Independent. No paid rankings. Pass or fail is never for sale. Where a provider passes our review, we may link to it with a disclosed affiliate link.Reviewed as findings changeEditorial policyNewsletter
The Credit RecordAn independent record of credit repair and debt settlement companies

Last reviewed: 21 October 2026

Home › Credit help › Identity-theft credit-report blocks

Blocking identity theft items on your credit report: the four-business-day rule

Most of what this Library covers is disputing something on your report that is yours but wrong. Identity theft is a different problem: the account or collection is not yours at all. Federal law gives victims a separate tool for that. A credit bureau must block the fraudulent information within four business days of receiving the required documents.[1][4] An ordinary dispute runs on a 30-day clock.[5]

The short answer

  • The deadline: a consumer reporting agency "shall block the reporting" of information you identify as resulting from identity theft "not later than 4 business days" after it receives four things from you.[1]
  • The four things: proof of identity; a copy of an identity theft report; your identification of the information; and a statement that it does not relate to any transaction by you.[1] The CFPB says the identity theft report "can be done through IdentityTheft.gov."[4]
  • After the block: the bureau must promptly notify the company that furnished the information.[1] The CFPB says that, once notified, "creditors can't turn identity theft-related debts over to debt collectors."[4]
  • When a bureau can refuse: on the grounds the statute lists, and it must tell you promptly.[1]

The right itself: FCRA § 605B (15 U.S.C. § 1681c-2)

The statute says that, except as otherwise provided, a consumer reporting agency "shall block the reporting of any information in the file of a consumer that the consumer identifies as information that resulted from an alleged identity theft, not later than 4 business days after the date of receipt by such agency of—"[1]

  1. "appropriate proof of the identity of the consumer";
  2. "a copy of an identity theft report";
  3. "the identification of such information by the consumer"; and
  4. "a statement by the consumer that the information is not information relating to any transaction by the consumer."[1]

The CFPB's consumer page lists the same package: an identity theft report, proof of identity, a letter identifying the fraudulent debts and information, and a statement that they are not your transactions. It says you can get a sample letter on IdentityTheft.gov.[4] The CFPB also says to "use this method only for debts that are the result of identity theft."[4]

What counts as an "identity theft report"

Regulation V defines an identity theft report as one that alleges identity theft "with as much specificity as the consumer can provide" and that is "a copy of an official, valid report filed by the consumer with a Federal, state, or local law enforcement agency," the filing of which carries criminal penalties for false information.[3] A bureau or furnisher may ask for more information to judge the report's validity. It must ask within 15 days of receiving the report, and the rule sets further time limits for follow-up requests and a final decision.[3]

The CFPB tells victims to report identity theft to the FTC at IdentityTheft.gov, where "you will get an Identity Theft Report and recovery plan."[4] It also tells victims to report the theft "to both local police and at IdentityTheft.gov."[4]

After the block: the furnisher's duties

The bureau must "promptly notify the furnisher" that the information may be a result of identity theft, that an identity theft report has been filed, that a block has been requested, and of the block's effective dates.[1] The furnisher must then have "reasonable procedures" to respond to that notice and "to prevent that person from refurnishing such blocked information."[2]

You can also send an identity theft report straight to the furnisher, at the address it specifies for such reports. The furnisher then "may not furnish such information" to any bureau "unless the person subsequently knows or is informed by the consumer that the information is correct."[2]

When a bureau can say no, or take a block back

A bureau "may decline to block, or may rescind any block" only if it "reasonably determines" one of these:[1]

If it declines or rescinds, it must notify you "promptly, in the same manner as consumers are notified of the reinsertion of information."[1] In its Spring 2024 Supervisory Highlights, the CFPB said examiners found some consumer reporting companies "automatically declining to implement identity theft blocks upon receipt of the requisite documentation based on overbroad disqualifying criteria and without an individualized determination," and called that a violation of the FCRA.[8] If you think a block was wrongly refused, see where to file a credit complaint.

How this differs from a freeze, a fraud alert, or an ordinary dispute

A security freeze or fraud alert looks forward: it makes it harder to open a new account in your name. The CFPB notes a freeze "doesn't prevent identity thieves from taking over existing accounts."[4] The block looks back: it stops the bureau reporting fraudulent information already in your file.[1]

An ordinary FCRA dispute is for information that is about you but wrong. There, the bureau must reinvestigate "before the end of the 30-day period" after it receives your dispute, extendable by up to 15 days in some cases if you send relevant information during that period.[5] A dispute does not need an identity theft report.

A related right: survivors of human trafficking

FCRA § 605C (15 U.S.C. § 1681c-3), added by Public Law 117-81 in December 2021, says a consumer reporting agency "may not furnish a consumer report containing any adverse item of information about a consumer that resulted from a severe form of trafficking in persons or sex trafficking" if the consumer has provided trafficking documentation.[6] The CFPB's rule says that, within four business days of receiving the submission, a bureau "must block the reporting of any adverse item of information identified by the consumer."[7] The CFPB gives July 25, 2022 as the effective date of those Regulation V requirements.[8]

Under the rule, the documentation can be a victim determination by a federal, state or tribal government entity, or by an authorized non-governmental organization or human trafficking task force member. It can also be a court determination. Or it can be a signed statement by the consumer, if the statement or an accompanying document is signed or certified by a representative of one of those entities.[7] The consumer, or a designated representative, also identifies the adverse items. Credit repair organizations are excluded from acting as that representative.[7]

Questions people ask

How long does a credit bureau have to block identity theft information?

Four business days after it receives proof of identity, an identity theft report, your identification of the information, and your statement that it is not yours.[1]

Can I use an IdentityTheft.gov report?

The CFPB says the identity theft report "can be done through IdentityTheft.gov."[4] Regulation V lets a bureau or furnisher ask for more information within set time limits.[3]

What if the bureau refuses?

A nationwide bureau may decline or rescind a block on the three grounds in the statute, and must notify you promptly. (The statute has separate exceptions for resellers and check-verification companies.)[1] You can complain to the CFPB; see where to file a credit complaint.

Will the debt go to a collector anyway?

The CFPB says that once notified, "creditors can't turn identity theft-related debts over to debt collectors."[4]

This is not what a "CPN" pitch is selling you. A legitimate identity-theft or trafficking block requires real proof — an actual report of an actual crime committed against you — and only removes information that resulted from that specific crime. It does not erase your real credit history, and it isn't a way to get a fresh Social Security-like number to start over with. See our CPN scams explainer for why that separate pitch is a federal crime, not a shortcut version of this real right.
Related: see credit freezes, locks, and fraud alerts for the forward-looking protections, and furnishers and your FCRA dispute rights for the separate process that applies when something about your own, genuine account is simply wrong.

What you can do next

References

  1. Fair Credit Reporting Act § 605B, 15 U.S.C. § 1681c-2, "Block of information resulting from identity theft", subsections (a)–(c), U.S. Code 2023 edition, govinfo.gov, read 21 October 2026.
  2. 15 U.S.C. § 1681s-2(a)(6), "Duties of furnishers upon notice of identity theft-related information", U.S. Code 2023 edition, govinfo.gov, read 21 October 2026.
  3. 12 C.F.R. § 1022.3(i), definition of "identity theft report" (Regulation V), ecfr.gov, read 21 October 2026.
  4. Consumer Financial Protection Bureau, "What do I do if I am a victim of identity theft?" (last reviewed 30 July 2026), consumerfinance.gov, read 21 October 2026.
  5. 15 U.S.C. § 1681i(a)(1), "Procedure in case of disputed accuracy", U.S. Code 2023 edition, govinfo.gov, read 21 October 2026.
  6. Fair Credit Reporting Act § 605C, 15 U.S.C. § 1681c-3, "Adverse information in cases of trafficking" (added by Pub. L. 117-81, § 6102, 27 December 2021), govinfo.gov, read 21 October 2026.
  7. 12 C.F.R. § 1022.142, "Prohibition on inclusion of adverse information in consumer reporting in cases of human trafficking" (Regulation V), ecfr.gov, read 21 October 2026.
  8. Consumer Financial Protection Bureau, Supervisory Highlights, Issue 32 (Spring 2024), consumer reporting section, read 21 October 2026.

Related