What this answers
On this page
An identity theft report is the document that converts you from a person with a complaint into a person with statutory rights. Most of the strongest remedies in the Fair Credit Reporting Act are gated behind it. Here is how to get one and what it unlocks.
What an Identity Theft Report Is
It is a formal report of the fraud, filed with a government agency, that you can hand to bureaus and creditors as proof you are a victim.
That proof is the point. Without it, you can dispute items the ordinary way and wait on an investigation. With it, you can demand that fraudulent information be blocked outright, that an extended alert be placed, and that businesses hand over the records of accounts the thief opened in your name. The difference in leverage is substantial, and it costs nothing but the time to file.
How to Get One
The FTC Report
The practical route is the Federal Trade Commission's IdentityTheft.gov. It walks you through describing what happened and produces both an identity theft report and a personalized recovery plan. It is free, and it generally takes fifteen to twenty minutes.
Be thorough while you are in it. The report is most useful when it names every fraudulent account you know about, because an account you leave out is an account you will have to come back and add later, usually at the exact moment you are trying to prove something.
A Police Report
A police report about the identity theft can also serve. Some creditors prefer it, though a qualifying FTC report has to be accepted.
Getting one can be harder than it sounds. Departments are sometimes reluctant to take a report when the fraud happened elsewhere, or when nothing was stolen in their jurisdiction. If you are turned away, the FTC report is the route to use, and nothing in the law requires you to produce both.
What It Unlocks
The block. Under 15 U.S.C. § 1681c-2, a bureau that receives a complete block request generally must block the identified fraudulent information within four business days. This is the fastest remedy available, and it does not wait on the furnisher agreeing with you.
An extended fraud alert. An extended alert lasts seven years, and it requires creditors to take reasonable steps to verify identity before extending credit in your name. An initial alert, which needs no identity theft report, lasts one year.
Additional free reports. Placing an extended alert entitles you to additional free file disclosures beyond the standard ones.
The thief's records. This is the right most victims have never heard of. Under § 1681g(e), a business that opened an account or processed a transaction in your name must give you the application and transaction records, free, once you make a proper request with an identity theft report and proof of identity. You get to see what the thief submitted: the address, the phone number, the signature, the documents the company accepted.
Leverage against collectors. A collector pursuing a debt you have reported as fraud, with documentation in hand, is in a different position than one chasing a debt you simply dispute.
How to Use It
- File at IdentityTheft.gov as soon as you discover the fraud, before you start contacting companies
- Include every fraudulent account and transaction you are aware of
- Keep the report and the confirmation number where you can find them
- Reference it in every letter to a bureau, a furnisher, or a collector, and enclose a copy
- Update it if more fraud surfaces later, rather than filing a second unrelated report
- Send everything by certified mail with return receipt, and keep the receipts
What to Watch For Afterward
Filing the report is the beginning. The failures come next, and they are predictable.
Blocked items get reinserted when the furnisher keeps sending the same monthly data file. Collectors keep calling about an account the bureau has already blocked. A business ignores a § 1681g(e) records request, or answers it with a form letter that provides nothing. A bureau treats a complete block request as an ordinary dispute, sends it out for verification, and leaves the item in place.
Each of those is a failure of a specific duty, and each one is provable only if you kept the paperwork. Pull your reports again a month after the block and confirm the items are still gone. The work of being a victim does not end when the forms are filed, which is unfair, and it is also how these cases get won.
What to Put in the Report
The report is only as useful as what you put in it, and most people fill it out once, in the worst week, and never revisit it.
Be specific about accounts. Every fraudulent account you know of, named with the creditor and the account number from your credit report. An account omitted here is one you will have to add later, usually mid dispute.
Be specific about dates. When you discovered the fraud, when you believe it began, and how you found out. The discovery date matters because it frames everything that happens afterward.
Be specific about what was used. Social Security number, driver's licence, card number, address. This also helps you work out what else is exposed and therefore what else to check.
Be honest about what you do not know. A report that says you do not know how the information was obtained is fine. A report that guesses is a report with a weak point in it.
Using It Without Weakening It
One discipline matters more than any other: the report is a sworn account of what happened, and everything you do later is measured against it.
If the report lists four fraudulent accounts and your block request lists six, the bureau has a question. If the report says the fraud started in March and a dispute refers to an account opened the previous year, that is another. None of these are fatal and all of them are avoidable by updating the report when you learn more, rather than letting the documents drift apart.
Update it rather than filing a second unrelated report. One accurate report that has been kept current is stronger than two that disagree.
Common Questions
How do I get an identity theft report?
File at IdentityTheft.gov, the FTC's site. It is free, takes fifteen to twenty minutes, and produces both the report and a recovery plan. A police report about the identity theft also qualifies.
Is an FTC report as good as a police report?
For FCRA purposes, yes. A qualifying FTC identity theft report has to be accepted by bureaus and furnishers. Some creditors express a preference for a police report, but preference is not a legal requirement.
What does an identity theft report let me do?
It unlocks the four business day block under 15 U.S.C. § 1681c-2, the seven year extended fraud alert, additional free file disclosures, and the right under § 1681g(e) to the application and transaction records of accounts the thief opened in your name.
Do I need a separate report for each fraudulent account?
No. One report covers the incident. List every account you know about in it, and update it if more surface.
How long is an identity theft report good for?
There is no expiry written into it, but a report that is years old and does not match your current claim invites questions. Keep it current.
Can I file if I only suspect fraud but have not confirmed it?
An identity theft report should describe fraud that occurred. If you only suspect something, place an initial fraud alert, which requires no documentation, and freeze your files while you find out.