An Account Isn't Yours: The Identity-Theft Credit-Report Block

Educational information only, not legal or financial advice. This article describes federal reporting rules, not a determination that an account resulted from identity theft or that an individual qualifies for a block. It makes no credit-score prediction.

First, identify the problem

An account appearing on your report that resulted from identity theft is a different problem from an account you opened with a balance or payment status you believe is wrong. The CFPB directs consumers to use the identity-theft blocking process only for debts resulting from identity theft; other reporting errors belong in the ordinary dispute process. An unfamiliar company name alone does not establish identity theft. CFPB identity-theft guidance.

For a factual error on your own account, start with What Is Actually Disputable?. For identity-theft information already in a file, 15 U.S.C. §1681c-2, also called FCRA §605B, establishes a separate blocking process.

Four inputs, then the four-business-day clock

Subject to the section's exceptions, a consumer reporting agency must block reporting of information the consumer identifies as resulting from alleged identity theft not later than four business days after the agency receives all four inputs:

1. Appropriate proof of your identity.
2. A copy of an identity theft report.
3. Identification of the information at issue.
4. Your statement that the information does not relate to a transaction by you.

The trigger is receipt of these inputs—not the day you discover the account or start drafting a request. Four business days is not four calendar days. 15 U.S.C. §1681c-2(a).

Keep a copy of the material submitted and evidence of when the agency received it. That is a recordkeeping suggestion, not an additional statutory prerequisite or a promise of a particular outcome.

What counts as an identity theft report?

It is not simply a letter saying an account is unfamiliar. The statute's minimum definition includes an official, valid report alleging identity theft, filed with an appropriate law-enforcement or other qualifying government agency, with criminal penalties for false information. 15 U.S.C. §1681a(q)(4).

Regulation V requires as much specificity as you can provide. An agency or furnisher may reasonably request additional information to evaluate validity, subject to the regulation's request and determination deadlines. This means an incomplete or nonspecific report can raise a separate documentation question; do not assume every initial submission starts an unconditional four-day clock. 12 C.F.R. §1022.3(i).

The CFPB points consumers to IdentityTheft.gov for an Identity Theft Report and recovery plan. Use official channels directly, and provide truthful information. CFPB guidance.

A block can be declined or rescinded

The agency may decline or rescind a block if it reasonably determines that the request or block was in error, involved a relevant material misrepresentation, or that the consumer obtained goods, services, or money from the transaction. It must promptly notify the consumer of that decision as the statute prescribes. A block is not an unconditional or necessarily permanent outcome. §1681c-2(c).

The agency must also promptly notify the furnisher about the possible identity theft, report, request, and effective block dates. §1681c-2(b).

Three mechanisms, three different jobs

• A freeze generally restricts access to a report, subject to exceptions.
• A fraud alert calls for identity checks before certain new credit.
• An identity-theft block addresses reporting of identified information resulting from alleged identity theft.

Read Credit Freeze vs. Fraud Alert for the first two. They are not substitutes for reviewing identity-theft information already reported. A reporting block does not itself decide debt liability, promise a score change, or determine every recovery step.

Scope matters

Section 1681c-2 has special rules for resellers and check-services companies; this guide does not represent that all reporting businesses have identical obligations. It also preserves otherwise-authorized law-enforcement access to blocked information. For those boundaries, read subsections (d)–(f).

Sources and review

Primary sources accessed October 1, 2026: GPO's 2024 editions of §§1681c-2 and 1681a; the CFPB's current Regulation V §1022.3; and CFPB consumer identity-theft guidance. The House preliminary-code site was under maintenance when checked; the GPO edition is identified rather than represented as a newly certified statutory edition. This is source/editorial review, not external legal review.