Free Report = 45 days; pretty much name, address, amount, maybe SSN - that gets 'verified' - and that does NOT mean the debt is yours which is why challenging the CA is the better route. AND, a CA can ask you for 'proof' if you dispute with the CRAs - but if you ask them to validate they must ante up the info required without help from you.
And there is a follow-up that is sent to the CA threatneing legal action for attemping to collect without having validated...
Then you also have complaints to state AG, FTC etc - to bring the hammer down on a CA who won't validate but continues to report.