Extended Fraud Alert Under FCRA Section 605A.

An extended fraud alert is a seven-year notice on your credit file. You can get one only after identity theft has been documented through a police report or an Identity Theft Report filed with the Federal Trade Commission. Any business that pulls the report must take extra steps to confirm it is really you before it opens new credit.

That protection matters, and it is also where most victims stop. The alert slows the next thief down, but it does nothing about the fake accounts already sitting on your reports. A seven-year alert is a lock on the front door, and the damage already inside stays there until you go after it.

What is an extended fraud alert under FCRA Section 605A?

An extended fraud alert is the strongest of three fraud alerts created by 15 U.S.C. § 1681c-1, also called FCRA § 605A. It is free, it lasts seven years, and it requires proof that your identity was stolen. It is the only alert that also takes you off prescreened offer lists for five years and gives you extra free reports.

The need is real. In the FTC’s national accuracy study, one in five consumers had an error on at least one of their three credit reports (Federal Trade Commission, 2013). Identity theft is one of the fastest routes onto that list.

Here is the extended alert at a glance:

• Length: Seven years under FCRA § 605A.
• Proof: A police report, an FTC Identity Theft Report, or other proof of identity theft as the statute defines it.
• One call: Placing the alert with one bureau requires that bureau to notify the other two, so a single request covers all three nationwide credit reporting agencies.
• Free reports: Two free credit reports from each bureau.
• Prescreen opt-out: Your name comes off prescreened credit and insurance offer lists for five years.
• Lender checks: Businesses that pull the report must take reasonable steps to verify your identity before extending credit.

The extended alert is a separate tool from a credit freeze, which blocks access to your file entirely. It is also separate from a credit lock, which is a contract product sold by individual bureaus and is not a right under federal law. Credit Freeze vs Fraud Alert vs Credit Lock sets the three side by side. Civil and criminal cases against the person who stole your identity run under separate law.

How is the extended fraud alert different from other fraud alerts?

The extended alert differs from the initial alert on length, on who qualifies, and on the extra benefits. Anyone who reasonably suspects identity theft can place an initial alert. It lasts one year and comes with one free report from each bureau. The extended alert requires documented identity theft, runs seven years, and adds the prescreen opt-out and extra free reports.

What documentation qualifies for an extended fraud alert?

An Identity Theft Report under FCRA § 603(q)(4) qualifies. That is a report you file with a federal, state, or local law enforcement agency, and the Federal Trade Commission counts. It must state your claim of identity theft as specifically as you can. You also accept criminal penalties if any statement in it is false.

Documents that typically qualify include:

• FTC Identity Theft Report: Made through the IdentityTheft.gov tool. This is the most common proof consumers use. The FTC took more than 1.1 million identity theft reports through that site in a single year (Federal Trade Commission, 2025).
• Police report: Filed with a local, state, or federal law enforcement agency and naming the identity theft.
• Postal Inspection report: Filed with the U.S. Postal Inspection Service when the theft involved mail.
• Other federal reports: Filed with agencies such as the FBI in cases involving organized fraud.

The bureaus keep the right to check your proof. Be ready to back up an Identity Theft Report with account statements that show the fraud, denial letters from creditors, or other papers that show the theft happened.

How does a consumer place an extended fraud alert?

You contact one of the three nationwide credit bureaus and send your proof. That bureau places the alert on your file and must tell the other two, which then place it on theirs. Under this one-call rule, one request reaches Equifax, Experian, and TransUnion. You do not have to file three times.

Steps in the order we recommend:

1. File an Identity Theft Report with the FTC through IdentityTheft.gov, or file a police report with local law enforcement.
2. Print and keep a copy of the Identity Theft Report or police report.
3. Contact one of the three credit bureaus (Equifax, Experian, or TransUnion) and ask for an extended fraud alert.
4. Send the Identity Theft Report or police report through the bureau’s secure online portal, by mail, or by fax.
5. Prove your identity with the papers the bureau asks for, which typically include proof of address and a copy of a government-issued ID.
6. Confirm the alert with all three bureaus by pulling each report within 30 days of your first request.

Step 6 is the one people skip. It is also the step that shows you every fake account the thief already opened, which is where the next section of your recovery starts.

What must a credit bureau do once it gets your request?

The bureau must place the alert, keep it on for seven years, and pass it to the other two nationwide bureaus. Under § 605A(b) it must also pull your name from prescreened offer lists for five years and give you two free reports. Section 609 adds a duty to give identity theft victims a summary of their rights.

The bureau’s duties do not stop at the alert. Once you dispute an item, FCRA Section 611 requires a reasonable investigation, generally within 30 days. The CFPB has told bureaus and the companies that supply their data that an investigation that just repeats the lender’s word can break the law (Consumer Financial Protection Bureau, 2022).

That warning exists for a reason. About 90% of consumers who complained to the CFPB about the three big bureaus said they had already disputed the problem with the bureau directly (Consumer Financial Protection Bureau, 2025). An alert on file does not mean a bureau is working your case.

What counts as reasonable steps when a creditor sees the alert?

A creditor that sees an extended alert must take reasonable steps to reach you in person, by phone, or by another method you chose before it extends credit. It cannot lean on the report’s automated checks. You can list a preferred phone number on the alert, and the creditor should call that number before opening a new account.

Checks creditors typically use include:

• Calling the number listed on the alert and confirming who you are with knowledge-based questions.
• Asking you to come to a branch with photo ID before opening a new account.
• Asking for more papers, such as utility bills, bank statements, or tax returns.
• Running a video check through the lender’s identity platform.
• Holding the credit decision until you answer a verification request.

Section 605A(h) sets these duties for anyone who uses the report. The practical effect is a pause. A thief with your Social Security number now has to get past a phone call to your own number.

Does the extended fraud alert prevent all new account opening?

No. An extended fraud alert is not a credit freeze. It asks for verification, and your file can still be pulled. You can still open new accounts with the alert on, because the alert only adds a check before approval. If you want to block access to your file entirely, place a freeze on top of the alert or in its place.

Credit freezes fall under FCRA § 1681c-1(i). A freeze stops third parties from pulling your file until you lift it for a while or remove it. Freezes are free under federal law as of September 2018. See How to Freeze Your Credit in 2026 for the steps.

Someone facing active identity theft typically benefits from both. The alert gives backup verification. The freeze stops most pulls of the file in the first place.

What are the additional benefits of the extended fraud alert?

The extended alert carries two benefits the initial alert does not. Both are built for the long recovery that follows proven identity theft. One gives you free looks at your reports. The other cuts down the stream of personal offers landing in your mailbox, which is where a lot of identity theft starts.

• Two free credit reports from each bureau: You can get two free reports from each of the three nationwide bureaus within the 12 months after you ask. These come on top of the free reports every consumer gets under FCRA § 1681j.
• Five-year marketing opt-out: The bureaus must remove your name from prescreened lists for unsolicited credit card and insurance offers for five years. Fewer offers in the mail means less of your information sitting in a box someone can steal.

The free reports let you watch for new fraud during recovery. Many identity theft cases involve fraud that shows up months or years after the first incident. The extra reports give you a way to catch it without paying for a monitoring service.

Can an extended fraud alert be removed early?

Yes. You can ask the bureau to remove the extended alert at any time during the seven years. The bureau must remove it within a reasonable time after it gets your request and proof of identity. People usually ask for early removal once the identity theft is fully resolved and they no longer need the extra checks.

Early removal does not undo the prescreen opt-out. The five-year opt-out runs its full length unless you ask the bureau to turn prescreening back on. If you want those offers back, that is a separate request.

Does an extended fraud alert replace credit monitoring?

No. The alert puts a notice on your file that a creditor has to act on. It does not tell you when a new inquiry or account appears. To know about new activity as it happens, you need a monitoring service or regular checks of your own reports.

Free options include the weekly reports from each of the three bureaus at AnnualCreditReport.com. The bureaus committed to keeping those available after expanding access during the COVID-19 pandemic. Paid services add more frequent alerts and extras like dark web scans, but the credit data underneath is the same as in the free weekly reports.

Monitoring that only watches also leaves the fraud in place. One Credit Karma user who went through identity theft put it this way:

“I had a terrible experience and it’s really unacceptable that CK dont have a reliable customer support. This really happened after i experienced identity theft fraud issue which i don’t know how my information got leaked. This became a serious issue that dented my report negatively.”

Mistress T., a 1-star Trustpilot review of Credit Karma, September 3, 2026

What if a creditor does not honor the extended fraud alert?

A creditor that skips reasonable checks before extending credit to an impostor may violate FCRA § 605A(h). It may be liable to you under FCRA § 616 or § 617 for negligent or willful noncompliance. Damages can include actual losses, statutory damages of $100 to $1,000 in willful cases, punitive damages, and attorney’s fees.

Keep every record of the fake account. That means the credit application, the bureau records showing when the alert went on, and every message with the creditor about the dispute. Report the incident to the FTC and to the state or federal regulator that oversees that kind of creditor.

The stakes are high. Consumers reported losing more than $12.5 billion to fraud in a single year (Federal Trade Commission, 2025). A lender that ignores your alert is part of how that number grows.

How does a §605B block finish what the extended alert starts?

A block under FCRA § 605B removes items the thief created from your report. The alert only guards against new fraud. A bureau must block any item you identify as coming from identity theft if you send a copy of an Identity Theft Report, proof of identity, and a statement that the item is not your transaction.

The size of the problem shows why the block matters. In our read of complaints recorded in the CFPB’s public Consumer Complaint Database from July 2025 through June 2026, 66.9% of the 3,482,718 complaints filed under “Incorrect information on your report” named “Information belongs to someone else.” Those complaints are unverified consumer allegations, and the CFPB does not confirm the facts in them.

Other protections work next to the alert and the block:

• Credit freeze under FCRA § 605A(i): Blocks access to the credit file entirely.
• Business records under FCRA § 609(e): Lets you get free copies of records from the business where the fraud happened.
• Receipt truncation under FCRA § 605(g): Limits how much of your card number shows on receipts.
• Employment reports under FCRA § 604(b): Requires employer disclosure and your consent before a report is pulled for a job.

For the full block process, read How to Block Identity Theft Items Under FCRA Section 605B. For the wider recovery, see Identity Theft and Credit Reports: A Complete Guide to Recovery and What you need to do if your identity is stolen: 7 critical steps.

Which Tool Cleans Up Your Reports After the Extended Alert Goes On?

Once the extended alert is in place, the choice turns on who finds the fake items the thief left behind and who writes the letters to challenge them. Here is how the options compare on price, on what they do about items that are not yours, and on which bureaus they reach.

Every price is that company’s own published rate, read off that company’s own site on September 15, 2026. Trustpilot scores and review counts as published on September 24, 2026.

How CreditRefresh Finds and Challenges the Items the Alert Leaves Behind

The alert protects your future file, and CreditRefresh works on the one you already have. We scan all three bureau reports and flag every item that looks inaccurate, incomplete, unverifiable, or too old to report. Then we draft a print-ready FCRA dispute letter for each item you choose to challenge. In our September 18, 2026 member-data extract, 2.3% of disputed bureau-level items in mailed rounds had a recorded outcome. Within that subset, 47.9% were no longer reported on a newer pull of the same bureau, while 52.1% remained reported with a changed balance, status or negative flag.

You read and sign every letter before anything is sent. Mail them yourself, or hand the round to RushMail for a small per-letter fee. We log the date each letter went out and track the bureaus’ answers against the roughly 30-day window.

CreditRefresh comes with Refresh Monitoring at $49.99 a month. There is no setup fee, no per-dispute charge, no contract, and nothing to learn.

It is backed by our 100% money-back guarantee: members who work the full program and see no bureau score rise above where they started can claim back every Refresh Monitoring payment. It is a refund promise, never a score promise.

Frequently Asked Questions

Does an extended fraud alert hurt a credit score?

No. FICO and VantageScore models do not score fraud alerts, so the notation stays out of the score math. A creditor can still turn down new credit if it cannot finish the check the alert requires.

Can someone else place a fraud alert on a consumer’s file?

Yes. FCRA § 605A(b) lets a personal representative place an extended alert with proof of legal authority, such as a power of attorney or court order. It is most often used for incapacitated consumers, deceased consumers’ estates, and minors whose identity was stolen.

How quickly does the extended alert take effect?

The bureau must place the alert as soon as practicable after it gets your request and proof, typically within one to two business days. The notice to the other two bureaus runs on the same clock, so all three files should carry the alert within several business days.

Does the extended alert apply to specialty credit reports?

It covers files at the three nationwide credit bureaus. Specialty agencies that keep tenant, employment, and insurance screening files run their own procedures, so contact each one directly to ask for protection under FCRA § 1681a(p) and § 1681c-1.

What happens to the alert after the seven-year period ends?

It expires on its own, and you do nothing to remove it. If the risk remains, you can place a new initial alert, ask for a new extended alert, or freeze your credit. A new extended alert needs a new Identity Theft Report tied to recent fraud.

Can I dispute identity theft accounts while the extended alert is on?

Yes. The alert limits what creditors can open in your name and leaves your own dispute rights under FCRA Section 611 untouched. Bureaus generally have 30 days to investigate each item you dispute.

Last reviewed: May 2026

This article is for educational purposes only and does not constitute legal or financial advice. The Fair Credit Reporting Act and related regulations are complex, and outcomes depend on individual circumstances. Consumers with specific questions about their credit reports or rights under federal law should consult a licensed attorney or contact the Consumer Financial Protection Bureau directly.

CreditRefresh drafts the FCRA dispute letters for the items an extended fraud alert leaves sitting on your three credit reports. Backed by a 100% money-back guarantee.

Challenge the items your extended fraud alert can’t touch →