The records an identity theft victim can demand from the business

Most identity theft advice stops at the credit bureaus — dispute it, block it, freeze your file. There is a further right that is used far less and is often more useful: going directly at the business that opened the account.

The right

15 U.S.C. § 1681g(e) requires a business entity, on a victim’s request meeting the statutory conditions, to provide copies of application and business transaction records evidencing a transaction alleged to be the result of identity theft —

not later than 30 days after the date of receipt of a request from a victim in accordance with paragraph (3)

— and at no charge.

Think about what that is. The application someone filed in your name. The records of the transactions on the account. The paperwork the business relied on.

What you have to supply

The statute conditions the request. You provide:

• Proof of identity — a government-issued identification card, personally identifying information of the type the business ordinarily requests from a new applicant or for a new transaction, or comparable information.
• Proof of the claim of identity theft — a copy of a police report evidencing the claim, or a properly completed affidavit of the type the Bureau has developed and made available.

The provision also addresses where the request goes and permits the business entity to require it in writing at a specified address.

Why the records matter more than they look

They show what was actually submitted. An address that was never yours, a phone number, an email, an employer, a signature that is not remotely your handwriting. That is evidence of fraud in a form nobody can argue with.

They show what the business did or did not check. Whether identification was requested, what was accepted, whether anything was verified.

They are contemporaneous and cannot be reconstructed. Unlike your own recollection, these are the business’s records made at the time.

They frequently identify the thief, or narrow it considerably — particularly where it turns out to be someone who knew your details.

How this fits with the block

Section 1681g(e) is not a substitute for the four-business-day block under § 1681c-2. They do different jobs and run in parallel:

• The block addresses the credit file — it stops the item being reported.
• The records request addresses the underlying account — it gets you the evidence.

Both are triggered by the same underlying documentation, so if you have assembled an identity theft report for one, you are most of the way to the other.

There is a sequencing argument for doing the records request early. The block is fast and can be declined or rescinded under § 1681c-2(c), including on the basis of a material misrepresentation of fact. Having the business’s own records in hand before making assertions about a transaction is a good way to make sure the assertions are right.

A caution worth repeating

This route, like the block, involves making formal statements — potentially under oath, potentially to law enforcement — about transactions you say were not yours.

If the facts are simple and the account is plainly not yours, this is a strong statutory tool aimed at exactly that situation.

If the facts are complicated — a family member, a former partner, an account you were once aware of, a business you had some involvement with, goods that ended up in your possession — then whether this is the right route is a genuine legal question rather than a form-filling exercise. Section 1681c-2(c)(B) and (C) exist precisely for those cases, and the consequences of a false identity theft report reach well beyond a credit file.

Practical

1. Identify the exact business entity on the account. The name on the tradeline may be a servicer or a buyer rather than the entity that opened it.
2. Assemble your proof of identity and your identity theft report — the same package the block needs.
3. Send the request in writing, to the address the business specifies, and keep proof of delivery.
4. Diary 30 days.
5. Keep whatever comes back with everything else. See building a record that holds up.

We do not tell you whether your situation is identity theft in the statutory sense, and we do not evaluate documents. What is general is that this right exists, that most victims never use it, and that the records are often the most persuasive thing in the file.