In this guide
- Choose the process that fits the problem
- Build a packet with all four required elements
- Prepare a bureau-by-bureau inventory
- Understand the four-business-day rule
- When a block can be declined or removed
- Protect yourself while the reporting issue is corrected
- Your final verification checklist
- What should you ask if an identity theft block is denied?
- Sources
You can ask a credit reporting company to block information that resulted from identity theft by submitting a complete identity-theft packet. Under the federal rule, the bureau generally must block the identified information within four business days after receiving the required materials, subject to statutory exceptions. This is different from freezing access to your report or disputing an ordinary error. Identify each fraudulent item, provide proof of identity and an identity theft report, and state that the information does not relate to a transaction you made. Use this process only for genuine identity theft.
Choose the process that fits the problem
The CFPB’s identity-theft guidance describes blocking fraudulent information as a recovery step. It is not a general method for deleting debts you recognize. If someone else’s information was accidentally matched to your file, investigate a mixed credit file rather than assuming an identity thief opened the account.
| Tool | Main purpose | What it does not establish |
|---|---|---|
| Identity theft block | Stop identified identity-theft information from being reported under the applicable federal process | That all disputed debts are fraudulent or all related problems are resolved. |
| Credit report dispute | Investigate inaccurate or incomplete information | That the special identity-theft blocking deadline applies. |
| Credit freeze | Restrict access to your credit file for many new-credit checks | Removal of fraudulent accounts already on the report. |
| Fraud alert | Prompt additional identity verification for credit requests | Automatic correction of existing account information. |
You may need more than one tool, but keep records for each. Our freeze-versus-fraud-alert comparison explains the prevention side; the document packet below addresses information already being reported.
Build a packet with all four required elements
FCRA section 605B identifies four elements: appropriate proof of identity, a copy of an identity theft report, identification of the information to block, and a statement that it does not concern a transaction by you. A general note saying “I was hacked” may not tell the bureau which entries to address.
- Verify your identity. Follow the bureau’s current official instructions. Use readable documents and a secure submission channel.
- Include the identity theft report. IdentityTheft.gov provides the FTC reporting and recovery process. Keep the completed report and reference information.
- Identify every affected item. Include the company name, account identifier as shown on the report, report date, and the specific information you say resulted from identity theft.
- Explain the relationship to you. Clearly state that the identified information does not relate to a transaction you made. Describe the facts accurately and do not sign a statement that is untrue.
Use the FTC’s identity-theft credit bureau sample letter as an official starting point. Customize it to your facts. A template helps organize a request; it does not create evidence or guarantee that a disputed entry qualifies for blocking.
A short cover note for your document packet
Illustrative request: “I am requesting an identity theft block under FCRA section 605B for the entries identified in the attached list. These entries resulted from identity theft and do not relate to transactions I made. I have included proof of my identity and a copy of my identity theft report. Please confirm receipt and notify me of the action taken on each entry.”
Use this only when it accurately describes your situation. The cover note accompanies the four required elements; it does not replace them.
Prepare a bureau-by-bureau inventory
Obtain the reports and compare them using our free credit report instructions. A fraudulent account may appear at one bureau, several, or under slightly different names. Send the appropriate request to each affected company. The rule that one nationwide bureau notifies the others about a fraud alert is not a substitute for tracking your blocking requests.
Keep one row per affected bureau and item. Use an internal label such as “Item A” to follow the same fraudulent account across reports, and keep this record private.
| Record | What to enter |
|---|---|
| Item and affected report | Bureau, report date, furnisher, partial account number, amount shown, and why the item resulted from identity theft |
| Required packet | Identity proof, identity theft report, identified items, and statement that the transactions were not yours |
| Receipt | Submission date, delivery confirmation, reference number, and any missing-document request |
| Outcome | Written decision for this item, date checked on a fresh report, and remaining discrepancy |
Illustrative scenario: two reports show an unauthorized retail account, while a third does not. The consumer submits packets to the two affected bureaus and records delivery separately. One response addresses the retail account, but a related collection appears under another company. The consumer then checks whether that collection was included in the original item list before deciding what additional request is necessary.
Understand the four-business-day rule
The statutory clock is tied to receipt of the required information, not the moment you start an online form, send an incomplete email, or first notice the fraud. Weekends and holidays make “business days” different from calendar days. Save evidence of submission and receipt, and check whether the recipient has requested missing materials.
Separate three questions when following up: Did the bureau receive the packet? Does it consider the required materials complete? What action did it take on each identified item? A single status word such as “received” does not answer all three.
This timing rule concerns blocking information in the report. It is not a promise that a lender will approve an application, a credit score will rise by a fixed amount, or every collection contact will end at the same moment. Related account recovery and creditor investigations can require their own follow-up.
When a block can be declined or removed
The law includes circumstances for declining or rescinding a block, including requests made in error, material misrepresentations, or obtaining goods, services, or money from the transaction. A rejected request deserves a careful reading of the stated reason. Do not simply submit a stronger accusation or buy a different template.
If documents are missing, supply the relevant documents. If the response addresses the wrong account, identify the mismatch. If the company concludes the transaction was yours and you disagree, organize the contradictory evidence and consider qualified legal help. Keep the result letter because it explains what needs to be addressed next.
Protect yourself while the reporting issue is corrected
Contact affected businesses through verified channels about unauthorized accounts or account access. A credit freeze at all three nationwide bureaus can reduce certain new-account risks, but it does not secure an existing compromised bank login. Follow the recovery steps that match the actual incident.
Do not share full identity documents with a person who unexpectedly calls claiming to represent the government or a bureau. Return to the official site yourself. Store the recovery packet securely, and share only what the legitimate recipient needs.
Your final verification checklist
- Each fraudulent item is matched to an affected report.
- Each packet includes the required identity, report, item, and transaction statement components.
- Delivery and any missing-document requests are recorded.
- Written results are saved and compared with fresh reports.
- New or remaining discrepancies have specific follow-up notes.
Completing the checklist gives you a documented recovery process. It does not turn accurate negative history into identity theft or replace legal help when the facts are disputed.
What should you ask if an identity theft block is denied?
Request a written explanation that identifies the affected items and the reason for declining or rescinding the block. Section 605B requires prompt notice of a decision to decline or rescind a block. Do not interpret a generic dispute status as a complete explanation of that decision.
Organize the follow-up around four questions:
- Which required document or statement, if any, is missing?
- Which specific account or entry did the decision cover?
- Does the explanation say the problem is incomplete documentation or a disagreement about whether the transaction resulted from identity theft?
- What evidence directly answers that reason?
Save your original packet unchanged and label any additional material as a supplement. If a response refers to an account number you did not identify, point out the mismatch. If the facts are contested or the error is causing serious harm, consider qualified consumer-law assistance. Repeated identical submissions do not resolve a disputed factual issue.
Explore related guides on credit reports and disputes.
Sources
- CFPB: identity theft recovery
- Federal Reserve: FCRA section 605B
- FTC IdentityTheft.gov: credit bureau sample letter
Updated October 6, 2026. Product terms and submission procedures can change; confirm the current instructions with the relevant organization.
Claire Bennett is the site’s editorial name, as explained on our author page.
Educational information only, not individualized financial or legal advice. Examples are illustrative; results depend on your circumstances.
Photo: Wesley Tingey / Unsplash. Illustrative photograph; not a customer story or testimonial.
