California identity theft rights allow victims to challenge fraudulent accounts, protect credit reports, and respond to unauthorized debts. Under the Fair Credit Reporting Act (FCRA), consumers may request fraud alerts, block qualifying identity theft information, and obtain certain transaction records. California laws provide additional protections against inaccurate reporting and unlawful collection practices.
Key Takeaways
Under the FCRA, consumers can request a free initial fraud alert lasting one year.
Qualifying identity theft victims may request an extended fraud alert lasting seven years.
The FCRA generally requires credit bureaus to block qualifying identity theft information within four business days after receiving required documentation.
California identity theft victims with qualifying police reports may request additional free credit reports under state law.
Federal and California laws provide protections against certain unlawful debt collection practices and may allow remedies for qualifying violations.
What Are California Identity Theft Rights?
California identity theft rights are legal protections that help consumers respond when someone uses their personal information without authorization. These protections address fraudulent financial accounts, inaccurate credit reporting, and certain unlawful collection practices.
Identity theft may involve stolen Social Security numbers, fraudulent credit applications, unauthorized loans, or financial accounts opened in another person's name.
Consumers sometimes discover the fraud after receiving unexpected statements, collection notices, or credit application denials.
The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., provides important protections involving consumer credit information.
California also protects consumers through the Consumer Credit Reporting Agencies Act (CCRAA), California Identity Theft Act, and Rosenthal Fair Debt Collection Practices Act.
R23 Law is a consumer protection law firm in Los Angeles that represents California consumers in identity theft and related credit reporting matters.
R23 Law's California Consumer Protection Attorneys evaluate potential violations involving fraudulent accounts, inaccurate reporting, and unlawful debt collection activity.
What Should I Do Immediately After Discovering Identity Theft?
Start by documenting the fraudulent activity, reporting the identity theft, and protecting your financial accounts. These steps can help establish the fraud and support requests for credit reporting protections.
Step 1. Report Identity Theft to the FTC
Submit an identity theft report through the Federal Trade Commission at IdentityTheft.gov.
An FTC Identity Theft Report can document the fraud and support certain requests to credit reporting agencies and financial institutions.
Step 2. Consider Filing a Police Report
Depending on the circumstances, a police report may provide additional documentation.
In California, a qualifying police report may also support additional credit reporting rights under state law.
Step 3. Contact Affected Financial Institutions
Notify banks, creditors, and other financial institutions connected to the unauthorized activity.
Ask about procedures for reporting fraud and securing affected accounts.
Step 4. Preserve Supporting Records
Keep copies of fraudulent account statements, collection notices, identity theft reports, and communications with financial institutions.
These records may help establish what happened and when companies received notice.
How Do I Place a Fraud Alert on My Credit Report?
Contact Equifax, Experian, or TransUnion and request a fraud alert. Under the FCRA, the nationwide credit reporting agency receiving a qualifying request must notify the other two agencies.
A fraud alert instructs prospective creditors to take additional identity-verification precautions before approving certain credit requests.
Under FCRA § 605A, 15 U.S.C. § 1681c-1, consumers have access to different fraud alert protections.
Initial Fraud Alert: One Year
An initial fraud alert is available to consumers who reasonably suspect they have experienced or may experience identity theft or related fraud.
The alert lasts at least one year unless removed earlier at the consumer's request.
Consumers may request another initial alert if the risk continues.
Extended Fraud Alert: Seven Years
Qualifying identity theft victims may request an extended fraud alert lasting seven years.
This generally requires an identity theft report and appropriate proof of identity.
Extended alerts provide additional identity-verification protections for certain credit transactions.
A fraud alert does not automatically remove fraudulent accounts already appearing on a credit report.
Consumers can review the federal fraud alert provisions for the statutory requirements.
How Can I Obtain Free Credit Reports After Identity Theft?
Consumers can review reports from Equifax, Experian, and TransUnion through the authorized free credit report service. California also provides additional access rights for qualifying identity theft victims.
The Consumer Financial Protection Bureau's credit report guidance confirms that free weekly online reports are available from the three major nationwide credit reporting companies.
California Civil Code § 1785.15.3(b) provides an additional protection.
When the statutory requirements are satisfied, an identity theft victim who submits a qualifying police report may request up to 12 free copies of their credit file during the 12 months following the police report, not exceeding one copy per month.
When reviewing a report, investigate unfamiliar credit cards, loans, collection accounts, unauthorized inquiries, incorrect balances, and suspicious personal information.
Because credit reporting agencies may maintain different information, reviewing all three reports can help identify additional fraudulent activity.
How Do I Remove Fraudulent Accounts From My Credit Report?
Qualifying identity theft victims can request that fraudulent information be blocked from their credit reports. They may also dispute inaccurate information through the ordinary FCRA investigation process.
Under FCRA § 605B, 15 U.S.C. § 1681c-2, a consumer generally must provide:
Appropriate proof of identity.
A copy of an identity theft report.
Identification of the information resulting from identity theft.
A statement that the information does not relate to a transaction by the consumer.
When the statutory requirements are satisfied, the reporting agency generally must block qualifying information within four business days after receiving the required materials.
Statutory exceptions permit an agency to decline or rescind certain blocks.
Separately, FCRA § 611, 15 U.S.C. § 1681i, generally requires reasonable reinvestigation of qualifying credit reporting disputes within 30 days, subject to exceptions and extensions.
A reinvestigation is the reporting agency's review of disputed information to determine whether it is accurate, incomplete, or should be corrected or deleted.
An identity theft block and an ordinary credit reporting dispute are separate protections. Consumers may need to consider both procedures.
Can Debt Collectors Pursue Debts Created Through Identity Theft?
Debt collectors may contact consumers about accounts opened through identity theft, but federal and California laws restrict certain collection practices. Consumers can dispute fraudulent obligations and invoke applicable protections.
The Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692 et seq., regulates abusive, deceptive, and unfair debt collection practices by covered collectors.
Under FDCPA § 809, 15 U.S.C. § 1692g, a qualifying written dispute submitted within the statutory validation period generally requires a covered collector to stop collecting the disputed debt until the required verification is provided.
The statutory validation period generally runs for 30 days after the consumer receives the required notice.
Consumers may also submit written requests directing covered collectors to stop communications, subject to the exceptions in 15 U.S.C. § 1692c(c).
However, stopping communications does not automatically eliminate an alleged debt or prohibit every lawful collection remedy.
The FCRA also restricts certain reporting and transfers of qualifying identity theft debts after the required notifications.
California's Rosenthal Fair Debt Collection Practices Act, Cal. Civ. Code § 1788 et seq., provides additional protections concerning covered collection activity.
Can I Obtain Business Records Related to Identity Theft?
Qualifying identity theft victims may request records from businesses associated with fraudulent transactions. These records can help identify how unauthorized accounts were opened and used.
Under FCRA § 609(e), 15 U.S.C. § 1681g(e), covered businesses generally must provide qualifying application and transaction records within 30 days after receiving a proper request, subject to statutory requirements and exceptions.
These records may include credit applications, account-opening documents, transaction histories, and other qualifying business records.
The business may require identity verification and supporting documentation.
Obtaining these records can help consumers understand the fraudulent activity, support disputes, and evaluate potential legal claims.
What Is the Difference Between a Fraud Alert, Credit Block, and Debt Dispute?
These protections address different problems. A fraud alert helps protect against certain new credit transactions, an identity theft block addresses fraudulent credit reporting, and a debt dispute challenges an obligation being collected.
ProtectionPurposeGoverning lawInitial fraud alertAdditional identity verification for covered credit requestsFCRA § 605AExtended fraud alertLonger identity verification protections for qualifying victimsFCRA § 605AIdentity theft blockBlock qualifying fraudulent credit informationFCRA § 605BCredit report disputeInvestigate inaccurate or incomplete informationFCRA § 611Debt validation disputeChallenge a covered collector's demand for paymentFDCPA § 809Identity theft transaction recordsObtain qualifying records associated with fraudFCRA § 609(e)
These procedures are not interchangeable.
For example, placing a fraud alert does not automatically delete fraudulent credit accounts or prevent all collection activity.
Consumers should determine which protections address their circumstances.
What Additional Identity Theft Protections Does California Provide?
California provides additional protections involving consumer credit reporting, unauthorized use of identifying information, and covered debt collection activity.
The Consumer Credit Reporting Agencies Act (CCRAA), Cal. Civ. Code § 1785.1 et seq., regulates consumer credit reporting practices.
The California Identity Theft Act, Cal. Civ. Code § 1798.92 et seq., addresses certain unauthorized uses of personal identifying information and related transactions.
Depending on the violation, federal or California law may authorize actual damages, statutory damages, and attorney's fees.
Actual damages are losses or other compensable harm caused by a legal violation. Statutory damages are amounts permitted by law when specified requirements are satisfied.
Identity theft alone does not automatically establish liability against every creditor, debt collector, or credit reporting agency connected to an account.
How Can a California Identity Theft Attorney Help?
A California identity theft attorney can evaluate whether creditors, debt collectors, or credit reporting agencies complied with their legal obligations.
These matters can involve multiple fraudulent accounts, inaccurate credit reports, disputes, and repeated collection demands.
R23 Law evaluates potential FCRA, FDCPA, CCRAA, and California Identity Theft Act violations involving unauthorized debts and financial information.
Frequently Asked Questions
Does placing a fraud alert lower my credit score?
No. Placing a fraud alert does not itself lower your credit score. A fraud alert tells prospective creditors to take additional identity-verification steps before approving certain credit requests. It does not remove existing accounts or correct inaccurate credit information. Consumers can separately dispute fraudulent entries or request an identity theft block when eligible.
Can I place a fraud alert before proving identity theft occurred?
Yes. An initial fraud alert is available when a consumer asserts in good faith that they have been or may become a victim of fraud or identity theft. An extended seven-year fraud alert generally requires an identity theft report and appropriate identity verification. Both protections are governed by FCRA § 605A.
Is a fraud alert the same as a credit freeze?
No. A fraud alert requires additional identity verification for certain credit requests, while a security freeze restricts access to a consumer's credit file for specified purposes. Both are available without charge under applicable federal law. A security freeze may affect the processing of new credit applications until it is lifted or removed.
Do I need a police report to request an identity theft block?
Not necessarily. Federal law requires a qualifying identity theft report, which may be created through the FTC's reporting process when applicable requirements are satisfied. However, some California-specific protections, including additional monthly credit reports under Civil Code § 1785.15.3(b), require a qualifying police report or other specified investigative report.
Can I sue a company that refuses to correct fraudulent credit information?
Possibly. A consumer may have a legal claim when a covered company violates applicable reporting or dispute investigation requirements. The FCRA and California laws establish different duties and remedies. Whether a lawsuit is available depends on the conduct involved, the evidence, and the statutory requirements. Identity theft alone does not automatically establish liability.
Talk to R23 Law's California Consumer Protection Attorneys
California identity theft rights provide important protections when fraudulent accounts, inaccurate credit reports, or unauthorized debts affect your financial security. R23 Law's California Consumer Protection Attorneys evaluate potential statutory violations and available legal remedies. If identity theft has created unresolved financial problems, contact R23 Law to request a free case review.
Contact R23 Law Today
Phone: (888) 533-2948
Email: info@R23Law.com
Website: www.R23Law.com
Free case review: www.R23Law.com/contact
R23 Law, 633 W 5th St, Los Angeles, CA 90071
© 2026 R23 Law. All rights reserved.
Reviewed by Peng Shao, State Bar of California No. 319624. Last updated November 13, 2026.
Attorney Advertising. This article is general information, not legal advice, and reading it does not create an attorney-client relationship. Laws change and every case depends on its facts. Prior results do not guarantee a similar outcome.
