Identity Theft

Identity theft is the misuse of another person's identifying information for financial gain, whether that means opening a credit card, taking out a loan, filing a tax return, obtaining medical care or claiming a benefit. What matters practically is less the definition than the machinery federal law attaches to it, because the Fair Credit Reporting Act gives victims tools that ordinary dispute rights do not include.

Most of those tools are keyed to an identity theft report, and the statute defines the term rather than leaving it to the bureaus. Under 15 USC 1681a(q)(4) it means, at a minimum, a report that alleges an identity theft, that is a copy of an official valid report filed with an appropriate federal, state or local law enforcement agency, including the United States Postal Inspection Service, and the filing of which "subjects the person filing the report to criminal penalties relating to the filing of false information". That last condition is why the document carries weight: it is a statement made under threat of penalty rather than an assertion in a letter.

Two related terms are worth separating from this one. A fraud alert is a flag on your file that makes lenders verify identity; a credit freeze removes your report from circulation altogether. They solve different problems and can be used together.

The block is the strongest remedy in the statute, and it works faster than an ordinary dispute. Under 15 USC 1681c-2(a), a credit bureau must block the reporting of information a consumer identifies as resulting from an alleged identity theft "not later than 4 business days" after it receives four things: appropriate proof of the consumer's identity, a copy of an identity theft report, the consumer's identification of the information, and a statement that the information does not relate to any transaction by the consumer. Subsection (b) then requires the bureau to notify the furnisher promptly that the information may result from identity theft, that a report has been filed, that a block has been requested, and of the block's effective dates.

A block and a dispute are different mechanisms with different standards. A dispute asks the bureau to reinvestigate accuracy; a block removes the information on the strength of the report and the statement. Under (c)(1) a bureau may decline or rescind a block only on three stated grounds: that it was made in error, that it rested on a material misrepresentation of fact by the consumer, or that the consumer obtained goods, services or money from the transaction. If a block is declined or rescinded the consumer must be notified promptly.

Three alerts exist, with different triggers and different durations. 15 USC 1681c-1 provides for each of them:

An initial fraud alert requires nothing but a good-faith suspicion, and it lasts "not less than 1 year" (subsection (a)). The ninety-day figure still in wide circulation is the superseded text: the 2018 amendments substituted "1 year" for "90 days", in the same act that created the free nationwide freeze. Any guidance still saying ninety days predates both. The bureau must also refer the alert to the other nationwide bureaus, so one request covers all three, and must give you a free file disclosure.

An extended fraud alert requires an identity theft report, and it runs for 7 years (subsection (b)). It additionally excludes you from prescreened credit and insurance offer lists for 5 years and entitles you to two free file copies in the following twelve months.

An active duty alert is for a deployed service member, lasts "not less than 12 months", and excludes you from prescreened lists for 2 years (subsection (c)).

An alert imposes a duty on the lender, which is what makes it more than a note. Under 1681c-1(h)(1), an initial or active duty alert notifies every prospective user of the report that the consumer does not authorize a new credit plan, an additional card on an existing account, or a credit limit increase, and no prospective user may do any of those things "unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request." There is a sharper version of that duty available on request: if the consumer specifies a telephone number for identity verification when placing the alert, a user must contact the consumer on that number before authorizing new credit (1681c-1(h)(1)(B)(ii)).

The statutory front door is IdentityTheft.gov. 15 USC 1681c-1(i)(6)(B) requires the Federal Trade Commission to establish a single webpage, within identitytheft.gov or a successor site, linking to each bureau's own page for requesting a freeze, the three alerts, and the prescreen opt-out. So the site is the mechanism Congress designated rather than a convenience someone built.

You discover accounts, inquiries or balances that are not yours. You report the theft, which produces the identity theft report the rest of the process depends on, place an alert or a freeze, and then send each bureau the four items the block requires. You also dispute directly with the businesses that opened the fraudulent accounts, because the bureau's block addresses the report rather than the underlying account.

A hypothetical example, and the four-business-day clock is the part worth knowing. Malik finds a credit card he never opened. He files a report with law enforcement, then sends one bureau a package containing proof of his identity, a copy of that report, a clear identification of the fraudulent tradeline, and a signed statement that the account is not his. The bureau receives it on a Monday. The block is due by that Friday, four business days later, and the bureau also has to notify the card issuer that the item is alleged to be fraudulent and has been blocked.

What that does and does not accomplish is worth being precise about. The tradeline stops being reported, which repairs the credit consequence. It does not by itself resolve the account with the issuer, and it does not stop the same information reappearing at another bureau, so the package goes to each of them.

Pros

• The block is a genuinely strong remedy: four business days, notification of the furnisher, and only three grounds on which a bureau may refuse or reverse it.
• An extended alert lasts seven years and takes you off prescreened offer lists for five, so it keeps working long after the incident.
• An alert placed with one nationwide bureau must be referred to the others, so one request covers all three.
• An alert imposes an affirmative verification duty on prospective lenders rather than merely informing them.
• The FTC's statutory hub collects the request pages in one place, and none of these tools costs anything.

Cons

• The strong remedies are conditioned on an identity theft report, which means involving law enforcement and making a statement under penalty.
• A block addresses what is reported about you, not the account itself, so the furnisher still has to be dealt with separately.
• Blocks and disputes are per bureau, which multiplies the paperwork.
• A bureau may rescind a block if it concludes the consumer obtained value from the transaction, so a disputed family situation can unwind the relief.
• None of it addresses tax, medical or benefit identity theft, each of which has its own separate process.