The 605B identity theft block: four business days, four documents

Four business days. That’s how long a credit bureau has to block identity theft information once it has what the law requires. A regular dispute gives the bureau 30 days, sometimes 45, and can end with the account marked “verified” and left in place.

The faster route has an entry fee: paperwork. Most people who try a 605B request and get nowhere were missing one of the four required pieces, or sent something that didn’t look like an identity theft claim at all.

What the statute requires of the bureau

Section 605B of the Fair Credit Reporting Act is codified at 15 U.S.C. 1681c-2. Subsection (a) says a consumer reporting agency must block any information in your file that you identify as resulting from alleged identity theft, no later than 4 business days after it receives:

1. Appropriate proof of your identity
2. A copy of an identity theft report
3. Your identification of the information you’re disputing
4. Your statement that the information doesn’t relate to any transaction you made

Once it blocks the information, the bureau must promptly notify the company that furnished it. That notice says the information may be the result of identity theft, that an identity theft report was filed, that a block was requested, and when the block took effect (subsection (b)).

Blocked information doesn’t appear on your report to lenders. That’s the practical difference from a correction: the item isn’t updated, it’s withheld.

Putting the four pieces together

Proof of identity. Send copies, never originals. Bureaus generally want a government-issued photo ID and a document showing your current address, such as a utility bill or bank statement. Experian asks for the same kind of documents for mailed freeze requests, which is a good reference for what passes.

The identity theft report. The usual route is the FTC Identity Theft Report generated at IdentityTheft.gov. The FTC’s sample 605B letter encloses that report. Make sure the fraudulent accounts you’re asking to block are listed in it; a report that describes a stolen wallet but never mentions the store card you’re disputing is a weak match.

Identification of the items. Be specific. The FTC’s sample letter includes a copy of your credit report with the fraudulent items marked. Write out each creditor name, the partial account number as shown, and whether it’s an account, an inquiry or an address.

Your statement. One plain sentence covers it: “The items listed above do not relate to any transaction I made.” Sign and date the letter.

The free letter builder lays out these sections so nothing gets dropped.

Counting the four business days

The clock starts when the bureau receives all four items, not when you mail them. Send the package by certified mail with return receipt so you have a delivery date.

Example: say the bureau receives your complete package on Thursday, October 15, 2026. Count business days only:

The block should be in place by Wednesday, October 21. Compare a standard dispute received the same day: 30 days from October 15 is November 14, and the results can take another 5 business days to reach you under 15 U.S.C. 1681i. That’s the gap the 605B route closes. More on those standard windows in dispute timelines.

One catch can stretch the timeline. Regulation V lets a bureau ask for more information to confirm your identity theft report is valid, as long as it asks within 15 days of receiving the report (12 CFR 1022.3(i)). The regulation says a bare, automated allegation used to support a block can reasonably trigger a request for a notarized affidavit and ID. A detailed report that names each account cuts down the odds of that back-and-forth, so answer any request quickly and keep proof of what you sent.

Block vs. regular dispute

A regular dispute is the right tool for a wrong balance or a late payment you can prove you made on time. The block is the right tool for an account you never opened. For figuring out which you’re looking at, see fraudulent accounts and inquiries on your report.

When a bureau can refuse or undo a block

Subsection (c) lets a bureau decline a block, or rescind one already in place, if it reasonably determines that:

• the information was blocked in error, or you requested the block in error
• the block was based on a material misrepresentation of fact by you
• you obtained goods, services or money as a result of the blocked transaction

If the bureau declines or rescinds, it must promptly notify you, using the same method the law requires when it reinserts previously deleted information.

Don’t treat a 605B block as a credit repair shortcut. Using it on accounts you actually opened is a material misrepresentation, which is grounds for the bureau to rescind the block, and the FTC lists “file a false identity theft report” among the tactics credit repair scammers push. The block can come back off, and the false report can create legal problems of its own: Regulation V defines an identity theft report as one whose filing carries criminal penalties if the information is false.

The third ground matters for people whose information was used by a relative or ex-partner. If you knew about the account and benefited from it, the bureau can treat that as disqualifying. If you truly didn’t, say so in your statement and keep evidence: the Identity Theft Report, any police report, and anything showing where you lived or what you were doing when the account opened.

Gaps in the 605B process

A few businesses sit outside the four-day rule. A reseller, a company that buys reports from bureaus and repackages them, has a narrower duty: block the information from future reports it resells and tell you which agencies supplied it. A check services company acting in that role isn’t covered by the block itself, though it can’t report the identity-theft information to a nationwide bureau starting 4 business days after receiving your materials. And nothing in the section stops law enforcement from accessing blocked information it could otherwise obtain.

The block also only covers the bureau that received your request. Send separate packages to Equifax, Experian and TransUnion, each with its own copy of everything.

Your next moves

1. File your Identity Theft Report at IdentityTheft.gov if you haven’t. Make sure every account you plan to dispute is in it.
2. Pull your reports from all three bureaus and mark each fraudulent account, inquiry and address.
3. Send each bureau a separate package with all four pieces, by certified mail with return receipt.
4. Mark the fourth business day after delivery on your calendar. If the items still show after that, follow up in writing and reference 15 U.S.C. 1681c-2(a).
5. Contact each furnisher’s fraud department as well, as laid out in identity theft recovery, step by step. A block hides the item; the furnisher is the one that closes the account.