How to Use 15 USC 1681c-2 to Block Identity Theft

Under 15 U.S.C. 1681c-2, a credit bureau must block fraudulent information from your credit file within four business days once you send it the required documentation. The block is faster and more decisive than a regular dispute: the bureau does not investigate first, and while the block is in effect the item cannot appear on your report or affect your score. The statute also forces the bureau to tell the company that reported the fraudulent data, which triggers separate obligations on that company’s end.1Office of the Law Revision Counsel. 15 USC 1681c-2 Block of Information Resulting From Identity Theft

The Four Items You Must Submit

A general dispute letter will not trigger the block. The statute requires four specific pieces, and if any one is missing the bureau has no obligation to act.

  • Proof of identity. A government-issued ID and proof of your current address, such as a utility bill or bank statement.
  • An identity theft report. A formal report filed with a law enforcement agency or the FTC. It must describe the fraudulent activity, and filing a false report carries criminal penalties.
  • Identification of the fraudulent information. Point to the specific accounts, inquiries, or tradelines on your credit file that resulted from the theft.
  • A statement of non-authorization. A declaration that the disputed information does not relate to any transaction you actually made.

The identity theft report is where most people stall. Federal regulations accept reports filed with local police, the FBI, the U.S. Postal Inspection Service, or the FTC. IdentityTheft.gov generates a report that satisfies the statute and produces a personalized recovery plan at the same time. Filing there first and then taking that report to local police is often the fastest path, since the FTC report can serve as the foundation for the police report.2Consumer Financial Protection Bureau. Regulation V – 12 CFR 1022.3 – Definitions

What the Bureau Must Do After You Submit

Two obligations kick in once all four items arrive. The bureau must block the identified information within four business days, and while blocked the item cannot appear on your credit report or feed into your score. That is the whole point of the mechanism: no 30-day investigation window, no back-and-forth about whether the debt is really yours.1Office of the Law Revision Counsel. 15 USC 1681c-2 Block of Information Resulting From Identity Theft

The bureau must also promptly notify the company that furnished the fraudulent data. That notice has to include the fact that an identity theft report was filed, that a block has been requested, and the dates the block is effective.

When the Bureau Can Rescind a Block

The block is not always permanent. A bureau may decline to place one, or lift one it already placed, on three grounds:

  • Error. The information was blocked by mistake, or you requested the block in error.
  • Material misrepresentation. You made a materially false statement in your request. This is the statute’s safeguard against consumers using the block process to erase legitimate debts.
  • You benefited from the transaction. If you actually received the goods, services, or money from the transaction you claimed was fraudulent, the block can come off.

Those are the only grounds. A furnisher’s insistence that the debt is valid, or a creditor’s complaint, is not one of them.

If a bureau does rescind, it must notify you in writing within five business days. That notice has to state that the blocked information has been reinserted, identify the furnisher by name, address, and phone number, and remind you that you can add a statement to your file disputing the information.3Office of the Law Revision Counsel. 15 USC 1681i Procedure in Case of Disputed Accuracy

What the Furnisher Must Do

The company that reported the fraudulent account has its own obligations once notified. It may not continue reporting information you have identified as resulting from identity theft, unless it later learns or you tell it that the information is actually correct. If the furnisher discovers it reported inaccurate data because of identity theft, it must notify every credit bureau of the correct information and stop reporting the fraudulent data.4Federal Trade Commission. Notice to Furnishers of Information – Obligations of Furnishers Under the FCRA

In practice, this is where cases fall apart. Furnishers must maintain reasonable procedures to prevent re-reporting, but automated systems sometimes push the same fraudulent data back to the bureaus in the next reporting cycle, and the blocked item resurfaces. If that happens, contact both the bureau and the furnisher directly, referencing your original identity theft report and the block. A furnisher that keeps re-reporting after being told the data is fraudulent can face liability for willful noncompliance.

How This Differs From a Dispute, Freeze, or Fraud Alert

The identity theft block under 1681c-2 is often confused with the general dispute process under 15 U.S.C. 1681i. They are not the same tool.

  • Speed. A standard dispute gives the bureau 30 days to investigate. An identity theft block must take effect within four business days.
  • Burden. In a standard dispute, the bureau investigates and decides whether the information is accurate. With a block, you supply the identity theft report and the block goes into effect; the burden shifts to the bureau if it later wants to rescind.
  • Documentation. A dispute can be initiated with a letter or online form. A block requires all four statutory items, including a law enforcement or FTC report.

A credit freeze and a fraud alert are different tools again. A freeze stops new creditors from accessing your report, which prevents new fraudulent accounts from being opened. A fraud alert flags your file so creditors take extra steps to verify your identity. Neither removes existing fraudulent entries. The 1681c-2 block is the mechanism for getting fraudulent entries off your report.

What You Can Recover if a Bureau or Furnisher Violates the Law

Violations of the FCRA are actionable in federal or state court, and the remedies depend on whether the noncompliance was negligent or willful.

Negligent Violations

When a bureau or furnisher fails to comply through carelessness, you can recover the actual damages you suffered. That includes a denied loan, a higher interest rate you were forced to accept, or out-of-pocket costs from cleaning up the fallout. A prevailing plaintiff can also recover attorney’s fees and court costs.5Office of the Law Revision Counsel. 15 USC 1681o Civil Liability for Negligent Noncompliance

Willful Violations

Willful noncompliance carries more. You can recover either actual damages or statutory damages of $100 to $1,000 per violation, whichever is greater, without proving financial harm. The court may also award punitive damages and must award attorney’s fees and costs to a prevailing plaintiff.6Office of the Law Revision Counsel. 15 USC 1681n Civil Liability for Willful Noncompliance

A bureau that refuses to place a block despite receiving all four required items, or that lifts a block without one of the three permitted grounds, is a strong candidate for willful noncompliance. So is a furnisher that keeps reporting data it knows resulted from identity theft.

Deadline to Sue

You must file within two years of discovering the violation, or five years from the date the violation actually occurred, whichever comes first. If a bureau quietly rescinds your block without notifying you, the clock starts when you discover the fraudulent information back on your report, not when the bureau made the decision.7Office of the Law Revision Counsel. 15 USC 1681p Jurisdiction of Courts – Limitation of Actions

The CFPB and FTC also have independent enforcement authority. Filing a complaint at consumerfinance.gov can prompt regulatory action even if you never sue.8Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act

How to Start the Process

Move quickly and keep records. Start at IdentityTheft.gov to file the FTC report and generate a recovery plan; the site walks you through the report, pre-fills dispute letters, and tracks your progress. Take the FTC report to your local police department if you also want a police report, since many creditors find the combination more persuasive.

Send your block request to each of the three major bureaus separately: Equifax, Experian, and TransUnion. Include all four required items with each request. Use certified mail with return receipt so you have proof of the date each bureau received your materials. The four-business-day clock starts on the date of receipt, not the date you mailed everything.

Keep copies of every document you send, every confirmation you receive, and every credit report you pull. If you end up in court, that paper trail is the difference between a strong case and a swearing match. Pull your free credit reports 30 to 60 days after submitting your block requests to confirm the fraudulent items are gone and have not quietly reappeared.