Credit Reports, Disputes and Fraud Protection

Your score can only be as good as the report it is calculated from, and that report is assembled by companies you never hired, from data sent by lenders who can make mistakes. Errors and fraud are both common enough that checking is worth a few minutes a year, and the strongest protection against new-account fraud is free. This chapter covers how to read your reports, how to get errors corrected, the difference between a freeze, a fraud alert and a lock, and what to do if someone opens credit in your name.

Your three reports, and how to get them free

Three national credit bureaus, Equifax, Experian and TransUnion, each keep their own file on you. Lenders do not always report to all three, so the files differ, and a lender may pull any one of them. That is why checking a single report, or a single score in an app, can miss a problem.

The free, federally authorized source is AnnualCreditReport.com. The three bureaus now let everyone download a free report from each of them every week there. Other sites that advertise "free reports" usually want to sell a subscription.

When you read a report, check:

• Personal details. Names, addresses and employers you do not recognise can be the first sign of a mixed file or of fraud.
• Accounts. Every account should be yours, with the right open date, limit, balance and status. Look closely at anything marked late, in collections or charged off.
• Inquiries. A hard inquiry from a lender you never applied to is a warning sign.
• Age of negative items. Most negative information must come off after seven years, and a Chapter 7 bankruptcy after ten. Older items still showing are errors.

Getting errors corrected

The Fair Credit Reporting Act gives you the right to dispute anything inaccurate or incomplete, free.

Dispute with each bureau that shows the error. All three accept disputes online, by phone and by mail. Be specific: which account, what is wrong, what it should say. Attach evidence, such as a statement showing an on-time payment or a letter confirming an account was paid. If you dispute by mail, certified mail gives you proof of the date.

Consider disputing with the lender too. The company that supplied the information, called the furnisher, also has a duty to investigate disputes sent to it directly. Fixing the source helps prevent the error from coming back.

Know the clock. A bureau generally has 30 days to investigate, extended to 45 in some cases, such as when you send more information during the investigation. It must tell you the result, and if anything changed, give you an updated copy of the report. Information that cannot be verified must be corrected or deleted.

If the result is wrong, you can add a brief statement to your file explaining your side, which lenders will see, and you can submit a complaint to the Consumer Financial Protection Bureau, which forwards it to the company and tracks the response. Keep copies of everything you send and receive.

You do not need to pay anyone to do this. Disputes filed by a credit repair company use the same process, and accurate information cannot be removed by anyone.

Freeze, fraud alert or lock

These three tools sound alike but work differently.

A security freeze blocks most new lenders from seeing your report, which stops most new-account fraud, since lenders will not open credit they cannot check. Since 2018 federal law has made freezes free at all three bureaus, and they last until you remove them. You place one at each bureau separately. When you want to apply for credit, you lift it temporarily online, often for a set number of days, then it returns on its own. A freeze does not affect your score, and your existing lenders can still see your report. Parents can also freeze a child's file, which protects a clean identity that fraudsters value.

A fraud alert tells lenders to take extra steps to verify your identity before opening an account. You place it with one bureau, which must notify the other two. An initial alert lasts one year. An extended alert, for confirmed identity theft victims with a report, lasts seven years. Members of the military can place an active-duty alert while deployed. An alert is weaker than a freeze because lenders can still see your report, but it does not need lifting when you apply for credit.

A credit lock is a product sold or offered by a bureau. It works much like a freeze, but its terms come from the bureau's contract rather than from federal law, and it may be bundled with a paid subscription. For most people, a free freeze does the same job.

Many people now simply keep all three files frozen and lift them for a few days before applying for a loan, a card or an apartment.

Monitoring: useful, but it only tells you afterwards

Credit monitoring sends an alert when something changes on a report: a new account, an inquiry, a late payment, a change of address. It shortens the time between fraud and discovery, which matters because the damage grows with every week a fraudulent account runs unnoticed.

But monitoring detects; it does not prevent. A freeze prevents most new-account fraud before it happens. Many banks, card issuers and the bureaus themselves offer basic monitoring free. Paid services add features such as monitoring of all three bureaus, insurance, or dark-web scans, and they are worth comparing on what you would actually use rather than on alarming statistics in the ads.

Two free protections outside the credit system cover gaps that a freeze does not:

• An IRS Identity Protection PIN. Anyone who can verify their identity can request one. It is a six-digit number required to file a return under your Social Security number, which blocks a thief from filing a fake return to collect your refund.
• Your own Social Security online account. Creating it at ssa.gov means nobody else can create one in your name.

If someone opens credit in your name

Act quickly and in order.

1. Report it at IdentityTheft.gov, the Federal Trade Commission's site. It produces an Identity Theft Report and a recovery plan with prefilled letters.
2. Freeze your files at all three bureaus, or place an extended fraud alert, so no further accounts can be opened.
3. Call the fraud department of each company where an account was opened or misused, and ask them to close it and confirm in writing that you are not responsible.
4. Ask the bureaus to block the fraudulent information. With an Identity Theft Report, the bureaus must block information resulting from identity theft, generally within four business days of accepting your request.
5. Change passwords on email and financial accounts, starting with your email, since it is how most other accounts are reset.

Keep a log of whom you contacted and when. Recovery can take weeks, and the record makes every later step easier.