You already know something is wrong. You have seen the accounts you never opened. You have sent the disputes. You may have sent them more than once, with the police report and the FTC report attached, and gotten back the same letter saying the account was verified as accurate and will remain on your file.
Meanwhile the damage keeps coming. A mortgage application stalled. A collector calls about a debt that was never yours. An employer or a security officer asks about six figures of debt you don’t owe.
At that point you might conclude the system has turned against you. It has not. Federal law places obligations on the credit bureaus and on the companies reporting the fraudulent accounts, and when they fail to meet those obligations, you can sue them.
First, This Is Not Your Fault
Victims often arrive convinced they caused this. They lost a wallet once. They threw out a statement without shredding it. They clicked something.
That is rarely how it happens anymore. Personal information is bought and sold in bulk after data breaches at banks, retailers, health systems, and credit reporting agencies themselves. Your information is probably already out there, through no act or omission of yours. Yes, the fraud was initiated by a thief, but it is the banks and finance companies that opened the fraudulent accounts in your name. If their safeguards were stronger, maybe it would never have happened. The problem is that they opened accounts without verifying who was applying, and/or they keep reporting it after you have told them the truth.
This matters legally as well as emotionally. Nothing in the Fair Credit Reporting Act conditions your rights on having been careful enough.
Take Inventory of the Whole File, Not Just the Obvious Account
Serious identity theft usually leaves more behind than one bad tradeline. Pull all three reports and look for:
- Accounts you never opened, including ones already sold to collectors
- Hard inquiries from lenders you never contacted, which show who accessed your file and when
- Soft Inquiries from collectors and lenders you have never done business with
- Addresses, employers, phone numbers, and name variations that are not yours, which is often how the thief kept the mail away from you
- A mixed file, where another person’s information has been merged into yours
- Collection accounts and judgments downstream of the original fraud
The identifying information matters more than people realize. Wrong addresses and name variants tend to be what allowed the fraud to continue undetected, and they can help perpetuate it if they stay on the file.
What the Law Requires of Them
A reasonable reinvestigation. Under 15 U.S.C. § 1681i(a), once you dispute an item, the credit reporting agency must conduct a reasonable reinvestigation, generally within 30 days, and must forward your dispute and relevant information to the company that furnished the information. “Reasonable” is the operative word, and a rushed or automated review may not satisfy it, especially when you have supplied documentary proof.
The furnisher’s own duty. Under 15 U.S.C. § 1681s-2(b), the lender or collector that receives a forwarded dispute must investigate, review all relevant information provided, correct what is inaccurate, and stop reporting anything it cannot verify. Re-confirming what is already in its own computer is not an investigation.
The identity theft block. This is the provision most consumers have never heard of, and in a serious case it is often the most powerful. Under 15 U.S.C. § 1681c-2, a credit reporting agency must block information resulting from identity theft when you provide four things: proof of your identity, a copy of an identity theft report, information identifying the specific item, and a statement that the item does not relate to any transaction by you. An FTC Identity Theft Report from IdentityTheft.gov qualifies. The bureau may refuse only on narrow grounds set out in the statute, such as a determination that the block was requested in error or that you materially misrepresented something. “The furnisher says it is accurate” is not one of them.
Permissible purpose. Under 15 U.S.C. § 1681b(f), a company may access your credit report only for the purposes the statute allows. Whoever pulled your file to open the fraudulent account had no permissible purpose, which is a violation independent of everything that followed.
Collection conduct. When a collector reports or pursues a debt arising from identity theft, the Fair Debt Collection Practices Act and Maryland’s consumer debt collection statute may also apply. Maryland’s law prohibits attempting to enforce a right to collect that the collector knows does not exist, and it expressly allows recovery for emotional distress with or without accompanying physical injury.
Why Your Disputes Keep Coming Back “Verified”
Understanding this is what turns a frustrating dead end into a case.
When you mail a bureau a detailed letter with your identity theft report and supporting documents attached, that package is generally not what reaches the furnisher. The bureaus process disputes through an automated system that reduces what you sent to a code and an attachment. All too often, the furnisher receives that, checks whether the name, SSN and account number match its own records, confirms the match, and sends the answer back. The bureau then reports to you that the account was verified.
Sometimes, nobody read your documents. Nobody looked at the signature. Nobody asked why the application listed an address you have never lived at. Other times, the furnisher searches for “reasons” to justify holding you liable for the account, such as that statements were sent (even if you didn’t get them) or payments were made (even if you didn’t make them).
That is the failure the statute was written to address, and a verification letter is often the single most useful document in the case, because it proves the bureau and the furnisher were told and did nothing.
What to Do Now
File an FTC Identity Theft Report at IdentityTheft.gov if you have not. It is free, and it can be used to get a § 1681c-2 block. File a police report as well.
Dispute in writing, by mail, to each bureau separately. Certified mail, return receipt, and keep a complete copy of everything you send. The bureaus do not copy each other’s results, so an item deleted from one file can sit on the other two indefinitely.
Dispute directly with the furnisher too, in writing, enclosing the same materials.
Be specific. Identify the account, state plainly that you did not open or authorize it, and attach your evidence. A bare “this is not mine” invites a cursory investigation.
Place a fraud alert or a security freeze. These prevent new accounts from being opened. They do nothing about accounts already reported, so this is an additional step, not a substitute.
Keep everything. Denial letters, collection notices, envelopes, dispute responses, call logs, and the names of everyone you spoke with. Save the envelopes; postmarks establish timing.
Do not stop after one verification. That letter is not the end of the road. It is very often the beginning of the claim.
Be wary of “credit repair” companies. Many charge for form letters you can send yourself, and some file volume disputes that get flagged as frivolous, which can undermine a legitimate claim. If you really want help disputing a fraudulent account, find an attorney you can trust to help you – but expect to pay for the service.
What an Identity Theft Credit Report Lawyer Can Do
There is a point past which sending more letters yourself stops helping. What changes at that point is not effort. It is leverage.
Build a record that proves the violation. Much of what determines whether a case succeeds is how the disputes were framed, what was enclosed, and what can be proven about what the bureau and the furnisher received. A lawyer structures that deliberately rather than in hindsight.
Get behind the “verified” response. In litigation, the bureau’s and furnisher’s internal dispute records become discoverable, including the coded forms actually transmitted, the procedures the investigator followed, and what documents were or were not passed along. That is where a superficial investigation becomes visible, and it is not something a consumer can obtain by asking.
Sue the right defendants. Claims may run against the credit reporting agencies for unreasonable reinvestigation or failure to block, and against the lender or collector for continuing to furnish information it knew or should have known was false. These are often separate claims against separate companies arising from the same account.
Pursue deletion and damages together. Correcting the file is the starting point, not the finish. Consumers who prevail may recover actual damages, which can include denied credit, higher interest paid, lost opportunities, and emotional distress. Where the conduct was willful, statutory and punitive damages are available.
Defend what comes downstream. Fraudulent accounts generate collection calls and sometimes lawsuits. Those need to be handled alongside the credit reporting claims, and a collection suit against you frequently supports counterclaims.
Document the harm properly. Denial letters, score histories, and the testimony of people who watched what this did to you are all evidence. Most consumers do not realize until too late what they should have been keeping.
There Is a Clock
FCRA claims are subject to deadlines running from when the violation occurred and when you discovered it. Waiting to see whether the next dispute round finally works can quietly consume the time available to do anything about the earlier ones. If your disputes have already failed, that is the moment to get the case evaluated, not after another year of letters.
You Do Not Have to Keep Doing This Alone
Being told repeatedly that a debt you never incurred is accurate is exhausting, and it is designed to be. The companies on the other side process millions of disputes and are set up to make persistence expensive for you and cheap for them.
The law does not require you to accept that outcome. If fraudulent accounts are on your credit reports, if the bureaus keep verifying what you have proven is false, or if collectors are pursuing you for a debt created by someone else, don’t give up; give us a call. Contact our team for a review of your case.