"this should be solely their problem" - from a legal standpoint, it is. The only reason it "isn't" is because the credit bureaus suck and don't move fast enough

"this should be solely their problem" - from a legal standpoint, it is. The only reason it "isn't" is because the credit bureaus suck and don't move fast enough. I'm generally not in favor of using regulation as a blunt hammer, but I think a regulation that makes total sense is to strongly punish anything resembling a credit reporting agency (credit bureau or otherwise) that can't demonstrate RESULTS (not effort) in remediating errors related to ID theft. The FCRA put a lot of measures in place to RESPOND to consumer complaints, but they don't work well and only matter when the consumer decides to complain and is willing to put the time in to do so. That's not enough - if a CRA can't demonstrate success, they should either not be allowed to exist or they should be de-certified. CRA's that can't meet that standard could still exist as businesses, but the shouldn't get the government protected oligopolistic designation they get now.