Identity Theft Protection: What Victims Must Do to Recover and Rebuild

The Identity Theft and Assumption Deterrence Act of 1998 made identity theft a federal crime punishable by up to fifteen years in prison, and it designated the FTC as the primary federal agency for receiving consumer identity theft complaints and assisting victims. The Act defines identity theft broadly to include any knowing transfer, possession, or use of another person's identifying information without lawful authority and with intent to commit or facilitate a federal crime. Identity theft counsel should confirm whether the theft involves a federal crime warranting a referral to the FBI or Secret Service.

The Fair Credit Reporting Act gives identity theft victims the right to place a free fraud alert on their credit file that remains active for one year, requiring creditors to verify the consumer's identity before extending new credit. The FCRA also gives victims the right to block fraudulent information from their credit reports by submitting an identity theft report, and credit reporting agencies must block the information within four business days of receiving the request. Identity theft lawsuits and identity theft protection counsel should confirm whether the agencies complied with the four-day blocking requirement.

A victim's first step in identity theft protection is to file an identity theft report at IdentityTheft.gov, which creates a recovery plan and generates an official report for disputing fraudulent accounts. A credit freeze prevents credit reporting agencies from releasing a consumer's credit report to potential new creditors and is the most effective identity theft protection tool for preventing new fraudulent accounts. Consumer protection law counsel should confirm whether the credit freeze is in place at all three major bureaus.

Once an identity theft report has been filed, victims have the right under the FCRA to dispute fraudulent accounts with each creditor and with the credit reporting agencies that included them in the credit file. If a creditor or credit reporting agency refuses to correct a fraudulent account after a proper identity theft dispute, the victim has a private right of action under the FCRA to sue for actual damages, statutory damages, and attorney fees. Consumer protection disputes and identity theft protection counsel should confirm whether the creditor verified its records before refusing to correct the fraudulent account.

When a corporate data breach exposes consumer personally identifiable information, the company whose negligent security practices allowed the breach may face civil liability under state notification laws, state consumer protection statutes, and the FTC Act. Class action lawsuits following corporate data breaches have resulted in settlements requiring companies to fund credit monitoring, identity theft protection services, and direct payments to affected consumers. Data breach litigation and identity theft protection counsel should confirm whether the company complied with state breach notification law.

Federal law limits a consumer's liability for unauthorized credit card transactions to fifty dollars per card when the theft is reported promptly, and most credit card issuers waive even this amount under zero-liability policies. Debit card fraud liability under the Electronic Fund Transfer Act is higher: reporting within two business days limits liability to fifty dollars, but delayed reporting can expose the consumer to five hundred dollars or more. Credit card fraud and identity theft protection counsel should confirm whether the charges are disputed under the correct legal framework.

A victim who sues under the FCRA for a credit reporting agency's failure to correct identity theft errors can recover actual damages, statutory damages between one hundred and one thousand dollars per willful violation, and attorney fees. Victims may also sue under the Identity Theft and Assumption Deterrence Act, state identity theft statutes, and common law fraud theories, depending on which parties were negligent and what specific harm resulted from the theft. Identity theft penalties and identity theft protection counsel should confirm which federal and state statutes provide a private right of action for the specific misconduct.

Full recovery from identity theft requires systematic removal of all fraudulent accounts from all three credit reports, which may require repeated disputes if agencies fail to block the information within the statutory timeframe. An extended fraud alert, combined with a credit freeze and regular credit monitoring, provides ongoing identity theft protection while the victim works through the recovery process. Consumer data protection and identity theft protection counsel should confirm whether all fraudulent accounts have been removed from the credit file.