If Someone Steals Your Identity, Are You Responsible for Debt?

If someone steals your identity, are you responsible for the debt they create? In almost every case, no. Federal law either caps your liability at a small amount or removes it entirely, depending on how the fraud happened. Charges on an existing credit card are capped at $50, and most issuers waive even that. Unauthorized transfers from a bank or debit account can cost you as little as nothing if you report quickly. Accounts a thief opens from scratch in your name are not legally yours to pay at all. The catch is paperwork: you have to report the fraud, document it, and push back against creditors and credit bureaus that keep trying to collect.

Charges on Your Existing Credit Card

Federal law caps your liability for unauthorized credit card charges at $50, full stop.¹ Once you notify the issuer, you owe nothing for charges made after that point. Every major card network now offers a zero-liability policy that goes beyond what the statute requires, so most victims pay nothing at all.

There is a real deadline. Under the Fair Credit Billing Act, you must send a written dispute to your card issuer within 60 days of the statement that shows the unauthorized charge. Miss that window and you lose the statutory protections for those charges. The dispute has to identify the charge, explain why you believe it is fraudulent, and include your account information. Once the issuer receives your notice, it has 30 days to acknowledge it and must resolve the dispute within two billing cycles, no more than 90 days.² While the investigation is open, the issuer cannot try to collect the disputed amount or report it as delinquent.

Unauthorized Transfers From Your Bank or Debit Account

Debit cards follow different rules than credit cards, and your liability depends entirely on how fast you report the problem. The Electronic Fund Transfer Act sets up a tiered system for lost or stolen cards and PINs:

Report within two business days of learning your card is lost or stolen, and your maximum liability is $50.
Report after two business days but before 60 days from your statement, and your liability rises to as much as $500.
Wait longer than 60 days after your statement, and you could be on the hook for every fraudulent transfer that happens after that window until you finally report it.³

The tiers above apply when your physical card or PIN is lost or stolen. When only your account number is compromised, through a data breach, a skimmer, or online theft, the first two tiers do not apply at all. Your only obligation is to report the unauthorized transfer within 60 days of receiving the statement that shows it. Do that and your liability is zero. Wait past 60 days, and you become responsible for fraudulent transfers that occur after those 60 days and before you finally notify the bank.⁴ This distinction matters, because most debit fraud today comes from stolen numbers rather than stolen wallets.

Accounts a Thief Opened in Your Name

When a thief opens entirely new credit cards, loans, or utility accounts using your identity, you have no legal obligation to pay those debts. You never agreed to the account, never signed a contract, and never received the benefit of the credit. The problem isn’t the law. It’s proving to the creditor and the credit bureaus that the account isn’t yours.

The Fair Credit Reporting Act gives you two levers. Once you submit an identity theft report to a creditor or debt collector along with a statement that the account is fraudulent, the company is prohibited from continuing to report the account to credit bureaus.⁵ And the credit bureaus themselves must block fraudulent information from your report within four business days of receiving your identity theft report, proof of identity, identification of the fraudulent entries, and your statement that the accounts aren’t yours.⁶

The Document That Unlocks the Protections

Almost every protection above depends on one piece of paperwork: an FTC Identity Theft Report. This is the official proof of identity theft that creditors, credit bureaus, debt collectors, and law enforcement recognize. Without it, you can still dispute debts, but the process is slower and the legal protections are weaker.

To create the report, go to IdentityTheft.gov and work through the online form.⁷ You’ll enter your personal information, describe the fraud, and list every fraudulent account or transaction you’ve discovered. The site generates your official report and a personalized recovery plan with step-by-step instructions.⁸

Some creditors and law enforcement agencies also want a police report. Bring your FTC report, a government-issued photo ID, and proof of your address to your local police department. Not every department will take these reports enthusiastically, but having both documents strengthens your position when a creditor drags its feet.

Disputing the Debt With the Creditor

With your FTC Identity Theft Report in hand, send a written dispute to the fraud department of every company where a fraudulent account exists or unauthorized charges appear. Your letter should identify the specific account or charges, state that you are an identity theft victim, and declare that you are not responsible for the debt. Include a copy of your FTC report.

Send the dispute by certified mail with a return receipt requested. That paper trail matters if the company stalls. For credit card billing disputes, the creditor must acknowledge your notice within 30 days and resolve the dispute within two billing cycles.² For fraudulent accounts opened in your name, a creditor who receives your identity theft report is prohibited from continuing to report that account to credit bureaus.⁵

Disputing With the Credit Bureaus

Disputing with the creditor is only half the job. You also need to dispute the fraudulent entries directly with each credit bureau reporting them. Under the Fair Credit Reporting Act, when you notify a bureau that information in your file is inaccurate, it must conduct a free investigation and either verify, correct, or delete the disputed item within 30 days.⁹ If you provide additional information during that 30-day window, the bureau gets up to 15 extra days. It must notify you of the results within five business days of finishing the investigation.

When you have an FTC Identity Theft Report, you can go further and request a block under FCRA Section 605B. Once you provide your report, proof of identity, and identification of the fraudulent accounts, the bureau must block that information from your credit file within four business days.⁶ A block is stronger than a dispute. It removes the information rather than flagging it as contested.

When a Debt Collector Contacts You

Fraudulent debts often reach a collection agency before you even know they exist. Your failure to dispute a debt with a collector is not a legal admission that you owe it. If a collector contacts you about a fraudulent account, send a written dispute within the validation period, typically 30 days of the collector’s initial contact. Once you dispute in writing, the collector must stop all collection activity until it sends you verification of the debt.¹⁰

Include a copy of your FTC Identity Theft Report with your dispute. A collector who receives a valid identity theft report and keeps pursuing you for a debt that isn’t yours is violating federal law, and you have legal recourse to stop them.

If a Creditor Cancels the Debt and Sends You a 1099-C

When a creditor writes off a fraudulent debt, it may issue a Form 1099-C reporting the canceled amount as income to you.¹¹ Normally, canceled debt is taxable. A debt you never legitimately owed is different. You never received the money, so there is nothing to tax. If a 1099-C arrives for a fraudulent debt, contact the creditor and ask them to correct or withdraw it. If they refuse, dispute the amount on your tax return and keep your FTC Identity Theft Report and supporting documentation in case the IRS follows up.

When a Company Ignores You: Your Right to Sue

When a creditor or credit bureau ignores your identity theft report and keeps reporting fraudulent accounts, you have a private right of action under the Fair Credit Reporting Act. What you can recover depends on whether the failure was careless or deliberate.

For negligent violations, you can recover the actual damages you sustained plus the cost of bringing the lawsuit and reasonable attorney’s fees. For willful violations, you can recover actual damages or statutory damages between $100 and $1,000 per violation (whichever is greater), plus punitive damages, plus attorney’s fees and costs.¹²

The willful category is where companies pay attention. A credit bureau that keeps reporting a fraudulent account after receiving your identity theft report and blocking request is hard-pressed to argue it wasn’t deliberate. Because punitive damages and attorney’s fees are on the table, many consumer attorneys will take these cases on contingency, so you don’t need money upfront to push back.

1
Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card
2
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
3
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
4
Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
6
Federal Trade Commission (FTC). FCRA 605B – Blocking Information Resulting From Identity Theft
7
Federal Trade Commission. IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan
8
Federal Trade Commission. Identity Theft Recovery Steps
9
Office of the Law Revision Counsel. 15 U.S. Code 1681i – Procedure in Case of Disputed Accuracy
10
eCFR. 12 CFR Part 1006 – Debt Collection Practices (Regulation F)
11
Internal Revenue Service. Topic No. 431, Canceled Debt – Is It Taxable or Not?
12
Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance