What the law actually gives you
The Fair Credit Reporting Act’s identity theft provision — 15 U.S.C. § 1681g(e) — was written to solve one specific problem: victims need proof that a fraudulent account isn’t theirs, and the only place that proof exists is inside the company the thief used. Here’s what that means for you.
01
You can request the actual paper trail
The application the thief signed, statements, invoices, shipping addresses, and other business records tied to the fraudulent account — not just a summary or a denial letter.
02
It applies to almost any business
Any company that extended credit, sold goods or services, took a payment, or otherwise transacted with the person impersonating you — retailers, lenders, phone carriers, utilities, online marketplaces.
03
They have 30 days, and it must be free
Once the business receives your written request (and confirms your identity), the clock starts. They cannot charge you a fee to produce these records.
04
You’ll need to verify who you are
Expect to provide a government-issued ID, personal details matching what the thief used, and often an identity theft affidavit or police report. This protects you too — it keeps your records from going to the wrong person.
05
“Privacy” isn’t a valid excuse to refuse
A business cannot cite privacy or data-security policies as a reason to withhold these records from the actual victim. That refusal is itself a violation of the statute.
06
You can route records to law enforcement
You’re allowed to direct the business to send the records straight to a law enforcement officer investigating the theft, instead of or in addition to sending them to you.
Why this matters right now: In 2026, the FTC took enforcement action against a major online retailer for routinely refusing these exact requests, citing “security” concerns as a excuse. The business paid a multimillion-dollar penalty. The right isn’t theoretical — regulators are actively enforcing it.
Knowing your rights is only the first step. Many businesses comply with these requests, but not all do. If a company refuses to provide the records you’re entitled to, federal law may give you additional legal rights.
Frequently Asked Questions
Do I need an identity theft report before sending this letter?
It’s a good idea. An identity theft report from IdentityTheft.gov is often sufficient and provides documentation many businesses request. Some businesses may also ask for a police report or additional proof of your identity.
How should I send the request?
We recommend sending your completed request using a method that provides proof of delivery, such as certified mail or another trackable delivery service. Keep copies of everything you send for your records.
Is this the same as disputing my credit report?
No. A credit report dispute is sent to the credit reporting agencies. This request is sent directly to the business that opened or maintained the fraudulent account so you can obtain the underlying records related to the identity theft.
You Have the Right to These Records. If a Business Refused, You May Have a Legal Claim.
If a company denied your request for identity theft records, ignored your written request, or claimed it couldn’t provide the documents because of “privacy” or “security” concerns, that may be more than frustrating—it may be a violation of federal law.
At Francis Mailman Soumilas, P.C., we represent consumers nationwide in Fair Credit Reporting Act litigation, including cases involving identity theft and businesses that fail to comply with their legal obligations.
If a company’s refusal has made it harder to clear your name, dispute fraudulent accounts, or recover from identity theft, we’ll evaluate whether its actions may have violated your rights.
Start your free case review today. If you have a potential claim, we’ll explain your options and the next steps.
