Recovering From Identity Theft

Discovering that someone has used your identity is disorienting: a bill for a card you never opened, a letter from the IRS saying you already filed, a collector calling about a car loan. The damage is real but usually repairable, and the law gives victims specific tools that work faster than arguing account by account. This chapter sets out how to recognise identity theft, what to do in the first day, how to clear fraudulent accounts from your record, and how the special cases (tax, medical, children) differ.

How it shows up

Identity theft rarely announces itself. These are the common signs:

• Bills, statements or collection calls for accounts you did not open.
• Hard inquiries or accounts on your credit report you do not recognise.
• Charges or withdrawals you did not make, or mail from your bank that stops arriving.
• A notice that a tax return was already filed in your name, or that you have income from an employer you never worked for.
• Medical bills or insurance statements (explanation of benefits) for care you did not receive.
• Text or email codes you did not request, or a sudden loss of mobile signal, which can mean your number was moved to another SIM.
• Being turned down for credit you expected to get.

Any one of these is a reason to look closer the same day. Speed limits both the damage and, for bank accounts, your legal liability.

The first day: contain it

Work in this order. Each step takes minutes to an hour.

1. Secure your email and phone. If the criminal controls either, they can reset everything else. Change the email password, sign out of other sessions, and call your carrier to check for a SIM change and add a port-out PIN (chapter 2).
2. Call the fraud departments of every company where something happened. Ask them to close or freeze the affected accounts, issue new card numbers, and send you written confirmation. Write down the date, the name of the person and what they agreed to do.
3. Freeze your credit at all three bureaus, if it is not already frozen, so no further accounts can be opened. Place a fraud alert with one bureau as well; it will pass the alert to the other two.
4. Change passwords on financial accounts, starting with any that share a password with a breached account, and turn on strong second factors.
5. Check your other accounts for changes to addresses, phone numbers, payees or linked bank accounts.

The report that unlocks your rights

The Federal Trade Commission runs IdentityTheft.gov, the official federal site for reporting and recovering from identity theft. You describe what happened, and it produces two things:

• An FTC Identity Theft Report. This is the document that gives you the stronger legal rights below. In most cases it replaces a police report, though some creditors still ask for one, and a police report can help if you know who the thief is or a large loss is involved.
• A personal recovery plan with prefilled letters to bureaus, creditors and debt collectors, which you can update as you go.

With an Identity Theft Report you can:

• Have fraudulent information blocked from your credit reports. Under the Fair Credit Reporting Act, a bureau must generally block information resulting from identity theft within four business days of receiving your report and proof of identity. This is faster and firmer than an ordinary dispute.
• Place an extended fraud alert that lasts seven years.
• Get copies of the documents the thief used to open accounts, which helps you prove the fraud and find other exposures.
• Stop companies reporting the debt. Once a creditor or collector receives your report, it must stop sending the fraudulent debt to the bureaus, and a collector you dispute a debt with must verify it before continuing to collect.

Clearing the accounts and debts

For each fraudulent account, send the creditor a written dispute saying the account was opened through identity theft, with a copy of your Identity Theft Report. Ask them to close it, remove it from your credit reports, and confirm in writing that you are not responsible. Use the prefilled letters from IdentityTheft.gov and keep copies of everything, ideally sent by a method that gives proof of delivery.

Then follow up. Pull your reports again after 30 to 60 days to check the accounts and inquiries have gone. Expect some items to need a second letter. Recovery from a serious case can take months of intermittent work, which is why keeping a dated log from the start pays off.

What you are liable for

Federal law limits the money you can lose to fraud on existing accounts, which is why the first-day calls matter:

• Credit cards: at most $50 for unauthorized use, and most issuers charge nothing.
• Debit cards and electronic transfers: at most $50 if you report a lost or stolen card or code within two business days of learning of it, up to $500 if you report later, and potentially unlimited for transfers after the 60-day window that follows the statement showing the first unauthorized one.
• New accounts opened in your name: you are generally not responsible for debts you did not authorize, but you do need to dispute them so they come off your record.

Identity theft insurance usually does not pay stolen money back; the protections above do that. What it typically covers is the cost of recovery: lost wages for time off, notary and mailing costs, sometimes legal fees, and access to a case manager. Many policies are bundled free with bank accounts, card memberships or homeowners policies, so check what you already have before buying one.

Special cases

Tax identity theft. A thief files a return with your Social Security number to collect a refund. Signs are an IRS letter about a return you did not file, or your e-filed return being rejected as a duplicate. File IRS Form 14039, the Identity Theft Affidavit, if the IRS has not already flagged the problem, and keep filing your own return (on paper if needed). Any taxpayer who can verify their identity can request an Identity Protection PIN from the IRS: a six-digit number, issued fresh each year, without which an electronically filed return using your number is rejected. It is free and one of the most effective prevention steps.

Medical identity theft. Someone uses your health insurance to get care, which can leave false entries in your medical records as well as bills. Read every explanation of benefits from your insurer, ask providers for your records and an accounting of disclosures, and ask them to correct anything wrong.

Child identity theft. A child's Social Security number has a clean history and no one checks it for years. Warning signs include pre-approved credit offers or collection notices addressed to the child. You can ask each bureau whether a file exists for your child, and place a freeze for a child under 16 even if none does.

Social Security number misuse. If someone is working under your number, the earnings may appear on your Social Security record. Check your earnings history in your online Social Security account each year and report wages that are not yours.

YOUR NEXT STEPSDo this now

1. Bookmark IdentityTheft.gov and keep your bureaus' freeze logins in your password manager, so you can act within minutes if it ever happens.
2. Request an IRS Identity Protection PIN for yourself, your spouse and your dependents.
3. Check what identity theft cover you already have through your bank, card or home insurance before paying for a separate plan.
4. Create your own online Social Security account and review your earnings record.
5. Start a simple log (a document or notebook) for any fraud call or letter, with dates, names and reference numbers.