If Someone Steals Your Identity, Are You Responsible for Debt?

If someone steals your identity, you are not responsible for debts you didn’t authorize, but the legal protection you get depends on the type of debt and how fast you report it. Federal law caps your liability for unauthorized credit card charges at $50, limits debit card losses on a sliding scale tied to how quickly you notify the bank, and imposes no obligation at all on you for entirely new accounts a thief opens in your name. The work is in proving the fraud and getting the entries off your credit report before collectors and creditors treat the debts as yours.

Unauthorized Charges on Your Credit Card

Federal law caps your liability for unauthorized credit card charges at $50.¹ That cap applies as long as the card issuer gave you notice of your potential liability and a way to report unauthorized use. Once you notify the issuer, you owe nothing for charges made after that point. Every major card network now offers a zero-liability policy that goes further than the statute requires, so most cardholders end up paying nothing.

There is a hard deadline, though. Under the Fair Credit Billing Act, you must send a written dispute to your card issuer within 60 days of the statement showing the unauthorized charge. Miss that window and you lose the statutory protections for those charges. The dispute has to identify the charge, explain why you believe it is fraudulent, and include your account information. Once the issuer receives your notice, it has 30 days to acknowledge it and must resolve the dispute within two billing cycles, and in any event within 90 days.² While the investigation is open, the issuer cannot try to collect the disputed amount or report it as delinquent.

Unauthorized Withdrawals from Your Debit Card or Bank Account

Debit card fraud follows different rules, and your liability rises the longer you wait. The Electronic Fund Transfer Act sets a tiered system when your physical card or PIN is lost or stolen:

Report within two business days of learning your card is lost or stolen, and your maximum liability is $50.
Report after two business days but before 60 days from your statement, and your liability rises to as much as $500.
Wait longer than 60 days from your statement, and you can be on the hook for every fraudulent transfer that happens after that window until you finally report it.³

When your account number is compromised without your card being lost, through a data breach, skimming, or online theft, the first two tiers don’t apply. Your only obligation is to report the unauthorized transfer within 60 days of receiving the statement that shows it. If you do, your liability is zero. If you don’t, you’re responsible for any fraudulent transfers that happen after those 60 days and before you notify the bank.⁴ That distinction matters in a world where most debit fraud comes from stolen card numbers rather than stolen wallets.

New Accounts a Thief Opened in Your Name

When a thief opens entirely new credit cards, loans, or utility accounts in your name, you have no legal obligation to pay those debts. You never agreed to the account, never signed a contract, and never received the benefit of the credit. The challenge isn’t the law. It’s proving the fraud before creditors and collectors treat the balance as yours.

The Fair Credit Reporting Act gives you two tools. Once you submit an identity theft report to a creditor along with a statement that the account is fraudulent, that company cannot continue reporting the account to credit bureaus.⁵ And credit bureaus must block fraudulent information from your credit report within four business days of receiving your identity theft report, proof of identity, identification of the fraudulent entries, and your statement that the accounts aren’t yours.⁶

One tax boundary worth knowing: if a creditor cancels a fraudulent debt, it may issue you a Form 1099-C reporting the canceled amount as income.⁷ A debt you never legitimately owed isn’t taxable income, but you may need to contact the creditor to correct or withdraw the form, and hold onto your identity theft report in case the IRS asks.

Get Your FTC Identity Theft Report First

Almost every protection above depends on one document: an FTC Identity Theft Report. It serves as official proof of the theft for creditors, credit bureaus, debt collectors, and law enforcement. Without it, you can still dispute debts, but the process takes longer and the legal leverage is weaker.

Go to IdentityTheft.gov and work through the online form.⁸ You provide your personal information, details about the fraud, and a list of every fraudulent account or transaction you’ve discovered. The site generates your official report and a personalized recovery plan with step-by-step instructions for your situation.⁹

Some creditors and law enforcement agencies also want a police report. Bring your FTC report, a government-issued photo ID, and proof of your address to your local police department. Not every department will take these reports enthusiastically, but having both documents strengthens your position with stubborn creditors.

Disputing the Debts and Cleaning Up Your Credit Report

Getting the debts off your back takes two parallel disputes: one with each creditor, and one with each credit bureau reporting the account.

Disputing with the Creditor

With your FTC Identity Theft Report in hand, send a written dispute to the fraud department of every company where a fraudulent account exists or unauthorized charges appeared. Your letter should identify the specific fraudulent account or charges, state that you are an identity theft victim, and declare that you are not responsible for the debt. Include a copy of your FTC report.

Send the dispute by certified mail with a return receipt requested. That paper trail matters if the company drags its feet. For credit card billing disputes, the creditor must acknowledge your notice within 30 days and resolve it within two billing cycles.² For fraudulent accounts opened in your name, a creditor that receives your identity theft report is prohibited from continuing to report that account to credit bureaus.⁵

Disputing with the Credit Bureaus

You also need to dispute the fraudulent entries directly with each credit bureau reporting them. Under the Fair Credit Reporting Act, when you notify a credit bureau that information in your file is inaccurate, the bureau must conduct a free investigation and either verify, correct, or delete the disputed item within 30 days.¹⁰ If you provide additional information during that 30-day window, the bureau gets up to 15 extra days. The bureau must notify you of the results within five business days of completing its investigation.

With an FTC Identity Theft Report, you can go further and request a block under FCRA Section 605B. Once you provide the report, proof of identity, and identification of the fraudulent accounts, the bureau must block that information from your credit file within four business days.⁶ A block is more permanent than a dispute because it removes the information rather than just flagging it as contested.

When Debt Collectors Contact You

Fraudulent debts often end up with collection agencies before you know they exist. Your failure to dispute a debt with a collector does not count as a legal admission that you owe it. If a collector contacts you about a fraudulent account, send a written dispute within the validation period (typically 30 days of the collector’s initial contact). Once you dispute in writing, the collector must stop all collection activity until it sends you verification of the debt.¹¹

Include a copy of your FTC Identity Theft Report. A collector that receives a valid identity theft report and keeps pursuing you for a debt that isn’t yours is violating federal law.

If a Company Ignores Your Report

When a creditor or credit bureau ignores your identity theft report or keeps reporting fraudulent accounts after you’ve followed every step, you have a private right of action under the Fair Credit Reporting Act. What you can recover depends on whether the company’s failure was careless or deliberate.

For negligent violations, you can recover actual damages you sustained because of the failure, plus the cost of bringing the lawsuit and reasonable attorney’s fees. For willful violations, you can recover actual damages or statutory damages between $100 and $1,000 per violation (whichever is greater), plus punitive damages, plus attorney’s fees and costs.¹²

A credit bureau that continues reporting a fraudulent account after receiving your identity theft report and blocking request is hard-pressed to argue the failure wasn’t deliberate. The availability of punitive damages and attorney’s fees is why many consumer attorneys take these cases on contingency, so you don’t necessarily need money upfront to fight back.

1
Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card
2
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
3
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
4
Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
6
Federal Trade Commission (FTC). FCRA 605B – Blocking Information Resulting From Identity Theft
7
Internal Revenue Service. Topic No. 431, Canceled Debt – Is It Taxable or Not?
8
Federal Trade Commission. IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan
9
Federal Trade Commission. Identity Theft Recovery Steps
10
Office of the Law Revision Counsel. 15 U.S. Code 1681i – Procedure in Case of Disputed Accuracy
11
eCFR. 12 CFR Part 1006 – Debt Collection Practices (Regulation F)
12
Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance