What to Do if Your Identity is Stolen

Identity theft is scary. If you’ve seen a loved one go through it or just heard any of the horror stories out there, you know it can have huge consequences and can be hard to deal with. But with data breaches, data brokers, and ever-crafty criminals, it happens more than we would like to think. It’s essential to know not just how to protect yourself from identity theft, but what to do if your identity is stolen. That way, if the worst happens, you know what steps to take to deal with it and prevent more damage.

How and Why Identity Theft Happens

There are all kinds of ways criminals can get your identity information. Data breaches steal it from companies that had it for legitimate reasons. Malware or spyware steals it from your own devices. Tech-savvy criminals could intercept anything you entered into a website while you were connected to public wifi. Phishing and social engineering trick you into handing it over yourself. And some criminals go low-tech – stealing wallets or purses, snatching envelopes from your mailbox, even going through your trash for anything useful you might have thrown away.

As for why criminals steal identities, it’s often the same motivation as any other criminal activity: Money. They can use your credit to get new credit cards and loans and can establish services like phone plans and utility accounts in your name. They can open new bank accounts in your name to use for money laundering. Sometimes they are even able to trick your bank or credit card company and get access to your existing accounts. And they may file fake tax returns or for unemployment or other benefits to steal money from the government in your name.

Identities aren’t just good for money, either. If someone steals your identity, they can use it in any circumstance where they don’t want to be themselves. They may use your information to get healthcare – which has the bonus of leaving you on the hook for the bill. Some foreign actors infiltrate companies by getting jobs under stolen identities. Criminals getting arrested may even provide a stolen identity to keep themselves off the hook. Anything where a person’s identity matters is a great opportunity for a criminal to use a stolen identity instead of their real one.

Tips to Prevent Identity Theft

Unfortunately, with the improvements in all kinds of technology, the prevalence of hackers, and the severity of data breaches, it’s not possible to completely guarantee no one will ever be able to steal your identity. But there are things you can do to make it harder for criminals to steal your identity in the first place, and to catch it earlier if it does happen.

• Don’t carry your social security card in your wallet or purse. (That just makes it easier for a pickpocket to steal your identity.)
• Avoid giving out your social security number if you can help it. In fact, avoid sharing as much personal information as you can.
• Monitor your mail. Check it every day, and pay attention to billing cycles so you know if someone stole a bill – or switch to paperless billing so a mail thief can’t get at it.
• If you use public wifi, use a VPN.
• Review your credit card and bank statements every month.
• Check your credit report at least once a year, but ideally every few months.
• Shred anything with personal info – including receipts, credit card offers, and expired cards – to deter dumpster-diving thieves.
• Use an antivirus to keep spyware off your devices.
• Make sure all your passwords are long, strong, random, complex, and not used for any other account (a password manager makes this easier).
• Store physical documents with personal information securely. A safe or locked cabinet is a good idea.

Warning Signs that Your Identity was Stolen

If someone steals your TV or car, you know it was stolen because it’s not there anymore. But it’s usually not immediately obvious that someone stole your identity. One of the barriers to knowing what to do if your identity is stolen is that you first have to realize it happened.

These are the most common signs that someone stole your identity. If you spot any of these, it’s important to act right away.

• Bills for things you didn’t buy or services (including medical services) you didn’t receive.
• Account statements or other mail for accounts you don’t recognize.
• Calls or letters from debt collectors about accounts you don’t know about.
• Calls from your bank or credit card company about suspicious transactions. (This is also a common phishing tactic, so be careful!)
• The personal information (like email address, phone number, or mailing address) on any of your online accounts is different when you didn’t change it.
• Notifications about suspicious login attempts on your accounts, or getting two-factor authentication codes when you weren’t trying to log in.
• Unexpected denials for credit cards or loans.
• Unexpected denials for government benefits, employment, or housing.
• There’s a warrant out for your arrest (and you’ve checked with your local law enforcement to make sure it’s not an arrest warrant scam).
• Sudden or unexpected decreases in your credit score.
• Accounts or hard inquiries you aren’t familiar with on your credit report.
• Incorrect personal information (like names, addresses, or employers) on your credit report.
• Receiving tax documents from an employer you never worked for.
• Getting an error that you’ve already filed taxes when e-filing your tax returns.
• Mail stops being delivered, or mail is missing from your mailbox.

You Saw the Signs – Now What?

You’ve identified at least one sign that someone has stolen your identity. What do you do now? The worst thing you can do is nothing. Criminals won’t stop on their own. Even if one criminal has decided they’re done with your identity, they’ll sell it to someone else to exploit more. They won’t stop until either you take action to stop them, or your life has been so destroyed that there’s no more benefit to using your identity.

There are three main steps for what to do if your identity is stolen.

1. Stop the theft and start a paper trail.
2. Check for compromise and dispute fraud.
3. Secure everything and protect yourself going forward.

What specific things you have to do in each step varies depending on what signs you noticed and what specifically the thief has done with your identity. This article lists steps that cover as many potential situations as possible. Not all of them may apply to you. But this is still a good starting point if you’re dealing with identity theft.

First: Stop the Theft and Start a Paper Trail

If you discover that your identity was stolen, the first thing to do is to shut down as much as you can to stop the theft. Start with financial accounts. That’s often where identity thieves start, too.

As you work through these steps, start a contact file. This can be either a physical notebook or a file on your computer or phone. Use it to write down every call you make and letter you send about the identity theft situation. Write down the date, what institution or company you contacted, and a brief note describing what the contact was about. If it was a letter, keep a copy for yourself. If it was a phone call, also note the time you called, the name of the customer service representative you spoke to, and what they told you. This will help you as you work through this process.

1. Contact Affected Financial Institutions

Contact any bank, credit card company, investment brokerage, or any other organization that you know the identity thief interacted with. That includes both fraudulent accounts that you didn’t open and fraudulent activity on legitimate accounts.

Call them and ask to speak to the fraud department. Explain that someone stole your identity and tell them what is fraudulent. If the whole account is the problem, ask them to freeze it. If it’s transactions or changes on a legitimate account, dispute the fraudulent charges, ask for your current cards (if the account has a card) to be cancelled and replaced, and change your password and any PINs associated with the card.

2. Lock Down Your Credit

Next, pull your credit reports from all three credit reporting agencies. You can do this once a week for free at annualcreditreport.com. Go through your credit report and look for any accounts or information that you don’t recognize or that aren’t yours. Sometimes fraudulent accounts take some time to show up on your credit. So keep checking regularly to spot any that might not have been there immediately.

An important thing to do if your identity is stolen is to set up a fraud alert or a credit freeze on your profile. Both fraud alerts and freezes are free. A fraud alert flags your credit file as having high potential for fraud. Lenders are supposed to take extra steps to verify someone before letting them open an account if there’s a fraud alert. It lasts for one year, and you only have to contact one of the three bureaus to set it up. A credit freeze is a total block – nobody not even you, can use your credit while it’s frozen. It lasts until you turn it off, and you have to contact all three credit bureaus individually.

Bonus: Contact Your Identity Theft Insurance

Not everyone has identity theft insurance. And not every identity theft insurance plan helps with recovery. But if you have identity theft insurance, it’s important to report this to them and see what they have available. They may have resources they can point you to, additional advice on the process, or even specialists who can help walk you through what to do since your identity was stolen.

3. File a FTC Report

The Federal Trade Commission (FTC) has a website all about identity theft at identitytheft.gov. This site contains a lot of resources for helping you figure out what to do if your identity is stolen and how to recover. That includes personalized recovery plans, dispute letter templates, and contact information for credit bureaus and other helpful agencies.

Reporting your situation to the FTC will also give you an identity theft affidavit. This is an official legal document stating that someone stole your identity. It will be very important as you continue disputing things and work through the rest of the recovery process. So report the situation at identitytheft.gov and get the affidavit.

4. File a Police Report

No, your local police probably won’t be able to help you very much with the recovery process. But along with the FTC affidavit, a police report saying that someone stole your identity will be an important piece of paper to help you take the rest of these steps. So take your FTC affidavit to your local police, report the theft, and ask them to create a police report.

Depending on your police department’s regulations, you may need to show a photo ID, proof of your address, and proof of the theft. Bring as much documentation as you can. They may say there’s not much that they can do for you, and you can let them know that you know that, you just need the report. Make sure you get a copy of the police report once it’s filed.

5. Report Stolen Documents

If your identity is stolen because someone stole your ID or other important document, it’s important to report that theft separately from the identity theft. Report stolen identity documents to the relevant entity. You can report a stolen driver’s license to the issuing state’s DMV/BMV, a stolen social security card to the Social Security Administration, and a stolen passport or passport card to the State Department. For all other stolen ID or documents, report it to whatever organization issued it.

Next: Check for Compromise and Dispute Fraud

Now that you have the start of a paper trail in place, you can move on the time-consuming part: Checking everything, disputing issues, and securing yourself against future compromise. People often get overwhelmed when thinking about what to do if your identity is stolen because this is the part that they picture. And it is a lot. Even if you caught it early and they haven’t done much, it’s challenging to check everything and everywhere to make sure. But it is possible.

Just like the previous steps, keep making a record of every phone call you make and letter you send. This will help you keep track of what you’ve done, and let you refer back to previous contact if there’s a problem. Consumer protection laws require written documentation, so many financial institutions don’t accept phone calls as formal disputes. Some have their own forms, others just want you to mail something. It’s a good idea to include a copy of your FTC affidavit with every letter. Also use certified mail or request delivery notifications for any physical mail you send so you know exactly when it arrived. Keep those confirmations with the rest of your records. This will be helpful if anyone ignores your disputes or if you need legal help in the future.

You don’t have to go through these steps in this specific order. Some of them may not apply to you, or there may be extra steps you need to do based on your specific situation. (See the “What to Do in Specific Identity Theft Situations” section for more details.) And very few of these are one-and-done situations – you will most likely be doing all of these at once, a little bit at a time, as you work to recover.

Places to Check for Fraudulent Activity

Identity thieves are creative and good at coming up with tricks that are useful to them and harmful to you. When trying to figure out what to do if your identity is stolen, it’s important to get as clear a picture as possible of what the thief did. Here are some of the places you should check for compromise, fraud, and unauthorized changes:

• Your credit report with all three bureaus (look at both the accounts and the names, addresses, and employment listed on the report)
• All of your existing financial accounts (including bank accounts, investment accounts, and credit cards)
• Social Security benefits (request a report of benefits you’re listed as getting by contacting the Social Security Administration)
• Employment records (check if someone is using your SSN for their work at ssa.gov/myaccount)
• Medical records and health insurance benefits
• State-based benefits like Medicaid, unemployment, and food stamps (unfortunately, since these are state-based, you’ll want to check with the state-specific agency in every state to be safe)
• Bank accounts that aren’t yours (ChexSystems is a bank reporting agency that tracks checking accounts; you can get a free copy of your report once a year at chexsystems.com)

Close Accounts Opened in Your Name

Now it’s time to start formally disputing fake accounts. Many banks and creditors have dispute processes posted online, or you could call and ask. Follow their process to explain that an identity thief opened the account, that it’s not yours, and that you want to close the account. Include a copy of your FTC affidavit. Also ask them for a letter stating that the account isn’t yours, you aren’t liable, and it was removed from your credit report. Keep this letter with all your other documentation on this situation.

Credit accounts, loans, mortgages, and even student loans all use roughly this same process. Some institutions or companies will have specific dispute processes or forms that they want you to use. But almost all will want a copy of your FTC affidavit. And make sure to get a letter stating you’re not responsible for the debt.

Dispute Fraudulent Charges on Real Accounts

If you discovered fraudulent charges on a genuine account, you probably started the dispute process back in step 1. But if not, or if you find new fraudulent charges after the fact, call the institution’s fraud department and ask how to dispute the fraudulent charges. Follow their process, and if they don’t provide a formal letter confirming the charges aren’t yours, ask for one.

Deal with Debt Collectors

One thing you may run into as you work through what you need to do if your identity is stolen is debt collectors. Identity thieves don’t pay their bills, and they leave your information with their creditors. Depending on how long it takes you to realize someone stole your identity, some of those bills may have gone to collections. In fact, for some people, getting a call from a collections agency about a debt they don’t know about is how they find out someone stole their identity in the first place.

If a debt collector calls you, you have the right to obtain information on the debt. And they must provide it in writing. Ask for the information, and when you receive it, confirm if it’s legitimate or if it’s a charge the identity thief put in your name. If it is fraudulent, write to the debt collector stating that someone stole your identity and it’s not your debt. Include a copy of your FTC affidavit, your police report, and any other documentation you have.

Fix Your Credit Report

Getting fraudulent accounts off your credit report is a big concern for people when thinking about what to do if your identity is stolen. All three credit bureaus have a dispute process. Follow the dispute process to say that you were a victim of identity theft and the accounts aren’t yours. Provide your FTC affidavit, and if you’ve already gotten a letter from a bank or creditor confirming that the account isn’t yours, include a copy of that, too.

If you have wrong information on your credit report (like name or address), you can also dispute that. Write to each of the three bureaus and explain that someone stole your identity and which information is wrong. Include a copy of your FTC affidavit. You have a right to exclude inaccurate or fraudulent information from your report, and the credit bureaus have to comply if you have the FTC identity theft affidavit.

You can also consider an extended fraud alert on your credit profile. The extended fraud alert is only available for identity theft victims and lasts for seven years. Unlike the regular fraud alert, it’s not just a notice that the company should verify a little more – the company has to contact you before they allow new credit in your name. You only have to set up this alert with one of the three bureaus, and you will need to provide a copy of the FTC affidavit.

What to Do in Specific Identity Theft Situations

Financial-related identity theft – accessing your accounts or getting new credit in your name – is the most common type. That means it’s also the type that existing systems are most prepared to deal with. The question of what to do if your identity is stolen gets a bit more challenging in certain specific situations. These are some things to know and steps to take that may not apply to every identity theft scenario, but might happen.

Medical Identity Theft

Medical identity theft is a specific type of identity theft where someone pretends to be you in order to get medical care or to use your health insurance benefits. This often won’t show up on a credit report (unless a fraudulent medical bill goes to collections). Instead, common warning signs of this one are bills for appointments or procedures you never had, Explanation of Benefits (EOB) documents from your health insurance listing services you never received, or major inaccuracies in your medical records.

You can report medical identity theft at identitytheft.gov as well. And the steps to dealing with it are pretty straightforward. Go through all your EOBs from your insurance, identify the fraudulent ones, and dispute them with your insurance company. Make sure their fraud department has a copy of your FTC affidavit on file. Contact any medical providers sending you bills for fraudulent services and send them a formal letter explaining the situation with your FTC affidavit. And request a copy of your medical records, identify any inaccuracies, and ask your providers to correct them. (Federal law gives you a right to view your records – if a provider doesn’t give them to you within 30 days, report it to the US Department of Health and Human Services.)

Fraudulent Tax Returns

In tax identity theft, someone gets enough of your information to file a fake tax return in your name. In many cases, the IRS’s internal processes pick up on the suspicious tax return, pauses the process, and sends you a letter asking you to verify your identity. If you’ve already gotten a letter about a duplicate or suspicious tax return in your name, there’s no need to file anything else – just follow the instructions in the letter.

If you haven’t received a letter but you think a criminal has used your identity to file tax returns, you’ll need to file IRS Form 14039. The good news is that in most cases, you don’t have to file it yourself. If you file an identity theft report with the FTC at identitytheft.gov, the system will automatically create and file that form for you.

The final thing you’ll want to do if your identity is stolen and used for fraudulent tax returns is create an identity protection PIN (IP PIN) with the IRS. This is a six-digit number that, once set up, is required to file your tax return. Even if a criminal has your identity information, if they don’t have your IP PIN, the IRS won’t accept their fake return.

Employment and Social Security Benefit Fraud

If an identity thief got your social security number, they could use it to get employment or to get Social Security benefits. If you haven’t already signed up for a my Social Security account at ssa.gov/myaccount, it’s a good time to do that. Once you’ve verified your identity, this online account will let you check what benefits you’re listed as getting and what employers your identity has been used at. If you see any benefits you’re not getting or employers you don’t recognize, call the Social Security Administration or go to your local SSA office.

You can also block all electronic access to your Social Security account by calling the SSA. If you do that, nobody, including you, can see or change information online or via phone until you remove the block. The E-Verify system also lets you “lock” your social security number so nobody, not even you, can use it to get a job. You can set up that lock at e-verify.gov/mye-verify. Just remember to remove the lock if you want to get a new job!

Checking Account Fraud

Criminals sometimes use stolen identities to set up checking accounts for money laundering. These are harder to identify because checking accounts don’t show up on credit reports. But ChexSystems is a reporting agency that monitors and tracks checking accounts specifically. They give consumers one free copy of their report every year. You can visit chexsystems.com to get your free report and see if there’s any checking accounts you don’t recognize. If there are, you can dispute them with ChexSystems. It’s also a good idea to contact the bank those accounts are at, report the fraud, and ask the banks to close those accounts.

Renting in Your Name

It can be challenging to discover that someone used your identity to rent a house or apartment in your name. Often, people don’t discover it until they apply to rent and are rejected for having a poor payment history or eviction on their record that they didn’t know about.

If this happens to you, ask the landlord what service they used to verify your tenant history. Then contact that service and ask for a copy of your history. Once you get the copy, review it and identify which information is fraudulent. Then ask the service what you need to do to correct that information. You will probably need to provide your identity theft affidavit.

Filing Bankruptcy in Your Name

If you find out that someone filed bankruptcy in your name, you need to deal with it quickly. It will be a messy and difficult situation. Start by writing to the US Trustee in the region where they filed the bankruptcy. Explain that someone stole your identity and include a copy of your FTC affidavit. But it’s almost definitely a good idea to hire a lawyer in this scenario.

Getting Arrested in Your Name

Identity theft is great any time criminals don’t want to have their real identity associated with their activities. That includes getting arrested. If someone gave your information when they got arrested, you need to deal with it right away.

Start by contacting the law enforcement agency that arrested them. You may need to check the court records to find that information. File a police report for impersonation. They will probably want your fingerprints, a recent photo of you, and other identity documents. Ask them to compare your information to the person they arrested. Once they’ve verified that the person they arrested wasn’t you, ask them to change your name in their records and provide a “clearance letter” or “certificate of release” declaring that it wasn’t actually you they arrested and they don’t suspect you of the crime(s). Carry this letter with you at all times.

If a court prosecutes someone under your name, contact the court. Provide proof of your identity, ask the District Attorney’s office to help clear your name in the court records and ask for a “certificate of clearance” to declare your innocence. Also consider hiring a criminal defense lawyer.

If you get denied employment or housing because your identity was stolen and someone used it when they got arrested, ask what background check company they used. Contact that company, provide all of your records (including your certificates of clearance and FTC affidavit) and ask that it be removed from your record.

Secure Yourself and Stay Safe Going Forward

The hardest part about figuring out what to do if your identity is stolen is that it’s not just a single thing. Even after you check for fraudulent activity, dispute problems, manage debt collectors, fix your credit, and handle all the specific and unique situations that might come up, you’re not out of the woods yet. Your identity is out there. And some kinds of compromise can hide for months or years. (If someone rents a property in your name, for example, you may not find out until the next time you try to get an apartment.)

Criminals often sell identities to other criminals when they’re done using them. Having your identity stolen once makes you much more likely to have issues pop up in the future. So it’s crucial to secure yourself as much as possible now and stay alert going forward.

Important Steps to Take

These are important steps you should take now to secure yourself and prevent more damage.

• Change your password. It’s best to do this for every account, but at the very least, your financial accounts. Use a long, strong, and random password that you don’t use anywhere else. (A password manager makes this easier.)
• Turn on multi-factor authentication (MFA) on every account.
• Secure your email account.
• Put a fraud alert or freeze on your files with all three credit agencies.
• Consider “locking” your Social Security Number at e-verify.gov/mye-verify so no one can get a job in your name.
• Set up an IP PIN with the IRS to prevent people from filing taxes in your name.

These steps aren’t a one-time thing, but are important things to do going forward to protect yourself.

• Keep monitoring your credit. It may take some time for fraudulent accounts to show up, so check for information and accounts (even accounts that are in good standing) that aren’t yours.
• Limit what you share online. The less you share on social media and other places online, the safer you’ll be.
• Don’t share your info if you can help it. Even in person, ask if a particular form needs that specific information. If you can avoid sharing, don’t share.
• Beware recovery scams. These scams target victims and claim they can get your losses back for a fee. But they can’t – they’re just stealing your money.
• Watch out for more phishing and scams. A lot of scammers like targeting victims. And since your identity info is out there, especially beware of things that look official or seem to know your information already.
• Use a password manager and MFA for everything. This is one of the best steps you can take to secure yourself online.