Blocking fraudulent information from your credit report

Most of what this Library covers is disputing something on your report that's inaccurate but genuinely yours — a wrong balance, a mis-dated account, a debt that isn't what it's claimed to be. Identity theft is a different problem: the account or collection isn't yours at all. Federal law gives victims a specific, faster tool for that situation, with its own paperwork and its own four-business-day deadline, separate from the ordinary 30-day dispute process.

The right itself: FCRA § 605B

Under the Fair Credit Reporting Act, 15 U.S.C. § 1681c-2, a consumer reporting agency must block — not just investigate, actually stop reporting — any information a consumer identifies as resulting from identity theft, no later than 4 business days after receiving all of the following: proof of your identity; a copy of an identity theft report; your identification of exactly which item(s) on your file resulted from the theft; and a statement that the information doesn't relate to any transaction you actually made. That's a materially faster and stronger remedy than an ordinary bureau dispute, which generally allows up to 30 days (extendable) just to investigate, and which can end with the item verified as accurate rather than removed.

What "identity theft report" means here. The Consumer Financial Protection Bureau's Regulation V defines it as a sufficiently detailed report filed with a federal, state, or local law enforcement agency. In practice, the report you generate at IdentityTheft.gov — the FTC's official identity-theft reporting site — is built to satisfy this requirement for most bureaus and creditors without a separate trip to the police, though a business is allowed to ask for more if something about your specific submission looks inconsistent. If a company insists on a traditional police report and won't accept an IdentityTheft.gov report at all, that's worth pushing back on, but it isn't automatically unlawful in every circumstance.

After the block: what happens to the furnisher

Once a bureau blocks an item under this right, it has to promptly notify the furnisher — the company that originally reported it — that the information may result from identity theft and that an identity theft report has been filed. From that point, a separate FCRA provision (15 U.S.C. § 1681s-2(a)(6)) generally bars the furnisher from reporting that same information again unless it later determines, based on its own investigation, that the information is actually accurate. That's meant to stop the same fraudulent entry from simply reappearing on your file a few months later.

When a bureau can say no — or take a block back

This right isn't unconditional. The statute lets a bureau decline to block, or rescind a block it already granted, if it reasonably determines one of three specific things: the information was blocked in error, or the block itself was requested in error; the block was requested based on a material misrepresentation of fact relevant to the request; or you actually obtained possession of the goods, services, or money involved in the disputed transaction. If a bureau declines or reverses a block on one of these grounds, it has to notify you promptly, using the same notice procedure the FCRA requires when previously-deleted information gets reinserted onto a report. This isn't a rubber-stamp process in either direction — it's a real determination the bureau has to be able to justify.

How this differs from a freeze, a fraud alert, or an ordinary dispute

These tools solve different problems and it's easy to conflate them. A security freeze or fraud alert is forward-looking — it makes it harder for anyone to open a new account in your name going forward. This block right is backward-looking — it removes something fraudulent that's already on your file. An ordinary FCRA dispute, meanwhile, is for information that's genuinely about you but wrong in some detail; it doesn't require an identity theft report, but it also doesn't come with a 4-business-day deadline or the presumption that the item should disappear rather than just get re-verified. Using the right tool for the right problem matters — filing an identity-theft block on an account that's actually yours, just reported incorrectly, is the wrong instrument and can be declined for exactly that reason.

A related, less-known right: trafficking survivors

A separate but similarly-structured right exists for survivors of human trafficking. The Debt Bondage Repair Act, enacted as part of the fiscal year 2022 National Defense Authorization Act and added to the FCRA as § 605C (15 U.S.C. § 1681c-3), requires bureaus to block adverse information that resulted from having been trafficked — evictions, defaulted loans, unpaid bills, or debts a trafficker incurred in a survivor's name are the kinds of entries this is meant to address. The Consumer Financial Protection Bureau's implementing rule took effect 25 July 2022, with the same 4-business-day blocking deadline as the identity-theft right above. The documentation is different, deliberately: rather than a police report against a trafficker, which many survivors can't or won't obtain, a survivor can submit an official government determination (such as documentation tied to a T-visa or a federal trafficking-benefits approval), or a signed statement from a qualifying government agency, human-trafficking task force, or victim-services organization attesting to their trafficking status.

This is not what a "CPN" pitch is selling you. A legitimate identity-theft or trafficking block requires real proof — an actual report of an actual crime committed against you — and only removes information that resulted from that specific crime. It does not erase your real credit history, and it isn't a way to get a fresh Social Security-like number to start over with. See our CPN scams explainer for why that separate pitch is a federal crime, not a shortcut version of this real right.

Related: see credit freezes, locks, and fraud alerts for the forward-looking protections, and furnishers and your FCRA dispute rights for the separate process that applies when something about your own, genuine account is simply wrong.