Skip to main content

There’s been a lot of talk about identity theft lately. Maybe you’ve even heard from customers affected by it. Your help can make a big difference. In fact, did you know that your business is required to provide identity theft victims with copies of records relating to the theft?

The Fair Credit Reporting Act (FCRA) Section 609(e) requires you to provide identity theft victims – or law enforcement at the victim’s request – with a copy of records relating to the theft. Following a written request from an identity theft victim, you must provide the records within 30 days, free of charge and without a subpoena. This is sometimes called “the business records turnover provision.”

Identity theft victims may need the records to document the crime or clear up their good name. You want to help them and you know you need to comply with the law. So, make sure you have policies in place for responding to victims’ requests for records.

Based on what we’ve learned, here are a few things to keep in mind when responding to a business records turnover request

  • Take stock. Know what types of records you have. Think about applications, account statements, receipts, customer service notes associated with a transaction, and records showing where merchandise was purchased or shipped. If you know what you have, then you can better ensure that victims are provided all types of records related to the identity theft
  • Think broadly. The FCRA’s business record turnover provision applies to all different types of identity theft, including new accounts opened, as well as purchases on existing accounts. That’s why it’s important to evaluate your policies periodically to make sure they include new types of identity theft as they emerge.
  • Don’t be afraid to duplicate. Under the FCRA you must provide records even if the victim has received the records before. Here’s an example: Suppose a victim sends in a request for records after receiving a late notice on a billing statement. What should you do? Produce all records related to the unauthorized charges, including copies of billing statements, even though the victim may have already received them. Why? Victims may not have kept the copies they previously received, especially if the identity theft happened some time ago. Denying the victim’s request because the victim previously had access to the records does not comply with Section 609(e).

You may be wondering if there’s any time you can refuse to provide records in response to a 609(e) request. If you’re not sure of the victim’s identity, the FCRA allows you to ask for proof of identity, such as a copy of a government-issued identification. You also may ask for proof of a claim of identity theft, such as an Identity Theft Report issued by the FTC or a police report. An FTC Identity Theft Report subjects the person filing the report to criminal penalties if the information is false, and businesses can treat it as they would a police report. After receiving those documents, if, in good faith, you can’t verify the victim’s identity or believe the request for records was based on a misrepresentation, you may decline to provide the records.

For more information about complying with 609(e), read Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft.

It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system, and user names also are part of the FTC’s computer user records system. We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.

The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.

  • We won’t post off-topic comments, repeated identical comments, or comments that include sales pitches or promotions.
  • We won’t post comments that include vulgar messages, personal attacks by name, or offensive terms that target specific people or groups.
  • We won’t post threats, defamatory statements, or suggestions or encouragement of illegal activity.
  • We won’t post comments that include personal information, like Social Security numbers, account numbers, home addresses, and email addresses. To file a detailed report about a scam, go to

We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.

James shipley
December 18, 2017
If this law was as correct then victims wouldn't be harassed, threatened, taken to court, and be thrown behind bars for for fighting for there identity. And it doesn't matter if all the proof shows that the identity was stolen. And it dosent matter if federal lawsuits against the people were broken. The can do what they want when they waant and no law is there to protect the victims as long as the pay off or make sure the victims lawyers dont repersent them. So victims of identity theft have no civil rights period.
Charles Nading
December 22, 2017
I'd like to have a refund for the transactions that wasn't provided by myself in my name.
Janet Jackson
January 10, 2018
How can you Obtain records or even file a legit complaint when the police in several states won't even allow you to make a physical written statement in at the police department even when you have documentation you provided
July 06, 2018
Agreed. Most apartment building don't given you any information on denied rental application, some times even cash your deposit, play games with returning it, all based on false information within a report. And then direct you to the 3rd party agency who got the information, and left without anyone information to give them. My identity was stolen, somehow even after making affidavit of supports, but the alligations were dismissed but still listed on bureau. Clear as Mud!? And try to rent again with limited income when disabled makes it a nightmare to explain and remove.
FTC Staff
July 09, 2018

In reply to by Steven

When you report identity theft to, you can create an identity theft Report and a personal recovery plan. You can send a copy of your Report to credit bureaus with a request to remove fraudulent information from your credit report. Report identity theft and learn more at

December 12, 2019
You should distribute to all Law enforcement agencies and Attorney General Offices. Many are non-compliant and very under educated on identity theft, the laws and how to handle victims complaints. I knew more as a victim about the procedures, how to file complaint for resolution and about victims of crime rights.

Get Business Blog updates