A fraudulent account on a credit file is rarely just an annoyance. The consequences can become immediate when inaccurate information affects an important financial or personal decision. At this point, you have disputed the accounts more than once, and the fraud is still sitting on your credit file. What most Florida consumers want to know at that point is whether a credit bureau can actually be sued, and the answer is yes. The Fair Credit Reporting Act gives you a private claim against Equifax, with strict deadlines and specific proof requirements. Knowing which specific duty Equifax missed is what turns a frustrating dispute into a case, and our Florida FCRA identity theft practice starts there.
The 2017 Breach Settlement Is Not the Same as Your Claim
Search this topic, and most of what comes back concerns the data breach Equifax announced in September 2017. That breach exposed the personal information of 147 million people and produced a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau, and 50 U.S. states and territories. That settlement has largely wound down. According to the official settlement information page, the deadline to file a claim was Jan. 22, 2024, though the administrator continues to review identity theft and fraud claims tied to the breach, and free identity restoration services remain available to affected consumers until January 2029.
A claim about what Equifax is reporting on your file today is a different question. It does not depend on the breach, and it does not depend on how the thief obtained your information. It arises under the Fair Credit Reporting Act and belongs to you individually. Whether any past settlement affects a particular claim is a question to raise with a lawyer about your file.
What Federal Law Requires Equifax to Do
Two duties matter most in an identity theft case. The first attaches every time a report is prepared. Whenever a consumer reporting agency prepares a consumer report, it must follow reasonable procedures to assure maximum possible accuracy of the information about the person the report concerns. That duty applies whether or not you have ever complained.
The second is triggered by your dispute. Once you notify Equifax that an item is inaccurate or incomplete, it must conduct a reasonable reinvestigation free of charge. All of that has to be finished, with the current status of the item recorded or the item deleted, before the end of the 30-day period that begins when the bureau receives your notice. That window can be extended by no more than 15 additional days if the bureau receives relevant information from you during the original 30 days. No extension is available once the bureau has found the item inaccurate or incomplete, or has determined it cannot be verified.
Within five business days of receiving your dispute, the bureau also has to notify whoever furnished the information, and pass along the relevant material you provided. If the reinvestigation shows the item is inaccurate, incomplete, or unverifiable, the bureau must promptly delete or modify it.
Three qualifiers matter. A bureau may terminate a reinvestigation it reasonably determines is frivolous or irrelevant, including because you did not give it enough information to investigate, but it must tell you so within five business days of making that determination and identify what it needs. When a reinvestigation is finished, the bureau must send you written notice of the results within five business days.
The third is easy to miss. If the bureau deletes the disputed item within three business days of receiving your dispute, it is excused from both the furnisher notice and the written results notice. It must still call you promptly and mail written confirmation, with a fresh copy of your report, within five business days of the deletion. A quiet file is worth documenting, though quiet alone is not a violation.
The Identity Theft Block Is a Separate and Faster Remedy
Most people never learn that identity theft victims have a second, stronger tool. It is not a dispute. It requires the bureau to block the item within four business days, and the clock starts once all of the following reach it:
- Appropriate proof of your identity
- A copy of an identity theft report
- Your identification of the specific information to be blocked
- Your statement that the information does not relate to any transaction by you
All four are required, so a submission missing any one of them does not start the clock. An identity theft report carries a federal definition. It must allege identity theft with as much specificity as you can provide. It must also be a copy of an official, valid report filed with a federal, state, or local law enforcement agency, and the filing must expose the person filing it to criminal penalties for false information.
A regulation also lets a bureau request more documentation on a defined schedule while it decides whether your submission qualifies. A bureau may decline or rescind a block in three narrow circumstances:
- A block entered or requested in error
- A material misrepresentation of fact by you relevant to the block request
- A determination that you received the goods, services, or money involved
Our overview of credit file damage caused by stolen identities covers how these pieces fit together.
What Changed About the Florida Freeze Procedure
Florida has a consumer report security freeze statute that many pages still quote. It tells consumers to request a freeze in writing by certified mail and gives the bureau five business days to place it. On the face of the federal statute, those procedural instructions have been displaced. In 2018, Congress added a national security freeze provision to the federal statute and, in the same legislation, provided that no state may impose a requirement or prohibition with respect to any subject matter regulated by the federal freeze subsections.
The practical effect is that a Florida consumer should follow the federal process, which is both free and faster. Once a nationwide credit bureau has your request and proper identification, it must place a freeze within one business day of a request made by toll-free telephone or secure electronic means, or three business days if the request comes by mail. On the same conditions, it must remove the freeze within one hour of a removal request made by toll-free telephone or secure electronic means, or three business days if that request comes by mail.
The Federal Trade Commission maintains a plain-language comparison of freezes and fraud alerts that reflects the current rules. Whether particular parts of the Florida statute, including its civil action provision, survive the 2018 change is an open question worth evaluating on the facts of your situation.
What a Florida Claim Can Actually Recover
The statute draws a sharp line between two states of mind, and the difference decides what is recoverable. Where the failure is willful, a consumer may recover actual damages or statutory damages of not less than $100 and not more than $1,000. Punitive damages are available on top of that, in whatever amount the court allows. Where the failure is merely negligent, there is no statutory or punitive tier, only actual damages. In either case, if the action succeeds, costs and reasonable attorney’s fees are recoverable in an amount the court determines.
That structure matters. Negligent handling is measured by what the failure actually cost you, so documenting the harm is essential. A bureau that received a complete identity theft report and did nothing, or that deleted an item and then let it reappear, presents a very different question. Headlines promising a fixed dollar range are not describing the statute. What a case is worth depends on the conduct, the harm you can document, and how the bureau handled your file.
Where and When a Florida Consumer Files
A claim to enforce liability under the statute may be brought in any appropriate United States district court, without regard to the amount in controversy, or in any other court of competent jurisdiction. The statute does not name a particular court. Which federal district is the right one in any given case depends on the general federal venue rules, and that is a question to work through with counsel before filing.
The deadline is the part consumers most often misread. Suit must be filed no later than the earlier of two years after the date you discovered the violation that is the basis for the claim, or five years after the date the violation occurred. The two-year clock runs from discovery of the violation, not from the day your identity was stolen and not from the day you first noticed the fraud. Because the outer five-year limit is measured from the violation itself, a long-running dispute can quietly age past the point where the earliest failures are recoverable.
Talk With a Florida Consumer Protection Lawyer
Identity theft claims against a credit bureau turn on documentation and timing, and both are easier to preserve early than to reconstruct later. Keep every dispute letter, response, report, and mailing receipt. If fraudulent accounts are still on your Equifax file after you disputed them, or a blocked item has reappeared, it is worth having someone read the file against what the statute requires. Contact Lehrman Law for a consultation.