Identity Theft Rights
Written in plain language for general understanding. This is educational content, not legal advice. Based on federal statutes and official sources.
What is this right?
If someone uses your personal information — your Social Security number, credit card number, or other identifying data — to open accounts, make purchases, or commit fraud in your name, you are a victim of identity theft. Federal law gives you specific rights to recover.
Under the Fair Credit Reporting Act (FCRA) and the Identity Theft and Assumption Deterrence Act, you can place fraud alerts and credit freezes on your credit reports for free, dispute fraudulent accounts, and get fraudulent debts blocked from your credit report. The FTC's IdentityTheft.gov website walks you through a personalized recovery plan.
When does it apply?
This right applies when:
- You discover accounts, loans, or credit cards opened in your name that you did not authorize
- You receive bills or collection notices for debts you do not owe
- You find unfamiliar charges on your bank or credit card statements
- You are denied credit, a job, or insurance due to information on your credit report that is not yours
Common misconceptions:
- "Identity theft only happens online" — It also happens through stolen mail, lost wallets, data breaches, and even people you know accessing your information.
- "I'm responsible for debts opened in my name by a thief" — No. Under federal law, you are not liable for fraudulent debts. You have the right to dispute them and have them removed from your credit report.
- "A fraud alert and a credit freeze are the same thing" — No. A fraud alert tells lenders to verify your identity before opening new accounts. A credit freeze completely blocks access to your credit report, which is stronger protection.
What should you do?
Step 1: Go to IdentityTheft.gov (the FTC's official site) and report the theft. The site creates a personalized recovery plan and generates an Identity Theft Report, which gives you specific legal rights.
Step 2: Place a fraud alert on your credit report by contacting any one of the three major credit bureaus (Equifax: 800-525-6285, Experian: 888-397-3742, TransUnion: 800-680-7289). That bureau must notify the other two. An initial fraud alert lasts one year.
Step 3: Place a credit freeze with all three bureaus. A freeze is free and blocks anyone from opening new accounts using your credit report. You can temporarily lift it when you need to apply for credit.
Step 4: File a report with your local police department. Bring your FTC Identity Theft Report, proof of your identity, and evidence of the fraud. A police report strengthens your disputes with creditors.
Step 5: Contact each company where fraudulent accounts were opened. Send them your Identity Theft Report and a letter disputing the account. Under federal law, they must stop collection efforts and investigate.
Step 6: Dispute fraudulent information on your credit reports with all three bureaus. Include your Identity Theft Report. The bureaus must block the fraudulent information within 4 business days.
What should you NOT do?
Don't delay. The sooner you act, the less damage the thief can do. File your FTC report, place your fraud alert, and freeze your credit as soon as you discover the theft.
Don't pay debts you did not create. Even if a collector is pressuring you, you are not responsible for fraudulent accounts. Dispute them formally using your Identity Theft Report.
Don't give personal information to anyone who contacts you claiming to be from a bank or credit bureau. Scammers sometimes pose as fraud departments. Always call the company directly using the number on their official website or your card.
Don't forget to check your credit reports regularly after the theft. Identity thieves may try again. Monitor your reports for at least a year, and consider keeping your credit frozen until you need to use it.
How California differs from federal law
California was a pioneer in identity theft protections and offers some of the strongest laws in the nation:
- California Identity Theft Remedy (Cal. Civ. Code § 1798.92 et seq.): Gives victims the right to obtain an "identity theft passport" from the California DOJ, which serves as proof of identity theft status when dealing with creditors and law enforcement.
- Data breach notification: California was the first state to pass a data breach notification law (Cal. Civ. Code § 1798.82). Companies must notify California residents when their personal information is exposed.
- California Consumer Privacy Act (CCPA) / CPRA: Gives consumers the right to know what personal data companies collect, to delete it, and to opt out of its sale. This reduces the amount of data available for identity thieves.
- Five-year right to reports: California allows identity theft victims to obtain copies of fraudulent applications and transaction records from creditors for up to 5 years after the theft (Cal. Pen. Code § 530.8).
Additional Steps in California
Apply for an identity theft passport through the California Attorney General's office at oag.ca.gov. File a report with your local police department and include a copy of your FTC Identity Theft Report. Contact the California DFPI at (866) 275-2677 for financial account issues.
Relevant Law: California Civil Code § 1798.92 et seq. (Identity Theft Remedy), Cal. Civ. Code § 1798.82 (data breach notification), Cal. Pen. Code § 530.8 (right to records)
Legal Resources
We may earn a commission if you use these services — at no extra cost to you. This supports our mission to make legal information free for everyone.