What Furnishers Must Do When You Report Identity Theft

The credit bureaus get most of the attention, but the company that reported the fraudulent account has its own obligations. Those duties are in section 623 of the Fair Credit Reporting Act, 15 U.S.C. § 1681s-2, and the difference between its two subsections decides whether you can do anything about a breach of them.

Who a Furnisher Is

A furnisher is any company that reports information about you to a consumer reporting agency: a bank, a card issuer, a lender, a utility, a debt collector that reports accounts.

In an identity theft case the furnisher is the company that accepted the thief's application. That matters for a practical reason: it holds the application, and the application is the evidence.

What the Law Requires

When a furnisher learns that information it reported is the product of identity theft, it generally must:

Stop reporting the fraudulent information. Once you have supplied an identity theft report and the identifying details, it may not keep furnishing information it has been told resulted from identity theft.
Investigate. After a bureau forwards your dispute, the furnisher must conduct a reasonable investigation of its own records and of the documentation you provided.
Report the results. If the information turns out to be fraudulent or inaccurate, it must notify the bureaus to correct or delete it, across every bureau it reported to.

The Part Most Articles Get Wrong

Your private right to sue a furnisher arises under section 1681s-2(b), and it is triggered only after a credit bureau forwards your dispute to the furnisher.

The consequence is concrete and it decides cases. If you write only to the creditor, you have given it notice, and you have created a useful record, but you have not triggered the duty you can personally enforce. The bureau dispute is what does that.

So the sequence is not optional: dispute through the bureau first, or in addition. Send the furnisher a copy if you like, but the bureau route is the one that creates the enforceable obligation.

What a Reasonable Investigation Means

The statute says investigate, and courts have held that the word carries weight. A furnisher that compares the incoming dispute against its own database, confirms its data matches what it already reported, and answers verified has not investigated. It has checked that it is consistent with itself.

In practice much of this is automated. The bureau converts your dispute into a code, the furnisher's system compares fields, and a response goes back in seconds. No person reads your letter and nobody looks at the documents you attached.

That gap, between what a reasonable investigation would require and what the automated process actually does, is the substance of most furnisher claims.

The Documentation That Triggers the Duties

An identity theft report, such as an FTC report from IdentityTheft.gov or a police report
Proof of your identity
Specific identification of the fraudulent information, by account number and furnisher name as they appear on your report

What to Do

File the identity theft report first, before contacting anyone
Dispute through each credit bureau where the item appears, in writing, with the report and your documentation attached
Send the furnisher a copy directly as well, which creates a second dated record that it knew
Be specific about what is wrong and why, and attach the evidence. The more detailed your dispute, the harder it is to defend an automated verification as reasonable
Keep copies of everything, with dates, and keep the certified mail receipts
Pull your reports afterward and confirm what actually changed

When a Furnisher Keeps Reporting

A furnisher that responds verified to a documented identity theft dispute, or that keeps sending the same account in its next monthly data file after being notified of a block, has a problem under section 1681s-2(b).

What makes it provable is unexciting: the dispute you sent, proof it was delivered, the response that came back, and dated reports from before and after showing the item never moved.

The Two Subsections, and Why the Distinction Decides Cases

This is the part of the statute most worth understanding, because getting it wrong means doing a lot of correct work that produces no enforceable right.

Section 1681s-2(a) contains the broad accuracy duties. Do not furnish information you know is inaccurate. Correct it when you learn it is wrong. Stop reporting information a consumer has identified as the product of identity theft. These read like the most important duties in the section, and they are enforced by the FTC, the CFPB, and state regulators. A consumer cannot sue over them.

Section 1681s-2(b) contains the duty that arises after a credit bureau forwards a consumer dispute. Investigate. Review what the bureau sent. Report the results. Correct across all bureaus. That one a consumer can enforce.

So the entire question is whether a bureau dispute happened. A victim who writes directly to the creditor, encloses the identity theft report, keeps the receipts, and is ignored has strong facts and no private claim. The same victim who also disputed through the bureau has both.

Write to the creditor by all means. The direct letter is good evidence that it knew. Just never let it be the only thing you did.

What the Furnisher Holds That You Want

There is a second reason the furnisher matters in an identity theft case, separate from its reporting duties.

It has the application. Whoever opened the account submitted something: an address, a phone number, an email, an employer, possibly a signature, possibly an uploaded ID. Section 1681g(e) entitles you to those records, free, within 30 days of a qualifying request.

That document does two jobs. It shows how much of your information was actually compromised, which tells you what else to protect. And it shows what the business accepted, which is a fact about the business rather than about the thief. An application approved on a name and a Social Security number, with an address you have never lived at, says something that no dispute letter can manufacture.

Common Questions

What is a furnisher under the FCRA?

Any company that reports information about you to a consumer reporting agency: banks, card issuers, lenders, utilities, and debt collectors that report accounts.

When can I sue a furnisher?

Under § 1681s-2(b), after a credit bureau has forwarded your dispute and the furnisher has failed to conduct a reasonable investigation or has continued reporting information it should have corrected.

Does writing directly to the creditor trigger that duty?

No. Only the bureau dispute does. Write to the creditor as well, for the record, but the bureau route is what creates the enforceable obligation.

What if the furnisher keeps reporting after a block?

A furnisher notified that information was blocked as the product of identity theft may not refurnish it. An item that reappears on your report after a block is the clearest version of this failure, and dated reports from before and after are what prove it.

How long does the furnisher have?

Its response runs inside the bureau's reinvestigation period, which is generally 30 days from when the bureau received your dispute, or 45 if you added information during that period.

Can I get the application the thief submitted?

The furnisher says its records show the account is mine. Now what?

That is the response to expect, and it is not the end. Ask for the application under § 1681g(e) and compare what the business accepted against your actual information. A furnisher whose own file contains an address you have never lived at, and which verified the account anyway, has described its own investigation.

Does a furnisher have to correct the error at every bureau?

Yes. If the information turns out to be inaccurate or incomplete, the furnisher must report the correction to every consumer reporting agency it furnished the data to, not only the one that forwarded your dispute.