If a credit report shows an account, collection, or inquiry you don't recognize, begin with the bureau that lists it. Use a regular FCRA dispute when the information is wrong. Use an identity-theft block when someone used your identity.
That is the practical route for U.S. consumers. A CFPB complaint can put the problem in front of a company and create a response record, but it doesn't replace your direct request to the bureau.
People often search for a red flags credit bureau complaint. Turns out, the FTC Red Flags Rule is mainly a business compliance rule for certain creditors and financial institutions with covered accounts. It isn't a consumer form that makes Equifax, Experian, or TransUnion remove a tradeline.
The FCRA gives consumers several different tools: fraud alerts, security freezes, disputes, and identity-theft blocks. They overlap a little. They don't do the same job.
Which rule actually controls your complaint?
The FTC's Red Flags Rule guide describes the programs businesses use to detect, prevent, and reduce identity theft. The eCFR text of 16 CFR Part 681 contains the rule.
An unfamiliar address, an unauthorized hard inquiry, or a new account in your name may be a red flag. One sign alone doesn't prove identity theft. Look at the report and ask two questions: Is the information inaccurate? Did it come from a transaction you didn't make or authorize?
| Problem | Main process | What it does |
|---|---|---|
| An account, collection, or inquiry came from identity theft | FCRA Section 605B block request | Asks the bureau to block qualifying information from your file |
| A reported item is inaccurate but may be yours | FCRA dispute | Requires the bureau to investigate the reported information |
| You think someone may apply for credit in your name | Fraud alert | Tells businesses to take steps to verify your identity |
| You want to limit access to your credit file | Security freeze | Restricts most new-credit access to your report |
| A company handled your request poorly | CFPB complaint | Sends the issue through the CFPB complaint process |
FCRA Section 605A is commonly associated with fraud alerts. Section 605B covers information that resulted from identity theft. The Red Flags Rule itself doesn't give you a freeze, erase a tradeline, or promise a payout.
Fraud alert, freeze, dispute, or block?
Choose the tool based on the problem. The phrase "red flags" doesn't choose it for you.
| Tool | When it fits | Important limit |
|---|---|---|
| Initial fraud alert | You suspect fraud and want lenders to verify your identity | It usually lasts one year |
| Extended fraud alert | You have an identity theft report | It usually lasts seven years and doesn't delete an item |
| Security freeze | You want to limit access before someone opens new credit | You must manage the freeze separately with each nationwide bureau |
| Regular dispute | A balance, date, account status, or inquiry is wrong | The bureau investigates the accuracy of the information |
| Identity-theft block | The information came from a transaction you didn't make or authorize | You must provide the required identity-theft documentation |
Place an alert with any one of the three nationwide bureaus. That bureau must notify the other two. An alert can prompt extra verification, but it won't stop every kind of fraud.
A freeze works differently. Request it from each bureau separately if you want that protection. It doesn't correct an existing fraudulent account, collection, or inquiry.
File the complaint in the right order
Once you know which remedy fits, work through the records in this order.
-
Get all three current credit reports. AnnualCreditReport.com is a legitimate starting point, or use another legitimate source. Reports differ, so mark whether Equifax, Experian, or TransUnion shows each item. Record the furnisher, account or inquiry number, dates, balance, and account status.
-
Create an identity-theft report if the item was unauthorized. IdentityTheft.gov can provide an FTC Identity Theft Report and a recovery plan. The CFPB's identity theft guidance also covers fraud alerts and the steps that follow.
-
Protect future applications while you work. Place an initial fraud alert with one bureau if you want identity verification. An extended alert requires an identity theft report. Request a security freeze separately from each bureau if you want tighter control over new-credit access.
-
Pick a regular dispute or an identity-theft block. Use a regular dispute when the information is wrong but may relate to you. Request a block under FCRA Section 605B when the information resulted from identity theft. Send the request to every bureau that reports that particular item.
-
Match the documents to the request. A block request should include proof of identity and an identity theft report. Identify each fraudulent account or inquiry precisely. State clearly that it doesn't relate to a transaction you made or authorized.
-
Contact the furnisher, too. Ask the creditor or collection company to investigate its records. Ask what it needs to identify the account as identity theft. Fixing one bureau's file doesn't always update the other two.
-
Track every response. Save submission confirmations, report copies, letters, and dates. Once a bureau receives the required material for a qualifying identity-theft block request, it generally must act within four business days. A standard dispute usually takes 30 days, although some situations allow 45 days. That period is a response window, not a deadline for filing your dispute.
Send each bureau its own packet. Use the secure portal or dispute address in the bureau's current official instructions. If you mail the documents, use a service that confirms delivery.
Build an evidence packet that answers the basic questions
Your packet should make three things easy to see: what the item is, why it is wrong, and what action you want. A clear record also gives the CFPB something concrete to review later.
| Document | What it should show |
|---|---|
| Credit report page | The exact item, reporting bureau, account or inquiry, and reporting date |
| Proof of identity | Your name and identifying details that match the file |
| Identity Theft Report | Why you believe the item resulted from identity theft |
| Short timeline | When you found the item, sent disputes, and received responses |
| Earlier correspondence | What the bureau or creditor said and when |
| Delivery confirmation | When the company received your request |
To be honest, the packet can feel repetitive. You may send the same account number, report page, and explanation to a bureau, the creditor, and the CFPB. It feels like busywork, but each recipient needs the item connected to its own records.
Keep copies. Keep the dates. Keep the boring details.
Sample identity-theft block request
Use the bureau's current instructions and adjust this wording to match your facts.
[Full name]
[Current address]
[Date]
Re: Request to block identity-theft information under FCRA Section 605B
I am requesting a block of the following information on my credit file:
Furnisher: [Business name]
Account or inquiry: [Number or description]
Date and amount: [Relevant details]
This information resulted from identity theft. It does not relate to a transaction I made or authorized.
I have enclosed proof of my identity, my Identity Theft Report, and a copy of the report page identifying the item. Please treat this as a request to block the information under FCRA Section 605B and send your response to the address above.
Sincerely,
[Full name]Don't send original identity documents unless the recipient's current instructions specifically require them. Save the complete submission before you send it.
File a CFPB complaint after the direct request
Use the CFPB complaint portal after you have given the bureau or company a chance to fix the issue. The portal accepts complaints about credit reports and other personal consumer reports.
Name the company and the exact account or inquiry. Include the date of your direct dispute, the documents you supplied, and the correction or block you want. Upload the report page, identity-theft report, correspondence, and delivery confirmation when the portal allows it.
Don't write only that the bureau "ignored red flags." Explain what the item is and what the bureau did instead.
Companies generally respond to CFPB complaints within 15 days. You can review the response through the complaint system and have 60 days to provide feedback.
A CFPB complaint creates an escalation record. It isn't a court order, and it doesn't guarantee that a bureau will delete the information.
The FTC's Red Flags Rule materials explain business obligations. IdentityTheft.gov is the place for an identity-theft report, while the CFPB complaint process is for a bureau or company's response.
If the bureau says the information was verified
A verified result doesn't necessarily explain why the information belongs to you. It means the bureau completed its investigation and accepted the furnisher's response.
Read the result closely. Ask the bureau how it verified the information, then send a focused follow-up with any evidence it missed or evidence that changes the facts. Dispute the item with the furnisher as well, especially if it supplied the same information to more than one bureau.
Thing is, a deletion from one bureau doesn't automatically remove the item from the other two. Check Equifax, Experian, and TransUnion again.
If the problem continues, a consumer-law attorney or qualified legal aid service can assess the facts, possible FCRA claims, and actual losses. Claims online that every violation produces a fixed fine or payout are not reliable. Remedies depend on the law involved, the company's conduct, and the evidence.
Common questions about red flags credit bureau complaints
Can I file a complaint directly under the Red Flags Rule?
Usually, that isn't the consumer process used to correct a credit report. The rule focuses on covered businesses and their identity-theft prevention programs. Use a bureau dispute or FCRA identity-theft block for the item, then use the CFPB complaint process if the response is inadequate.
Do I need to contact all three credit bureaus?
Only if all three report the inaccurate or fraudulent item. Send a separate request to each bureau that displays it. One bureau's correction doesn't guarantee a change elsewhere.
Will a security freeze remove a fraudulent account?
No. A freeze mainly restricts access for new-credit applications. It doesn't investigate, delete, or correct an existing account, collection, or inquiry.
How long can this process take?
A qualifying identity-theft block request generally has a four-business-day action period after complete documentation arrives. Regular disputes commonly take 30 days, and some can take 45 days. Companies generally respond to CFPB complaints in 15 days, but the full recovery process can take longer.
Download all three reports, mark which bureau shows each suspicious item, and calendar the response date after sending the targeted dispute or identity-theft block.