Lydia Bayley
Associate Editor
Loyola University Chicago School of Law, JD 2022

For me, it started with a phone call. Normally I do not answer calls from unknown numbers. But that day I did. The woman on the other end of the line informed me that she was calling on behalf of a debt collection agency. Sensing my confusion, she explained, “We’ve been trying to reach you regarding your outstanding balance with Sprint.” That did not make sense, I insisted. I had never been a Sprint customer in my life. After a brief pause, she asked, “Have you ever been the victim of identity theft?”

My story is not unique. According to the Federal Trade Commission (“FTC”), reports of identity theft have been steadily increasing over the past two decades. In 2019 alone, over 9.9 million Americans were reported to have been victims of some form of identity theft. And as any one of those 9.9 million people can tell you, sorting through the aftermath of identity theft can be a daunting task. That is why it is imperative to be aware of the laws and regulations that can help individuals restore their credit security and ensure future protection.

Your rights under the Fair Credit Reporting Act

Overseen and enforced by the FTC and the Consumer Financial Protection Bureau (“CFPB”), the Fair Credit Reporting Act (“FCRA”) is the primary federal law governing the collection, dissemination, and use of consumer credit information. But aside from regulating the actions of consumer reporting agencies (“CRAs”) and the users and furnishers of consumer information, the FCRA also gives individuals certain rights regarding to manage the accuracy and access to information contained in their credit files. Below is an overview of several rights provided by the FCRA to help those who have fallen victim to identity theft.

Filing for initial or extended fraud alerts

Under the FCRA, consumers who have a good faith suspicion that they have been the victim of fraud or identity theft can place a free, one year initial fraud alert on their credit report. A fraud alert acts as a sort of red flag, notifying anyone viewing your credit report that you may have been the victim of identity theft. Once a fraud alert has been placed on your credit report, a business must verify your identity before issuing credit in your name. Individuals who have submitted an official identity theft report — typically in the form of a police report — have the right to an extended fraud alert lasting for seven years.

To place either an initial or extended fraud alert on your credit report, you will need to mail (yes, mail) a completed request form and any other required documents to at least one of the three major CRAs: Equifax, TransUnion, or Experian. You may prefer to reach out to all three CRAs to ensure that they are each on alert as soon as possible. However, once the fraud alert has been processed and placed on your credit report by one CRA, it is then required to contact the other two credit bureaus to inform them to do so as well. And be aware: the only cost an individual should incur when placing a fraud alert is the price of postage. Any websites requiring payment are not legitimate.

Implementing security freezes

The FCRA also requires that all CRAs provide consumers the ability to “freeze” (and unfreeze) their credit reports, free of charge. A security freeze eliminates the ability for other parties to run your credit, blocking identity thieves from opening unauthorized accounts in your name. Once a security freeze has been placed on your credit file the credit bureau is prohibited from releasing any information in your credit report without your express approval. This means that prospective creditors will be prevented from accessing your credit file in order to approve or deny the issuance of new credit unless you have temporarily lifted the freeze.

Unlike a fraud alert, a security freeze, or credit freeze as it is sometimes referred to, can be managed entirely online. Additionally, CRAs are not required to pass on notice of a security freeze to the other credit bureaus like they are with fraud alerts. Meaning you will need to implement and manage a credit freeze with each of the three major CRAs individually. It is important to note that all consumers are eligible to install a credit freeze, regardless of whether they have been the victim of fraud or identity theft. There is no requirement that individuals have proof, or even a good faith suspicion, that they have been the victim of identity theft in order to freeze their credit reports.

There is potential for confusion here as all three CRAs also offer “credit lock” services through their paid membership programs. This is not the same thing as a security freeze; although it performs largely the same function. While the credit lock feature is marginally more convenient than a freeze, it comes at a price and is generally marketed alongside other paid services that a CRA may offer. The only notable difference between these two options is that the paid credit lock offers the ability to lock and unlock your credit report instantly through the CRA’s mobile app. However, that is not to say a security freeze is time consuming or cumbersome to manage. In fact, it is relatively simple and can be done online.

Obtaining copies of your credit reports

Finally, the FCRA requires each credit reporting agency to provide you with a copy of your credit report once a year upon request. Whether or not you have been a victim of fraud or identity theft, your credit report will provide valuable credit information and may alert you to the existence of fraudulent accounts or activity. It is recommended that consumers look at all three reports because each agency’s information may be different.

In addition to the required yearly disclosure, consumers are entitled to an additional copy of their credit report free of charge if they are the victim of identity theft and have placed a fraud alert on their credit file. Individuals who have placed an extended fraud alert are permitted to receive two free credit reports from each of the credit bureaus within 12 months after you placed the alert. However, consumers must be wary when securing a copy of their credit report. While there may be a plethora of websites promising free reports, the official site to request them is annualcreditreport.com.

Notifying the FTC

In addition to all of the FCRA required disclosures and services, it is also beneficial to file an identity theft report with the FTC at identitytheft.gov. As with the rest of these resources, this is free. After filing your report, you will receive a free recovery plan offering additional guidance on steps to take now and in the future to ensure your credit security is restored. And while the FTC does not have the ability to pursue criminal charges, the information you provided may be used by the FBI and other law enforcement agencies to identify and locate perpetrators.