Identity Theft and Credit Fraud

Identity Theft, Credit Fraud, and the Difference

Identity theft is the misuse of another person's personal identifying information, such as a name, Social Security number, date of birth, or account number, without permission. When that information is used to open accounts, take out loans, or make charges, the resulting activity is often described as credit fraud or account fraud.

The two terms overlap but are not identical. Identity theft describes the theft and misuse of the underlying data; credit fraud describes the specific financial transactions and accounts that result. A single set of stolen data can produce both, and the effects can appear across multiple credit files because the three national credit reporting companies, Equifax, Experian, and TransUnion, each maintain separate records.

How Fraudulent Activity Reaches a Credit Report

Credit reporting companies collect information from data furnishers, which include banks, card issuers, collection agencies, and other lenders. When a fraudster opens an account in someone else's name, the creditor may report that account to one or more of the credit reporting companies as if the victim were the customer.

Because each file is assembled separately, a fraudulent account may appear on only one report or on all three. Inquiries tied to applications the consumer never made can also be recorded. These entries generally remain in a file until the dispute process resolves them or a block is applied under federal law.

• Unauthorized new accounts opened in the consumer's name
• Charges on existing accounts the consumer did not make
• Collection accounts for debts the consumer never owed
• Hard inquiries from applications the consumer did not submit
• Address or employer changes the consumer never requested

Warning Signs to Watch For

Common warning signs include unfamiliar accounts or balances on a credit report, collection notices for debts the consumer does not recognize, denials of credit for reasons that do not match the consumer's history, and mail or email about accounts that were never opened.

Other indicators include calls from debt collectors about unknown debts, missing bills or statements, and unexpected changes to a credit file such as a new address or employer. A bank or card issuer may also contact the consumer about activity that was not authorized.

Because some signs appear only in a credit file, reviewing reports from each of the three national credit reporting companies is a common way people notice entries they do not recognize. Federal law gives consumers the right to obtain those reports and to dispute information they believe is inaccurate.

Reporting, Disputing, and Recovery Steps

Federal law, including the Fair Credit Reporting Act, gives consumers the right to dispute information in their credit files that is inaccurate or incomplete. A dispute is typically filed with the credit reporting company that lists the item, and that company is generally required to investigate and respond within set timeframes.

Consumers can also file an identity theft report with the Federal Trade Commission at IdentityTheft.gov and may file a police report with local law enforcement. An FTC Identity Theft Report can be used to support disputes and to request that fraudulent information be blocked from a credit file.

Recovery often involves contacting each creditor or data furnisher directly, closing or securing compromised accounts, and documenting all communications. Because each credit reporting company maintains its own file, a dispute may need to be filed separately with each company that shows the fraudulent item.

Fraud Alerts and Security Freezes

A fraud alert tells creditors to take reasonable steps to verify identity before extending credit in the consumer's name. An initial fraud alert lasts one year, and an extended fraud alert is available to people who have an identity theft report. Placing an alert with one national credit reporting company generally requires that company to notify the other two.

A security freeze, also called a credit freeze, restricts access to a credit file. Federal law allows consumers to place, temporarily lift, or remove a freeze, and freezes are free to place and to lift. Freezes are governed by federal law and, in some respects, by state law.

Both tools are preventive rather than corrective. They limit new-account fraud, but they do not remove existing fraudulent entries. Removing those entries generally requires a dispute under the FCRA or a block request supported by an identity theft report.

Protecting Personal Data

Identity theft often begins with data exposure, such as a breach, a phishing message, a skimming device, a lost document, or information shared publicly. Limiting how much personal information is shared and stored reduces the number of places it can be taken from.

Habits that limit exposure include using unique passwords, enabling multi-factor authentication, avoiding links in unsolicited messages, shredding documents that show account numbers, and being cautious about requests for a Social Security number. No single step prevents identity theft entirely.

Under laws such as the California Consumer Privacy Act and the California Privacy Rights Act, residents of California have specific rights over personal information held by businesses, including rights to know, delete, and opt out of certain sharing. Other states have enacted similar laws. These statutes are separate from the FCRA, which governs consumer reporting.

Rights Under Federal Law

The FCRA sets the framework for disputes, fraud alerts, and security freezes. It also requires consumer reporting companies to block information that resulted from identity theft when the consumer provides an identity theft report and proper identification, and when other conditions in the statute are met.

The Fair Credit Billing Act provides a dispute process for billing errors on credit card accounts, which can be relevant to unauthorized charges. The Electronic Fund Transfer Act and its implementing rules cover errors involving debit cards and electronic transfers, though the protections differ from those for credit cards.

The FTC's IdentityTheft.gov offers a recovery plan and can generate an Identity Theft Report. State attorneys general and state consumer protection offices may also assist consumers, and state law may add requirements or protections beyond federal law.