Sworn Truth, Ignored: How Reyes v. Equifax Undermines Identity Theft Protections and Misreads the FCRA

Examining how Reyes v. Equifax reshapes the treatment of sworn identity-theft disputes under the FCRA

In Reyes v. Equifax, the Fifth Circuit affirmed summary judgment in favor of the CRA, holding that Equifax was not liable under §1681i of the Fair Credit Reporting Act (FCRA) for failing to delete a credit account that the plaintiff disputed on the basis of identity theft. The court concluded that Equifax’s reinvestigation was reasonable because it had contacted the furnisher, Citibank, and received confirmation that the account “belonged” to Reyes. It further held that because the dispute raised a legal question—namely, whether Reyes was liable for charges she claimed were fraudulent—Equifax was not obligated to resolve it.

Factual Background and Procedural History

The dispute arose after Reyes alleged that her Citibank credit card had been skimmed and used to make fraudulent charges. Reyes disputed those charges, filed police reports, and Citibank canceled the card. But instead of eliminating the debt, Citibank transferred the charges to a new account, deemed the transactions valid after an internal review, and reported the unpaid balance as delinquent to Equifax. Reyes then sued Equifax under §§ 1681e and 1681i, alleging that it had failed to follow reasonable procedures and conduct a meaningful reinvestigation in light of her identity theft documentation.

The Court’s Dual Rationale and Internal Tension

This dual rationale renders the court’s reasoning structurally unsound. If Equifax had no duty to investigate in the first place because the dispute raised a legal issue, then its act of contacting the furnisher was irrelevant. The confirmation it received could not satisfy an obligation the court said never existed. But if Equifax’s inquiry into the dispute was necessary and sufficient to fulfill its obligations under §1681i, then the court was bound to ask whether the reinvestigation was reasonable in light of what Reyes submitted. She had provided a sworn identity theft affidavit stating that she did not authorize the transactions on the account. If a CRA can simply disregard that evidence and rely blindly on a furnisher’s one-word confirmation, then the phrase “cannot be verified” in §1681i(a)(5)(A) becomes meaningless. 

The “Collateral Legal Attack” Doctrine in §1681i Cases

The Fifth Circuit’s decision places it squarely within a growing line of cases that bar consumers from using §1681i to mount what the courts call “collateral legal attacks” on the validity of a debt. The Seventh, Ninth, and Eleventh Circuits have previously adopted this view: that unless the underlying legal issue has been resolved in court, there is no “inaccuracy” for the purposes of §1681i. In Reyes, the court held that because Citibank considered the charges valid (with absolutely no rationale presented), and the issue of liability had not been judicially resolved, there was nothing factually inaccurate in reporting the account. This logic rests on a formal distinction between “legal disputes” and “factual inaccuracies,” and it collapses entirely when applied to identity theft.

The Distinction Between Legal Disputes and Verifiable Inaccuracies

Courts have held that CRAs are not required to resolve inherently legal disputes under §1681i—such as whether a debt was discharged in bankruptcy, or whether a contractual obligation was valid. But they are required to investigate disputes that are “objectively and readily verifiable.” That standard, drawn from multiple circuit court opinions, turns on whether the nature of the dispute permits verification or falsification through documentation or procedure. It does not require the CRA to definitively resolve every factual conflict. Rather, it requires that the claim be capable—at least in principle—of being substantiated or rebutted through a reasonable reinvestigation. An identity theft affidavit meets that threshold by design.

The Evidentiary Function of an Identity Theft Affidavit

An identity theft affidavit performs a critical evidentiary function. It elevates what would otherwise be a speculative and weightless allegation—that the consumer does not owe a particular debt—into a sworn assertion made under penalty of law. Unlike a casual or unsupported dispute, a formal identity theft affidavit exposes the consumer to criminal liability if fabricated. The act of swearing to such a statement, with knowledge of its legal consequences, is itself powerful evidence of the claim’s credibility. 

That is because, in most cases, victims of identity theft have limited means to “prove” a negative. They may not know who used their information, how the fraud occurred, or have ready access to timestamps, device logs, or surveillance records. They cannot be expected to produce forensic evidence of where they were when charges were made. What they can do is swear under penalty of perjury that the account is not theirs. That is why Congress made the affidavit a sufficient trigger for action. It is not a placeholder or a procedural hoop—it is the best and often only evidence a consumer can realistically provide. And it is, by design, a sufficient basis for requiring deletion or blocking unless the CRA can affirmatively verify the disputed information.

Reyes’s Submission and the Requirements of §1681c-2

Reyes submitted exactly that. Her affidavit was not speculative or conclusory. It was a formal identity theft report supported by specific contentions and documentation. And Congress has already made clear how such affidavits must be treated. Section 1681c-2 of the FCRA, enacted through the FACTA amendments in 2003, requires CRAs to block the reporting of disputed information within four business days of receiving a proper identity theft affidavit, proof of identity, a description of the disputed item, and a statement from the consumer that the account is not theirs. The statute includes no requirement that the CRA prove the claim is credible in advance. Nor does it delay action pending judicial resolution. Congress determined that the affidavit alone is sufficient to warrant blocking unless the CRA can establish that the consumer’s submission was fraudulent or materially misleading. It is a bright-line evidentiary trigger.

How §1681c-2 Confirms the Meaning of §1681i

That function is crucial to understanding the broader structure of the FCRA. Section 1681c-2 does not create a new evidentiary standard; it affirms the sufficiency of the affidavit. And in doing so, it confirms the proper reading of §1681i: that a sworn identity theft affidavit renders the dispute objectively verifiable and triggers the duty to either confirm accuracy or delete the tradeline. If the CRA cannot substantiate the account in light of the affidavit, the information “cannot be verified” and must be removed. The affidavit thus operates as a statutorily recognized evidentiary tool—one Congress deemed reliable enough to warrant immediate removal under §1681c-2 and deletion under §1681i when verification fails.

The Court’s Treatment of the Affidavit as Legally Insignificant

The Fifth Circuit bypassed this framework by treating the affidavit as evidentiary noise. It did not explain how Equifax could have verified the accuracy of the tradeline when it had nothing more than Citibank’s repetition of the very information being disputed. That is not verification; it is circular deferral. Nor did the court engage with the significance of the affidavit under §1681c-2. Though not directly invoked in the case, that provision clarifies what Congress considered sufficient to establish a bona fide, verifiable dispute. 

The Unwritten Carveout for Account Takeover Fraud

Rather than recognize this burden-shifting function, the court adopted a categorical view: that because the account had once been opened in Reyes’s name, her dispute amounted to a legal question that CRAs need not adjudicate. In doing so, the Fifth Circuit effectively created a carveout for account takeover cases—a carveout that appears nowhere in the text of the FCRA. Congress did not exclude takeover fraud from §1681i or §1681c-2. It drew no distinction between an account fraudulently opened and one later fraudulently used. In both cases, the consumer is asserting that the tradeline does not reflect her own authorized conduct. Congress did not impose a heightened evidentiary burden on victims of takeover fraud, nor did it authorize CRAs to disregard identity theft affidavits in such cases. But the court did.

The Consequences of Allowing Furnisher Confirmation to Control

The logic of Reyes suggests that so long as a CRA can find a furnisher willing to confirm account ownership, it need not evaluate a consumer’s affidavit at all. That rule rewrites the statute. If accepted, it would permit CRAs to indefinitely report unverifiable tradelines—even in the face of sworn identity theft reports—simply because the account technically originated with the consumer. The statute contains no such exception. To the contrary, it demands deletion when the information cannot be verified. The affidavit exists to challenge the assumption that the tradeline is accurate. It is designed to be the evidentiary tipping point. The CRA cannot ignore it simply because the account wasn’t entirely fictitious.

Inverting the Evidentiary Logic Embedded in the FCRA

By declining to engage with §1681c-2 and minimizing the force of the affidavit, the Fifth Circuit reduced the statute’s procedural protections to a formality. The result is a system in which identity theft victims whose accounts were taken over—perhaps the most common kind of credit fraud—are stripped of meaningful recourse under §1681i. That is not what Congress wrote. 

Finally, the CRA in Reyes relied on the furnisher’s unverified assertion of accuracy—an assertion made with no criminal consequence if false—over the consumer’s sworn identity theft affidavit, submitted under penalty of perjury. That choice inverts the evidentiary logic Congress embedded in the statute. The consumer who lies in an identity theft affidavit faces potential criminal prosecution. The furnisher who mechanically confirms an account, even if wrong, faces no such exposure. By deferring to the party with zero criminal risk and disregarding the one who makes a prosecutable statement, the CRA—and the court—privileged convenience over accountability. Congress treated the affidavit as a meaningful evidentiary tool precisely because it carries weight under criminal law. The Fifth Circuit did not. It left in place a system where unverifiable data is validated by those with nothing to lose and rejected when challenged by those with everything at stake. That is not how the FCRA was written to function.