Identity theft, in the order that actually works

Each provision covered elsewhere on this site does one job. This page is about sequence, because the order genuinely matters and the intuitive order is not the effective one.

The mistake almost everyone makes

Discovering fraud, people go straight to disputing the accounts.

An ordinary dispute is the weakest available tool here. It routes to the furnisher, which checks its records, finds a real account, and verifies it. Meanwhile the fraud continues, because nothing has been locked, and any deletion you win can be undone by the next data feed.

The identity theft provisions are stronger, faster, and mostly unused.

The order

1. Stop the bleeding — initial fraud alert

One call. Under § 1681c-1(a) an initial alert lasts not less than 1 year, and the agency must refer the information to the other nationwide agencies — so one call propagates.

Do this first because it takes ten minutes and buys a year of friction against new accounts while you work out what happened.

2. Find out what actually happened — get all your reports

You cannot make specific assertions about accounts you have not identified precisely, and every later step requires specificity.

Get all three, and consider the specialty agencies too — tenant, check-writing, employment, insurance, medical. See the other credit bureaus nobody checks. Fraud does not confine itself to credit cards.

List every fraudulent item: creditor, account number as shown, date opened, amount.

3. Get the report — Minnesota takes it where you live

Under Minn. Stat. § 609.527, subd. 5, your local agency takes the report where you reside, regardless of where the crime occurred, and gives you a copy. Bring your list.

The FTC’s IdentityTheft.gov is the federal route and can run in parallel. See the police report Minnesota requires.

This step gates everything after it. Nothing below starts without it.

4. Lock the files — freeze all three

Under § 1681c-1(i) a freeze is free and lasts until you remove it; placement 1 business day by phone or secure electronic means, and removal in 1 hour by the same route. Minnesota’s own provisions are at Minn. Stat. § 13C.016 — see Minnesota’s security freeze rules.

Freeze after you have your reports, because a freeze can complicate getting them.

If you have children, freeze theirs too. Minn. Stat. § 13C.10 lets a representative freeze the file of a person under 16, and requires the agency to create a record if none exists.

5. Block the items — the four-business-day route

Under § 1681c-2(a), the agency must block within 4 business days of receiving all four submissions: proof of identity, a copy of an identity theft report, identification of the information, and a statement that it does not relate to any transaction by you.

All four, or the clock does not start. See the four-business-day identity theft block.

6. Turn off the source — tell each furnisher

This is the step that stops items reappearing.

Under § 1681s-2(a)(6), an identity theft report submitted to the furnisher at the address that furnisher specified for receiving such reports means it may not furnish that information to any agency, unless it later knows or is told by you that it is correct. The same paragraph requires furnishers to have procedures preventing refurnishing of blocked information.

Block alone leaves the tap running. See telling the furnisher it was identity theft.

7. Get the evidence — demand the records

Under § 1681g(e), the business must provide the application and transaction records within 30 days, free. The application shows what address, phone, and signature were used. See the records an identity theft victim can demand.

8. Consider the extended alert

Under § 1681c-1(b), an extended alert requires an identity theft report and lasts 7 years, excludes you from prescreened offer lists for 5 years, and gives you two free file disclosures in the first 12 months.

9. Verify, then verify again

Pull your reports at 30 days, 90 days, and 6 months. Reinsertion is real and is the reason step 6 exists. See when a deleted item comes back.

Keep every document, dated. See building a record that holds up.

Why the order

• Alert before reports — it is instant and buys time.
• Reports before the police report — you cannot list what you have not identified.
• Police report before everything federal — four provisions require it.
• Reports before freezing — freezing first complicates retrieval.
• Block and furnisher notice together — one addresses the file, the other the source.
• Records demand early — 30 days is a long time, and the records may change what you say later.

The caution that belongs at every step

From step 3 onward you are making formal written statements that specific transactions were not yours. Section 1681c-2(c) permits a block to be declined or rescinded on a material misrepresentation of fact, and a false report to law enforcement has consequences beyond a credit file.

Where an account is plainly not yours, these provisions were built for exactly that and this sequence is the efficient way through them.

Where the facts are complicated — a relative, a former partner, an account you were once aware of, a business you had some involvement in — whether this route fits is a real legal question. Ask it before step 3, not after.