The federal rights a victim of identity theft can use to remove fraudulent accounts from a credit report, obtain the records of what the thief did, stop the debts being collected, and limit liability for the charges.
Identity theft leaves a victim with three practical problems: accounts and debts in their name that they did not open, a credit report that now describes them as a defaulter, and collectors who do not believe them. Federal law gives a specific remedy for each, and all of them run off one document - an identity theft report, which is a report made to the Federal Trade Commission or to a law enforcement agency, usually together with a sworn statement of the facts.
With that report a victim may require each credit bureau to block from their file any information that resulted from the theft, and the bureau must also tell the business that furnished it, which then may not report it again or sell or place the debt for collection. A victim may demand from any business that dealt with the thief the application and transaction records of the fraudulent account, so that the victim can see and prove what happened; the business must provide them to the victim and, on request, to law enforcement. A debt collector told that a debt arises from identity theft must pass the information to the creditor, and a creditor may not sell or transfer a debt it has been notified is the product of identity theft. Extended fraud alerts and credit freezes, which are separate tools, stop the thief opening more.
Liability for what the thief charged is limited by other federal statutes: for credit card charges the cardholder's exposure is capped at a small statutory amount and is zero once the loss is reported; for debit card and electronic transfers the cap depends on how quickly the loss is reported and can grow if it is not. Beyond that, whether a victim can be held to a loan, lease or account opened in their name by someone else is a question of state contract and fraud law, and the answer is generally no - but proving it is what the records right is for.
A victim should file the FTC identity theft report immediately, place a freeze or fraud alert, and send the block requests and records demands in writing with a copy of the report - the statutes work on paper and most victims can start them alone. A lawyer becomes necessary when a bureau or business refuses to honour the block, when a collector sues, or when the theft has reached a lease, a mortgage, a tax refund or a criminal record in the victim's name, each of which has its own procedure.
Choose your state. Each link opens the directory page for the city in that state with the most currently published law firms in this practice area; a +n beside the city is how many other cities in the state also have one. The list is generated when this page loads, so a state whose listings have lapsed drops out rather than becoming a dead link.