15 U.S.C. 1681c-2, also called section 605B of the Fair Credit Reporting Act, provides a way to block credit-report information resulting from identity theft. A credit reporting agency generally must block the identified information within four business days after receiving the complete statutory package. It is not a method for erasing legitimate debts. [1]
Submit all four required items
- Appropriate proof of your identity.
- A copy of an identity theft report.
- Identification of the specific information caused by the theft.
- Your statement that the information does not concern a transaction you made.
The CFPB explains that IdentityTheft.gov can provide an identity theft report and a recovery plan. Identify accounts and entries precisely; include relevant report pages and keep a copy of everything sent to each reporting company. Sending a complete package matters because the four-business-day period follows receipt of the required information. [1][2]
What happens after the block?
The reporting company must notify the information furnisher about the alleged identity theft, report, and block. The statute permits declining or rescinding a block in specified circumstances, including material misrepresentation, a request made in error, or a consumer obtaining goods, services, or money from the transaction. Notice rules apply when a block is declined or rescinded. [1]
For example, a credit card opened by someone using your stolen identity is a potential blocking issue. A card you actually opened, but can no longer afford, is not transformed into identity theft by an adverse credit entry.
Use other protections for their own purposes
A security freeze helps restrict access to a credit file for new-account decisions. A fraud alert prompts identity-verification precautions. An ordinary accuracy dispute addresses errors that may have nothing to do with identity theft. These tools can work together, but none is interchangeable with the statutory block request. [2]
Report compromised accounts directly to the financial institution, monitor existing accounts, and preserve delivery confirmations. If the company does not properly address the request, provide the documentation in a CFPB complaint and consider legal advice about unresolved reporting harm. Read how fake SSN-account schemes expose personal information and the limits on paid credit-repair services before paying someone to submit a routine request.
Primary sources
Sources checked: October 31, 2026.