Title 15 › Chapter CHAPTER 41— - CONSUMER CREDIT PROTECTION › Subchapter SUBCHAPTER III— - CREDIT REPORTING AGENCIES › § 1681c–1
Credit reporting companies must put fraud alerts or active-duty alerts on your credit file when you ask and prove who you are. An initial fraud alert lasts at least 1 year and lets you get a free copy of your file; the company must tell you this and must give required disclosures within 3 business days after you ask. If you submit an identity-theft report, you can get an extended fraud alert that lasts 7 years, and the company must keep you off unsolicited credit/insurance marketing lists for 5 years; you may get two free files in the first 12 months and the same 3-business-day disclosure rule applies. Active-duty military alerts last at least 12 months (longer if the Bureau sets a longer period), and the company must keep you off marketing lists for 2 years. Alerts are shared with the other major credit bureaus and come with any credit score produced from the file. When an initial or active-duty alert is shown, businesses must have reasonable procedures to verify a person’s identity before opening most new accounts; if you gave a phone number for verification, they must call or otherwise confirm before approving certain new credit. For extended alerts, businesses must contact you in person or by your chosen contact method to confirm applications are not fraud. A security freeze (which stops new-credit checks for new accounts) must be placed free when you ask and show proper ID: within 1 business day for phone or secure online requests and within 3 business days for mail. The bureau must confirm the freeze and explain how to remove it within 5 business days. You can have a freeze lifted temporarily or removed: by phone/online it must be lifted within 1 hour, or within 3 business days if by mail. Freezes do not block certain uses (like companies you already have accounts with, government agencies with legal authority, child-support agencies, debt collectors, insurers, employers for screening, identity verification unrelated to credit, or services you subscribe to). Credit bureaus must have easy procedures and a webpage to request freezes and alerts (not the only way), and the FTC must host a central link page. Credit monitoring: if you prove you are on active duty and give contact info, the bureaus must provide a free electronic monitoring service that alerts you to major changes; the FTC had to write rules for this within one year after May 24, 2018. Definitions in this part: consumer reporting agency — a credit bureau; protected consumer — someone under 16 or an incapacitated person with a guardian; protected consumer’s representative — a person with authority to act for that protected consumer; record — a file made only to follow these rules; security freeze — the block on releasing a file for new-account credit checks; sufficient proof of authority — court order, power of attorney, birth certificate, or foster-care document; sufficient proof of identification — SSN, certified birth certificate, or government photo ID.
Full Legal Text
Commerce and Trade — Source: USLM XML via OLRC
Legislative History
Reference
Citation
15 U.S.C. § 1681c–1
Title 15 — Commerce and Trade
Last Updated
Apr 6, 2026
Release point: 119-73