What to Do If You Are a Victim of Identity Theft
Recognizing That Your Identity Has Been Stolen
Telltale signs of identity theft include the following:
•Bills/collection contacts/financial institution statements concerning transactions you know nothing about
•Inquiries on your credit reports from businesses that you do not recognize or have not done business with
•Information/transactions on your credit report that do not belong to you (this can also be a “mixed-file” problem)
•Changes in your credit score that are not consistent with your own credit activity
•Notices from businesses that your information has been compromised by a data breach
•Failure to receive bills/statements you expect to receive (because they have been rerouted by the identity thief)
•Your checks being refused acceptance
Repairing Damage to Your Credit Report—Reports You Must File
Identity-theft victims must go through a lengthy and sometimes frustrating process to correct the harm. It is important to act promptly, document all actions taken, and insist that creditors and credit bureaus comply with their legal obligations.
If you suspect that accounts were opened through identity theft, call the creditors involved. Ask for the fraud department. Explain that someone stole your identity. Insist that they close or freeze the accounts, so no one can add new charges unless you agree. Change all logins, passwords, and personal identification numbers (PINs) for your accounts. Send a letter to each creditor confirming your report. Keep a copy.
Victims of identity theft need to promptly file an identity-theft police report and fill out a Federal Trade Commission (FTC) identity-theft affidavit (the form is on the FTC website at http://www.consumer.ftc.gov/articles/pdf-0094-identity-theft-affidavit.pdf) and save a copy. Submit the report and affidavit to each credit bureau, specifying the information on the report that is not yours. Also include your name, address, and Social Security number. If you submit a police report and affidavit, the credit bureaus are required to block the information and “tradelines” from appearing on your report. Also submit a copy to the FTC.
The contact information of the major credit bureaus for this purpose are as follows as of June 2015:
Equifax.com
P.O. Box 105069
Atlanta, GA 30348-5069
1-800-525-6285
Fax 770-375-2821
Experian.com
P.O. Box 2104
Allen, TX 75013
1-888-397-3742
TransUnion.com
Fraud Victim Assistance Department
P.O. Box 6790
Fullerton, CA 92634
1-800-680-7289
Fax 714-447-6034
These numbers and addresses change from time to time, so check before use.
Once the information is blocked, it won’t show up on your credit report, and companies can’t try to collect the debt from you.
The complaint form is not available on mobile devices, but you can call 1-877-438-4338 to make your report.
Print and save your FTC identity-theft affidavit immediately. Once you leave the page, you won’t be able to get your affidavit.
Victims should also contact the credit bureaus and ask them to put an extended fraud alert or a security freeze on their credit files to prevent further damage. This can be done orally with written confirmation.
If you contact one of the three credit bureaus, that company is required to tell the other two. However, we recommend contacting all three.
A security freeze prevents all access to your credit report. It does not prevent misuse of existing accounts by an identity thief. If you want to apply for credit yourself, you must ask the credit bureau(s) to lift the freeze, permanently or temporarily.
A fraud alert allows access to your credit report but advises creditors to contact you by telephone before extending credit. (This is a request; contact is not mandatory, but most creditors comply.) We suggest a fraud alert so that you can continue obtaining credit.
NOTE
There is no charge for a fraud alert; there may be a charge for a freeze, depending on state law.
A fraud alert entitles you to two free credit reports within two months and requires that you be removed from marketing lists based on prescreening of credit reports for five years. The alert stays in place for seven years.
Under the Fair Credit Reporting Act (FCRA), identity-theft victims have the right to request from the credit grantor the credit application and other documents relating to the account opened by the ID thief. We strongly recommend doing this because the documents (e.g., signatures and addresses on an application) may help victims prove that they did not open the account themselves. Make the requests in writing and keep a copy. Some creditors, mainly smaller ones, may not understand that they have to provide this information, so insist that they do so.
Identity-theft victims should promptly contact any company that has issued credit in their name, inform them of the fraud, and demand that they immediately close the account. If you do this orally, send written confirmation afterward, and ask for written acknowledgment that the account has been closed, that you are not being held responsible for it, and that it is being removed from your credit report. Most large credit grantors have a fraud department; ask for that department.
Write down whom you contacted and when. Keep copies of all correspondence.
As soon as possible, send the creditor a copy of your police report and FTC ID theft affidavit. The company may request these items. However, do not delay providing notification until these documents are available.
If you receive collection letters on an account that is not yours, send a similar letter and provide the same documentation. Try to do so within thirty days of receipt of the initial collection letter to preserve your rights under the Fair Debt Collection Practices Act (FDCPA), where applicable.
Removing Unauthorized Charges from Accounts
If the problem is that the identity thief placed bogus charges on accounts that you did open, the procedure is similar. Call the fraud department of each business. Explain that someone stole your identity. Tell them which charges are fraudulent—be very careful to specify which charges are clearly unauthorized and which you have questions about. Send a confirming letter.
Ask the business to remove the bogus charges. Ask the business to send you a letter confirming the fraudulent charges were removed, that you are not being held liable for them, and that credit reporting will not include the fraudulent charges.
Write down whom you contacted and when. Keep copies of all correspondence.
The business may require you to send it a copy of your identity theft report or complete a special dispute form. Provide this information.
Other Steps That You May Need to Take
If you receive a notice from the Internal Revenue Service (IRS) indicating that a tax return has been filed using your Social Security number or tax ID number, call the IRS right away.
Complete IRS Form 14039, Identity Theft Affidavit. Mail or fax the form according to the instructions. Include proof of your identity, such as a copy of your Social Security card, driver’s license, or passport.
Did the notice say you were paid by an employer you don’t know? Send a letter to the employer explaining that someone stole your identity and that you don’t work for the employer.
File your tax return, and pay any taxes you owe. You might have to mail paper tax returns.
Write down whom you contacted and when. Keep copies of any letters you send.
If these steps don’t resolve your situation, contact the IRS’s Identity Protection Unit at 1-800-908-4490.
Victims of ID theft should request credit card companies and banks to issue new account numbers. Make sure that they are notified that the prior information was or may have been compromised and that they should not automatically transfer activity on the old account to the new one. Confirm such instructions in writing.
Summary
Prompt action can mitigate or avoid financial loss from identity theft. File a police report, fill out the FTC identity-theft affidavit, and notify the creditors and credit bureaus.
TIP
Change all passwords and PINs used prior to the incident, on all accounts.