Fraudulent Auto Loan on Your Credit Report: Get It Blocked

Yes, it comes off. File an FTC Identity Theft Report, send it with proof of identity to Equifax, Experian and TransUnion, and each bureau must block the fraudulent auto loan within 4 business days of receiving a complete request. The bureau then notifies the lender, the loan drops off your report, and the lender loses the right to sell the debt or hand it to a collector. Your first move today: pull all three credit reports and file the FTC report at IdentityTheft.gov with the lender's name and the account number.

How a 605B block works

Section 605B of the Fair Credit Reporting Act gives identity theft victims a block, a faster tool than an ordinary credit dispute. Each bureau acts once it has four things from you: proof of identity, a copy of your identity theft report, the account you want blocked, and your statement that the loan is not from any transaction you made. The bureau then notifies the lender of the identity theft claim, your report, the block request and the dates the block takes effect.

Four rules work for you:

• The loan stays off. A lender that gets a block notice needs procedures that keep it from sending the blocked loan back to the bureaus.
• No collector. After that notice, the lender is barred from selling the debt, transferring it for value or placing it for collection.
• Your own notice stops the reporting. When your identity theft report reaches the address the lender designates for those reports, the lender has to stop furnishing the loan to every bureau unless it later learns the information is correct.
• You get the file. Within 30 days of a written request, any business that extended credit or sold goods to the thief must send you its application and transaction records, free. That covers the lender and the dealer, which usually took the credit application and sold the contract to the lender. Either one can first require proof of identity, a police report and an affidavit; your FTC Identity Theft Report serves as the affidavit.

A bureau or lender has 15 days after your report arrives to ask for more proof, and another 15 days after that request to decide, or 5 days after your answer if it arrives on day 11 or later of that window. When all it has is an automated report with a bare allegation, it can ask for a notarized identity theft affidavit and ID. A police report that describes the theft and carries the officer's name or badge number counts as enough on its face, which is why step 3 below is worth the trip.

What to do today

1. Pull all three credit reports. They are free every week at AnnualCreditReport.com or 1-877-322-8228. On each report that shows the loan, write down the lender, account number, open date and balance.
2. File the FTC Identity Theft Report at IdentityTheft.gov or by calling 1-877-438-4338. Name the lender, the dealer if you know it, the account number, when the loan was opened and how you found it. Create an account, or print the report and recovery plan before you leave the page: without an account, you lose access to them.
3. File a police report with your local police. Bring the FTC report, photo ID, proof of address such as a lease or utility bill, and any letters about the loan, and leave with a copy and the report number.
4. Freeze your credit at all three bureaus so no one opens a second loan in your name: Equifax (888-298-0045), Experian (888-397-3742) and TransUnion (800-916-8800). A freeze is free, starts within one business day of an online or phone request, and lifts within an hour of one when you apply for credit yourself. At one bureau, also add an extended fraud alert using your FTC report; it lasts 7 years, and that bureau passes it to the other two.
5. Mail a block request to each bureau that shows the loan. Enclose the FTC report, the police report, a copy of your driver's license or other government ID, the report page with the loan circled, and a short letter that names the account, states that the loan does not come from any transaction you made, and asks for a block under section 605B. Addresses: Equifax, P.O. Box 105069, Atlanta, GA 30348-5069; Experian, P.O. Box 9554, Allen, TX 75013; TransUnion Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19016. Use certified mail with a return receipt.
6. Call the lender's fraud department, then write. Say an identity thief opened the loan, and get the mailing address it uses for identity theft reports. Mail the letter below there with its enclosures, including a printout of the Notice to Furnishers of Information.
7. Request the dealer's records. Get the dealer's name from the lender and send the dealer the letter below with only the records request.

Where it splits

If a collection agency contacts you

Write to the collector within 30 days of getting its first collection letter, say the debt came from identity theft, and enclose your FTC report and proof of identity. A collector that gets a written dispute in that window must stop collecting until it mails you verification of the debt. Once told the debt is identity theft, it must pass that on to the lender and, if you ask, give you the same debt details it owes anyone who disputes the debt. If the collection account shows on your reports, add it to your block requests. If you live in Texas, see our guide to Texas debt collection laws.

If a bureau refuses the block or the loan comes back

A bureau can decline or lift a block when it reasonably finds the request was made in error, rested on a material misrepresentation, or that you got the car, money or services from the loan, and it has to tell you promptly. Answer with a regular dispute under section 611 at each bureau showing the loan, attaching the police report, the lender's findings and the dealer's records. The bureau has 30 days to reinvestigate, or up to 45 if you send relevant new information during the first 30. It forwards your dispute to the lender, which must investigate and modify, delete or permanently block anything it finds inaccurate or cannot verify.

If you are sued over the loan

Respond by the deadline in the court papers, yourself or through a lawyer, and raise the identity theft in your response. A missed deadline lets the court enter a default judgment for what the lender claims, and a judgment is hard to undo once the case is over.

What you can get and your leverage

• FCRA damages: A bureau that ignores a proper block request, or a lender that fails a forwarded dispute, is liable for your actual damages for a negligent violation. A willful violation costs actual damages or $100 to $1,000 in statutory damages, plus punitive damages. Either way the company pays your attorney's fees when you win. Sue within 2 years of discovering the violation and within 5 years of the violation itself. Duties your direct letter to the lender triggers are enforced only by regulators, so keep the bureau disputes going.
• FDCPA damages: A collector that keeps collecting after your written dispute is liable for your actual damages, up to $1,000 more, and your attorney's fees.
• CFPB complaint: File against the bureau, the lender or the collector at the CFPB complaint portal. Companies generally respond within 15 days.

Call a consumer protection lawyer if the loan is still on any report a month after your block request or a collector keeps calling after your dispute.

Letter to the lender

[Date]

[Your name], [your address]

[Lender name], [Fraud or Identity Theft Department], [address the lender gave for identity theft reports]

Re: Account [number]: identity theft report and request for records

I am a victim of identity theft. The auto loan above, opened on [date] through [dealer name] for a [year, make, model, VIN if known], was taken out in my name without my knowledge or permission. I never signed the contract and never received the vehicle or any money from it.

Enclosed are my FTC Identity Theft Report (number [number]), police report [number], a copy of my [driver's license], my credit report with this account circled, and the Notice to Furnishers of Information.

Please:

1. Stop furnishing this account to every credit bureau, as FCRA section 623(a)(6)(B) requires.
2. Close the account, release me from it, and end all collection, including any sale or assignment of the debt.
3. Under FCRA section 609(e), send me copies of the credit application, the signed contract, the identification and income documents submitted, every address and phone number on the account, and the payment records.
4. Confirm in writing that the account is not mine, that I owe nothing on it, and that you have asked each bureau to delete it.

[Signature]

Today

1. Pull your three reports and file the FTC report.
2. Freeze your credit at all three bureaus.
3. File the police report, then mail the bureau block requests and the lender letter.

What comes back: freeze confirmations, each bureau's answer to your block request or its request for more proof, and the lender's written findings with the application file that shows who applied in your name. Pull your reports again once the block window has passed; any bureau still showing the loan gets the dispute and the complaint above.