15 U.S.C. 1681c-2: the 4-day identity-theft block

The short answer. If a fraudulent account is sitting on your credit report, the Fair Credit Reporting Act (FCRA) gives you a tool that is faster and more surgical than a generic dispute: under 15 U.S.C. 1681c-2, a consumer reporting agency (a credit bureau) must block, meaning stop reporting, the information that resulted from identity theft within four business days of receiving four specific items from you. Not “investigate.” Block. The catch is that you have to hand over all four items, in the right form, before the clock even starts.

This statute is titled “Block of information resulting from identity theft,” and it is one of the least understood corners of the FCRA, partly because most online guides blur it together with credit freezes, fraud alerts, and ordinary disputes. Those are four different instruments with four different jobs. Getting the routing right is most of the battle, so this guide walks through exactly what 1681c-2 requires, what the bureau must do in return, when it is allowed to say no, and how to tell whether the block is even the right tool for your situation.

The four items that start the 4-day clock

Subsection (a) of 1681c-2 is a checklist, and it is unforgiving in the sense that the bureau has no obligation to act until every box is ticked. You must give the credit bureau all four of the following:

1. (a)(1) Appropriate proof of the identity of the consumer. The bureau has to know it is really you, typically through identifying documents it specifies.
2. (a)(2) A copy of an identity theft report. This is a defined term, discussed below, and it is the item people most often get wrong.
3. (a)(3) The identification of such information by the consumer. You point to the specific items, line by line, that you say are fraudulent. A vague “everything is wrong” does not satisfy this.
4. (a)(4) A statement by the consumer that the information is not information relating to any transaction by the consumer. In plain terms, you affirm that you did not make these transactions.

Once the bureau receives all four, the four-business-day deadline runs. The reason this matters: a generic dispute carries no such hard removal deadline, while here Congress wrote the timeline directly into the statute.

What counts as an “identity theft report”

The phrase “identity theft report” in item (a)(2) is not casual. Under FCRA 1681a(q)(4), it means a report filed with a federal, state, or local law-enforcement agency. The most accessible route for most people is the Federal Trade Commission’s IdentityTheft.gov, which generates an FTC Identity Theft Report that satisfies this definition; you can add a police report on top of it. If you skip this step, or substitute an informal complaint, you have not met (a)(2), and the bureau can hold off without breaking the law. This single requirement is what separates the 1681c-2 block from an everyday error correction, where no law-enforcement report is needed.

What the bureau must do after it blocks

The duty is not one-sided. Subsection (b) requires the bureau, promptly after it blocks, to notify the furnisher, the bank, card issuer, or lender that supplied the information, of four things: that the information may be the result of identity theft, that an identity theft report has been filed, that a block has been requested, and the effective dates of that block. This notification is what stops the fraudulent tradeline from quietly reappearing through the furnisher’s own reporting channel.

When a bureau is allowed to say no

The block is powerful, so Congress added guardrails. Under subsection (c)(1), a credit bureau may decline to block, or rescind a block it already placed, if it reasonably determines one of three things:

• (A) the information was blocked in error, or the block itself was requested in error;
• (B) the block was requested on the basis of a material misrepresentation of fact by the consumer; or
• (C) the consumer obtained possession of goods, services, or money as a result of the blocked transaction or transactions.

In other words, you cannot use 1681c-2 to erase a debt you actually incurred. The mechanism is reserved for genuine identity theft, and a bureau that catches a misrepresentation or a real benefit to you can lawfully refuse. If your situation is a billing dispute or an inaccuracy rather than fraud, this is not your statute, and pushing it as one risks running straight into (c)(1)(B).

The routing map: block vs. dispute vs. fraud alert vs. freeze

Here is the distinction almost every page conflates, laid out plainly. These four tools sit next to each other in the FCRA, but they do different work:

Tool	What it does	Speed / duration	Needs an identity theft report?
1681c-2 block	Removes a specific fraudulent tradeline	4 business days	Yes
1681i dispute (the “611” route)	Corrects an inaccurate item	Up to 30 days	No
1681c-1 fraud alert (Section 605A)	Flags the file so lenders verify harder	Initial alert 1 year; extended alert 7 years	(Extended alert pairs with a report)
Security freeze	Locks the file so new creditors cannot pull it	Until you lift it	No

Read the table as a decision tree. If an item is simply wrong but not necessarily fraud, an unfamiliar balance, a wrong date, a misapplied payment, you want a general dispute under 1681i, and our walkthrough on disputing credit report errors covers that path. If you want to warn future lenders to take extra verification steps, a fraud alert under 1681c-1 does that, and if you want to stop new accounts from being opened at all, a security freeze locks the file; both of those are prevention rather than removal, and we cover them together in our guide to a layered credit freeze and fraud alert. What none of those three do is delete an existing fraudulent account. That is the unique job of the 1681c-2 block: targeted removal of a specific tradeline, on a four-business-day deadline, in exchange for the identity theft report.

How it fits the rest of your FCRA toolkit

The honest framing is that the block rarely travels alone. A freeze stops the bleeding by preventing new fraudulent accounts; a fraud alert nudges lenders to verify; the 1681c-2 block cleans up the damage that already landed on your file; and an ordinary dispute handles the non-fraud errors that surface along the way. Used in sequence, they reinforce one another. If you want the wider picture of what the statute entitles you to, our overview of your FCRA consumer rights places the block inside the full set of protections.

The practical takeaway is to match the tool to the problem and to assemble the four items before you contact the bureau, because the four-business-day clock is generous only once it has actually started. Treat 1681c-2 as a scalpel for confirmed identity theft, keep your FTC Identity Theft Report from IdentityTheft.gov in hand, identify the fraudulent items precisely, and you convert a vague sense of violation into a deadline the bureau is legally bound to meet.