment and the cost of the alternative. A larger deposit demanded by a utility. Emotional distress is compensable but is far stronger when anchored to a concrete event — and the contemporaneous note or text message describing the day you learned is worth more than a recollection years later.

5. Willfulness evidence, if it exists. Repetition after notice. Reinsertion without certification or notice. A "verified" response to a dispute accompanied by documents that plainly contradicted the tradeline. Under Safeco, reckless disregard suffices, and reckless disregard is usually proven by a pattern rather than a statement.

Why the fee provisions change everything. A consumer whose damages are a few thousand dollars cannot economically hire counsel — which is exactly why 15 U.S.C. § 1681n and 15 U.S.C. § 1681o shift fees to a prevailing consumer. Consumer lawyers take these cases on contingency, and the practical advice is simple: if a report is wrong, you disputed properly, it was not fixed, and it cost you something, talk to one. The consultation is usually free and the assessment takes twenty minutes.

One caution about arbitration. Many furnisher relationships — credit card agreements, loan contracts — contain arbitration clauses that may reach claims against the furnisher. Claims against the bureaus generally are not covered, because you have no contract with them. That asymmetry sometimes shapes who gets sued.

Frequently asked questions

Should I dispute with the creditor or the credit bureau? The bureau. A direct dispute to the furnisher generally does not preserve a private right of action.

How long do they have? Generally 30 days for a reinvestigation; four business days for a block based on an identity theft report.

Is a freeze better than a fraud alert? Yes. A freeze blocks access; an alert only requires extra verification. Both are free.

What if the same error keeps coming back? Reinsertion requires furnisher certification and written notice to you. Its absence is a separate violation — and repetition is evidence of willfulness.

Can I sue over an error that nobody saw? After TransUnion, probably not. Dissemination and concrete harm are the case.

What is the strongest remedy? The block for identity theft information. It is nearly automatic on proper documentation, and almost nobody uses it.