There are two types of credit bureau fraud alerts. We’ll cover both.
For an initial fraud alert, you simply notify the credit bureau directly that you believe you have been or are about to be a victim of identity theft.
Section 605A(a)(1) of the FCRA says:
"Initial alerts. Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, a consumer reporting agency described in section 603(p) that maintains a file on the consumer and has received appropriate proof of the identity of the requester shall –(A) include a fraud alert in the file of that consumer, and also provide that alert along with any credit score generated in using that file, for a period of not less than 90 days, beginning on the date of such request, unless the consumer or such representative requests that such fraud alert be removed before the end of such period, and the agency has received appropriate proof of the identity of the requester for such purpose; and (B) refer the information regarding the fraud alert under this paragraph to each of the other consumer reporting agencies described in section 603(p), in accordance with procedures developed under section 621(f)."
The alert is good for 90 days, and it requires the credit bureaus to include a fraud alert with any request for your credit file or credit score within that 90 day period, AND to notify the other CRAs of the fraud alert.
An initial fraud alert means that lenders must call you at the phone number you provide for identity verification before issuing credit in your name, or take other "reasonable steps" to verify your identity before issuing credit.
The other benefit of an initial alert is that you can get free access to your credit reports.
Section 605A(a)(2) of the FCRA says:
"Access to free reports. In any case in which a consumer reporting agency includes a fraud alert in the file of a consumer pursuant to this subsection, the consumer reporting agency shall – (A) disclose to the consumer that the consumer may request a free copy of the file of the consumer pursuant to section 612(d); and (B) provide to the consumer all disclosures required to be made under section 609, without charge to the consumer, not later than 3 business days after any request described in subparagraph (A)."
If you want to place a fraud alert on your credit report and get a free copy of your report as quickly as possible, the quickest and easiest way to do it is by visiting the Experian website at www.experian.com/fraud.
There you can place the fraud alert on your credit report AND get instant access to your credit report right from your computer.
An extended fraud alert takes things a step further. Your part is more complicated in that you are required to supply proof of the alleged identity theft, such as an identity theft report filed with local, state, or federal law enforcement.
With an extended fraud alert, the bureau is required to keep the fraud alert on your credit file for 7 years or until you remove it.
Also, with an extended fraud alert the credit bureau cannot sell your information to third parties for marketing purposes for a period of 5 years, unless you rescind that portion of the fraud alert and ask to be opted back in.
FCRA 605A(b)(1)(B) states that the bureau must,
“during the 5-year period beginning on the date of such request, exclude the consumer from any list of consumers prepared by the consumer reporting agency and provided to any third party to offer credit or insurance to the consumer as part of a transaction that was not initiated by the consumer, unless the consumer or such representative requests that such exclusion be rescinded before the end of such period […]”
With extended fraud alerts the bureau must also notify the other bureaus of the fraud alert, and they also must grant you free access to your credit report.
Instead of just one copy of your credit report, you can request it TWICE in the 12 month period after the alert has been placed.
The requirement to call you before issuing credit is spelled out a little more clearly in the FCRA for extended fraud alerts. In short, the creditor can’t extend credit without calling the number you provide. Note: the second part about "reasonable procedures" is left out. They HAVE TO call you! (FCRA 605A(h)(2)(B))
One final note on fraud alerts is that once you have initiated the fraud alert with one of the three major credit bureaus, the other 2 should be notified. And once the other bureaus are notified, they must treat the fraud alert as if it came directly from you. This includes giving you access to free credit reports, and including the "fraud alert" flag on your credit file for the required amount of time. (FCRA 605A(e))