FCRA 605B: Block Identity Theft in 4 Days

Most people fighting identity theft use the wrong tool. They send a standard dispute letter, wait 30 days, and get the account verified back onto their report by the same company that created it.

There is a faster route written into federal law, and almost nobody uses it.

Section 605B of the Fair Credit Reporting Act, codified at 15 U.S.C. 1681c-2, requires a credit bureau to block fraudulent information within 4 business days. Not investigate it. Block it.

This guide covers what triggers that deadline, what the four required items actually are, and what to do when a bureau or a creditor stalls.

What 605B actually says

The operative sentence is short. A consumer reporting agency shall block the reporting of any information in a consumer’s file that the consumer identifies as information resulting from an alleged identity theft, not later than 4 business days after the date of receipt of four things.

Those four things are the whole ballgame:

1. Appropriate proof of the identity of the consumer
2. A copy of an identity theft report
3. The identification of such information by the consumer
4. A statement by the consumer that the information is not information relating to any transaction by the consumer

Miss one and the clock never starts. Send all four and the bureau has 4 business days.

That is the entire mechanism. It is not discretionary and it is not an investigation.

Why this is different from a normal dispute

People conflate the two constantly, and the difference is the reason 605B is worth learning.

	Section 611 dispute	Section 605B block
What it starts	A reinvestigation	A mandatory block
Deadline	30 days, 45 if you add information mid-stream	4 business days
Who decides the outcome	The furnisher, by verifying or not	The statute
Can the creditor push back	Yes, by verifying the account	It must stop reporting once notified
What you must supply	A reason the item is wrong	The four items above

A normal dispute asks a question. A 605B block issues an instruction.

That is why a fraud victim who files a plain dispute often loses. The furnisher checks its own records, sees an account it believes it opened legitimately, verifies it, and the item stays. The fact that a thief opened it is exactly what the furnisher does not know.

The four items, one at a time

1. Appropriate proof of identity

The bureaus each publish what they accept. In practice this is a copy of a government issued photo ID plus something tying you to the address on file, such as a utility bill or bank statement. Send copies, never originals.

If you have moved recently, include proof for both the old and new address. Address mismatches are the single most common reason a package gets bounced back as incomplete, and a bounced package means the 4 day clock never started.

2. A copy of an identity theft report

This is the item people get wrong, because “identity theft report” is a defined term in the FCRA and not a plain English phrase.

An Identity Theft Report generated at IdentityTheft.gov satisfies it. The FTC states plainly that this report is an official report to law enforcement and is sufficient documentation to resolve issues with the credit bureaus and most companies.

You do not automatically need a police report. Get one anyway if any of these apply:

• You know who the thief is, or you have a suspect
• A specific company is refusing to move without one
• You want an extended fraud alert, which lasts 7 years and requires a police report, rather than the initial alert, which lasts 1 year

See how to file a police report for identity theft for what to bring and what to ask for, and Identity Theft Report vs police report for which one each company will actually accept.

3. Identification of the information

You have to point at the specific items. “Everything fraudulent on my report” is not identification.

For each account, give the creditor name, the account number as it appears on the report, the date opened, the balance shown, and where it appears on the report. If a fraudulent account produced a hard inquiry, name that inquiry separately.

Pull all three reports first, because the fraudulent accounts are rarely on all three, and each bureau only blocks what is in its own file.

4. A statement that the information is not yours

One sentence, signed. It has to say the information does not relate to any transaction by you.

This is not a formality. It is the sworn element, and it is why the next section matters.

The line you cannot cross

605B is powerful because it is close to automatic. That is also why the statute has teeth pointed back at you.

A bureau may decline or rescind a block where the block was based on a material misrepresentation of the facts, or where the consumer obtained goods, services, or money as a result of the blocked transaction.

In plain terms: this process is for accounts a thief opened. It is not a way to erase an account you opened and cannot pay. Signing a statement that says an account is not yours when it is, is a false statement on a federal fraud filing, and it can carry consequences well past a credit score.

If the debt is genuinely yours, you are in a different conversation. Read how to fix bad credit fast instead, which deals with real debt honestly.

What happens after the block

Two things follow automatically, and both matter.

The bureau must notify the furnisher. It has to tell the company that reported the account that the information may be the result of identity theft and that an identity theft report has been filed.

The furnisher must stop. Once notified, it may not continue reporting that information. This is what stops the account reappearing next cycle, which is the usual failure mode with an ordinary dispute.

If the account comes back anyway, that is a separate and more serious violation, and it is worth documenting carefully. See what to do when a creditor will not remove a fraudulent account.

Realistic timing, start to finish

The 4 business day figure is real, but it starts when a complete package arrives, not when you start working on it. Here is where the time actually goes.

Stage	Typical time	What controls it
Pull all three reports, list every fraudulent item	1 day	You
File at IdentityTheft.gov, get the Identity Theft Report	Same day	You
Police report, if you need one	1 to 7 days	Your local department
Assemble and send three packages, certified	1 to 2 days	You
Mail transit	3 to 5 days	The post
Statutory block window	4 business days	The law
Updated reports reflect the block	A few days after	The bureau

So the honest answer to “how fast” is that the legal step is 4 business days and the rest is logistics. Getting a complete, correct package into the mail quickly is the entire skill.

How fast fraudulent accounts can be removed walks through the full sequence with the dependencies laid out.

What to do before you send anything

Do these first. They stop the bleeding while the block works its way through.

1. Place a fraud alert. One call to any one of the three bureaus, and it must tell the other two. Initial alert lasts 1 year and is free.
2. Consider a freeze. A freeze is stronger than an alert because it blocks new credit being opened at all. It is free, and you can lift it temporarily. See how to freeze your credit.
3. Get your reports from all three bureaus. Blocks are per bureau, and fraudulent accounts often appear on only one or two.
4. Write down a timeline. Dates you noticed, dates you called, who you spoke to. This becomes your evidence if you end up at the CFPB or in front of a lawyer.

When the bureau ignores you

It happens. The escalation path in order:

1. Resend, certified mail, return receipt. Most failures are the package being ruled incomplete. The receipt proves the date of receipt, which is the date the statute keys on.
2. File a CFPB complaint. This is free and it moves companies. See how to file a CFPB complaint against a credit bureau.
3. Talk to an FCRA attorney. The FCRA provides for actual damages, statutory damages, and attorney fees in successful actions, which is why many consumer attorneys take these cases without money up front.

After the fraud is gone

Blocking the fraudulent accounts restores your file to the truth. It does not by itself build a strong profile, and it is worth being clear about the difference.

Once the fraudulent items are blocked, what is left is your real credit history. If that history is thin or damaged, rebuilding is a separate project with its own timeline. Payment history and utilization are the two largest factors in most scoring models, and both take real time to move.

We cover the honest version of that in rebuilding credit after identity theft, including what authorized user tradelines can and cannot do.

The short version

• 605B gives you a 4 business day block, not a 30 day investigation
• It only starts when the bureau receives all four required items
• An IdentityTheft.gov report meets the identity theft report requirement for the bureaus
• A police report is still worth getting for an extended fraud alert or a stubborn company
• Once blocked, the furnisher may not keep reporting the information
• Never use it on an account that is actually yours

Credit Booster AI reviews all three of your reports, flags the items that look fraudulent, and drafts the paperwork each bureau needs, so the package that leaves your hands is complete the first time.