What should you do first when someone steals your identity? Lock your active accounts right away.
Federal rules can shield you from catastrophic losses, but those rights depend on strict statutory clocks. Miss a deadline, and you risk getting stuck with balances you never touched. Move quickly. If you notify your bank promptly, your out-of-pocket loss usually drops near zero.
How Federal Law Caps Your Financial Loss
Credit cards and bank debit cards run on separate federal statutes.
Under the Fair Credit Billing Act, your liability on fraudulent credit card charges tops out at $50. Most card issuers waive that charge through private zero-liability pledges anyway. Still, you preserve your federal rights only if you mail written notice within 60 days after the statement was sent.
Debit cards hit your checking balance immediately, and CFPB Regulation E rules impose tighter deadlines.
| Payment Type | Reporting Window | Maximum Legal Liability |
|---|---|---|
| Credit Card (FCBA) | Within 60 days of statement mailing date | $50 (often $0 via issuer policy) |
| Debit Card (Reg E) | Within 2 business days of learning about fraud | Lesser of $50 or unauthorized amount |
| Debit Card (Reg E) | Between 2 and 60 days after statement | Up to $500 |
| Debit Card (Reg E) | More than 60 days after statement | All funds taken after the 60-day window |
Check your statements weekly. Catching a rogue withdrawal within two business days saves you hundreds of dollars.
The Two Documents You Need to Build Your Case
Dispute desks ignore phone calls. You need written records before you reach out to collectors or fraud departments.
Head to IdentityTheft.gov first. The Federal Trade Commission takes your account details and generates an official FTC Identity Theft Report and affidavit. This filing creates formal legal weight under federal law.
Turns out, local police desks often try to brush off identity theft complaints, especially when the scam happened online or in another state, but you have to stand in the lobby and politely insist on getting an incident report number because bank security desks routinely deny claims without one.
Keep several physical photocopies and digital PDF backups. Never give away your only hard copy.
Fast-Tracking Credit Bureau Blocks Under FCRA 605B
A standard dispute letter slows everything down. Sending a generic dispute triggers a standard 30-day investigation under the Fair Credit Reporting Act, which allows the bureau to contact the reporting creditor who might simply re-verify the false record.
Section 605B of the Fair Credit Reporting Act offers a much faster mechanism. Under this provision, consumer reporting agencies must block fraudulent trade lines within four business days of receiving your request packet.
Your packet needs four specific items:
- Proof of your identity, like a government photo ID and a utility bill
- A copy of your official FTC identity theft report
- A specific list identifying each fraudulent account, inquiry, or balance
- A signed statement declaring you never authorized those transactions
Freezing Your Credit Files
Blocking fraudulent data cleans up past wreckage, but it will not stop a criminal from opening new accounts tomorrow. You must freeze your credit files.
Federal statute guarantees free credit freezes and fraud alerts across the nationwide bureaus. As explained in FTC guidance on credit freezes and fraud alerts, a security freeze blocks lenders from accessing your credit history entirely. No business can open a line of credit in your name until you lift the freeze using a secure account or PIN. It remains active until you deliberately unfreeze it.
Fraud alerts offer an alternative layer. An initial alert lasts one year and instructs lenders to verify your identity before granting credit. With an official identity theft report in hand, you can demand an extended alert that lasts seven full years.
You have to place freezes with Experian, Equifax, and TransUnion separately. Freezing one bureau leaves the other two completely unlocked.
Escalating When Creditors Push Back
To be honest, dealing with fraud departments often feels like arguing with automated form letters and brick walls. Don't quit.
Submit a formal complaint to the Consumer Financial Protection Bureau if a creditor stalls or rejects valid documentation. The CFPB routes complaints directly to bank compliance officers, and companies usually deliver a written response within 15 days. That official channel often breaks bureaucratic gridlock.
You also hold legal leverage in court. Under the Fair Credit Reporting Act, you can bring a private lawsuit against reporting agencies or data furnishers that willfully fail to remove fraudulent records. The statute permits recovery of actual damages and statutory penalties. You have two years from discovering the violation, or five years from the date it occurred, to file.
Immediate Next Steps
Take control by tackling your paperwork in this sequence:
- Pull your credit reports. Order free copies through the authorized annual credit report service. Review every line item, noting down unauthorized accounts, bogus inquiries, and unfamiliar collections.
- Secure your core documents. File a sworn report online at IdentityTheft.gov, then visit your local police station to file a police report. Copy both files multiple times.
- Mail certified dispute packets. Send your FCRA 605B blocking letters to the bureaus using certified mail with return receipt requested. The signed green postal card proves exactly when their four-day statutory clock started.