Credit Bureau Fraud Alert: How It Works

What a credit bureau fraud alert is

A credit bureau fraud alert is a request from a consumer that a notice be added to their credit file. Under the Fair Credit Reporting Act, while an alert is active, a business that uses a credit report must take reasonable steps to confirm that the person applying for credit is the consumer named in the file. Lenders commonly meet that duty by calling a phone number the consumer supplied or by asking additional identifying questions.

Everyday language uses several overlapping terms for this notice, including credit fraud alert, credit agency fraud alert, and fraud alert on credit report. They describe the same entry in a file. The phrase credit bureau fraud alert is also common, although the nationwide credit reporting companies are private businesses rather than government agencies; each keeps its own file, and an alert is recorded in each of those files separately.

An alert is not a finding that fraud occurred, and it does not remove or alter the accounts, balances, or inquiries already in a file. It is a temporary flag that travels with the file for the period federal law assigns, unless the consumer asks for it to be removed sooner or renews it.

The three kinds of fraud alerts

Federal law recognizes three alert types, each with its own duration and supporting documentation. The Fair Credit Reporting Act sets these terms, and the nationwide credit reporting companies apply them when a consumer files a request.

An initial fraud alert lasts one year. A consumer can request it without proving that identity theft has occurred, although the company verifies identity before adding it to the file. When the term ends, the consumer can renew it.

An extended fraud alert lasts seven years and requires an identity theft report, such as the report a consumer creates through IdentityTheft.gov. An active-duty alert is available to servicemembers who are away from their usual duty station; it also lasts one year and can be renewed.

• Initial fraud alert: one year, renewable, no identity theft report required.
• Extended fraud alert: seven years, requires an identity theft report.
• Active-duty alert: one year for qualifying servicemembers, renewable.

How an alert is placed across the three nationwide companies

A consumer does not need to contact all three nationwide credit reporting companies. Under the Fair Credit Reporting Act, a company that receives a fraud alert request must notify the other two, and all three then include the alert in the consumer's files. This single-contact rule is what makes one call or one written request sufficient.

Companies verify identity before adding an alert. A request typically includes full name, current and recent addresses, date of birth, and Social Security number, and a company may ask for documents such as a government-issued identification or a utility bill. Requests are accepted by mail, by telephone, and, at each company, online.

Placing a fraud alert is free under federal law. Consumers generally receive a confirmation letter from each company, and that letter includes instructions for renewing, extending, or removing the alert.

What a fraud alert does and does not do

The main effect of an alert is procedural. It tells anyone who pulls the report that the consumer has reported possible fraud or identity theft, and it obliges that business to use reasonable procedures to confirm identity before extending credit. A lender that cannot reach the consumer may delay or decline a pending application.

An alert does not lock a file. Businesses with a permissible purpose, such as a lender evaluating an application, a landlord screening a tenant, or an insurer, can still obtain the report, and a consumer can still obtain their own copy. The alert also does not prevent every fraudulent account; a thief who can answer the verification questions may still succeed, which is why an alert is described as one layer among several rather than a complete safeguard.

Because an alert expires, consumers who want to see what appears in their files can request reports from AnnualCreditReport.com, the site the nationwide companies operate jointly under federal law. Reviewing reports for unfamiliar accounts and inquiries is part of how identity theft is detected.

Fraud alert compared with a credit freeze

A credit freeze and a fraud alert work differently. A freeze restricts access to a credit file: a business generally cannot obtain the report until the consumer lifts the freeze, subject to exceptions such as existing creditors and certain government uses. An alert leaves the file accessible but adds a verification step before credit is extended.

Both are free, and both are filed with each nationwide company. A consumer can have a freeze and an alert at the same time. The distinction between a fraud alert and a credit freeze is a common question, and the comparison usually turns on whether a consumer wants access restricted or wants identity confirmation required.

A freeze is lifted with a personal identification number or password the company issues, while an alert is removed by written request or simply ends when its term expires. Removing one does not automatically remove the other.

Extended alerts, identity theft reports, and removal

The extended fraud alert is the version that lasts seven years, and it requires documentation that identity theft occurred. The Identity Theft Report generated at IdentityTheft.gov is designed for this purpose and is also used with police reports and creditors. The same report can support other steps in an identity theft recovery plan.

To remove an alert before it expires, a consumer writes to each company and provides proof of identity, such as a government-issued identification and a recent utility bill or bank statement. A company may also accept removal requests made through the same channels used to place the alert.

An initial alert that has expired can be renewed, and a consumer whose circumstances change can replace an initial alert with an extended one. Each company publishes the mailing address and toll-free number used for these requests.

Where a fraud alert fits in identity theft recovery

A fraud alert is one entry in a larger recovery process. Consumers who suspect identity theft commonly file a report at IdentityTheft.gov, obtain their credit reports, dispute information that is not theirs, and weigh a freeze alongside an alert. The Federal Trade Commission publishes a step-by-step recovery plan, and the Consumer Financial Protection Bureau answers questions about fraud alerts, freezes, and dispute rights.

Documents matter. Keeping copies of the identity theft report, any police report, alert confirmation letters, and correspondence with creditors helps when a consumer needs to show that a specific account is not theirs.

An alert stays on the file only for its statutory term, and it does not decide any application on its own. Lenders apply their own underwriting criteria, and the alert simply requires them to confirm identity first.

Common questions about alerts and files

Consumers often ask whether an alert changes how a file is scored. Scoring models use the account and inquiry information in a file, and an alert is a separate statement about the consumer; the alert itself does not add or subtract a score value.

Others ask how long they must keep paperwork. Since an extended alert runs for seven years and lenders may revisit identity questions later, retaining the identity theft report and confirmation letters for the life of the alert is a practical record-keeping step.

Questions about removal usually follow an alert that has served its purpose. A written request with proof of identity ends the alert early, and otherwise the entry falls off automatically at the end of its statutory term.