What this answers
On this page
Most identity theft victims never learn about this one. You have a right to obtain the actual application and transaction records the thief created in your name, free, from the business that accepted them. It comes from section 609(e) of the Fair Credit Reporting Act, 15 U.S.C. § 1681g(e).
Why These Records Matter
Everything else in identity theft recovery is about removing information. This is the only right that gets you information.
The application the thief submitted is a document about the thief. It carries the address they used, the phone number, the email, the employer they claimed, sometimes a signature, and whatever identification the business accepted. That tells you how much of your information was actually compromised, which is how you know whether to expect more fraud.
It also tells you something about the business. An application approved on the strength of a name and a Social Security number, with an address that has never been yours, is a document about how that account came to be opened.
What You Can Request
- The application the thief used to open the account
- Transaction records: purchases, payments, and activity on the account
- Related account documentation, including statements and correspondence
How to Make the Request
Send it in writing to the business that opened the account or processed the transaction, not to the credit bureau. The bureau does not have these records.
Include:
- A clear statement that you are requesting application and business transaction records under section 609(e) for an account opened through identity theft
- Proof of your identity, typically a government issued ID and proof of address
- Proof of the claim, meaning an identity theft report such as an FTC report from IdentityTheft.gov, or a police report
- Enough account information for the business to find the account: the account number as it appears on your credit report, approximate dates, and the amount
Send it certified mail with return receipt and keep the receipt. The deadline runs from when the business receives a request that meets the requirements, so proof of delivery is what starts the clock.
What the Business Owes You
The records must be provided within 30 days of receiving a qualifying request, and they must be provided free of charge.
You can also direct the business to send the records to a law enforcement agency you name instead of to you, which is useful when there is an active investigation.
The Exceptions
A business may decline where:
- It has a good faith belief the request itself is fraudulent
- The records contain another person's information in a way that raises a safety concern
- Disclosure would violate another legal restriction
The Limit Worth Knowing Up Front
Section 609(e) does not create a private right of action. You generally cannot sue a business for ignoring the request, which is a real gap and the reason this right is underused.
What you can do is complain to the FTC and the CFPB, which enforce it. And a refusal is still useful to you: a business that will not produce the application it approved has created a document trail about its own conduct, and that can matter in a dispute with the same company over what it reported about you.
The records themselves are frequently the most valuable thing in the file. An application showing an address you have never lived at, accepted anyway, is evidence about the account that no dispute letter can manufacture.
How to Work Through It
- List every business where the thief opened an account, from your credit reports at all three bureaus
- File the identity theft report first, since the request requires it
- Send a separate written request to each business, with all the required documentation
- Calendar 30 days from each delivery date, and follow up in writing when one passes
- Read what arrives. The address, phone number, and email on the application are what tell you how exposed you are
- Keep everything, including the refusals
If the records show a business opened an account on obviously mismatched information, or if the same company is still reporting that account after being told it was fraud, those are separate problems from the theft itself, and they have their own remedies.
What the Application Usually Reveals
It is worth knowing what you are likely to find, because it changes what you do next.
The address is the most useful field. If the thief used their own, you now know where the goods went, which is information law enforcement can use and which also explains why that address is now attached to your credit file.
The contact details tell you how much of your identity was reconstructed rather than stolen outright. An application with your Social Security number and an unfamiliar email and phone suggests partial information. One with your real phone number suggests a different and more uncomfortable scenario, often someone who knows you.
The identification accepted tells you about the business. An account opened with no verification beyond a name and a number, at an address with no connection to you, says something about the procedures that approved it.
Making the Request Land
The request fails for ordinary reasons more often than it is refused on the merits.
Send it to the right place. This goes to the business that opened the account, not to the credit bureau, and ideally to a fraud or legal department rather than general customer service, which will frequently not recognise the request.
Cite the section. Saying you are requesting application and business transaction records under section 609(e) of the FCRA, 15 U.S.C. § 1681g(e), tells whoever opens it that this is a statutory request with a deadline rather than a complaint.
Include everything required: proof of identity, your identity theft report, and enough account information to locate the account.
Diary 30 days from the delivery date on the return receipt, and follow up in writing when it passes.
Common Questions
Can I get the records of an account a thief opened in my name?
How long does the business have?
30 days from receiving a request that meets the requirements, which is why proof of delivery matters.
What do I have to send with the request?
Proof of your identity, proof of your claim such as an identity theft report or police report, and enough account information for the business to locate the account.
Can the business refuse?
Only in narrow circumstances: a good faith belief that the request is fraudulent, records containing another person's information that raises a safety concern, or another legal restriction on disclosure.
Can I sue if they ignore me?
Section 609(e) does not create a private right of action, which is a real gap. You can complain to the FTC and the CFPB, which enforce it, and the refusal itself remains a useful document.
Why bother if I cannot enforce it?
Because the records are often the best evidence in the file. An application the business approved on obviously mismatched information is a fact about that business, and it is relevant to a dispute about what it reported.
Can I ask a credit bureau for these records instead?
No. The bureau never saw the application; it only received the furnisher's monthly data. The records sit with the business that opened the account, which is why the request goes there.
What if the account was opened in person?
Ask for whatever the business captured at the counter, including any identification it copied and any signature it took. An in person account opened on a mismatched identification document is among the more telling records you can obtain.