Every year, identity theft targets tens of millions of Americans, causing billions of dollars in losses. These incidents also take an incalculable toll in anxiety, hassle and loss of victims' valuable time. The best way to combat identity theft is to avoid it altogether, but if you or a loved one has been victimized, it's important to know what to do in the immediate aftermath.
Here are seven things you should do as soon as possible after discovering an instance of identity theft.
1. Place a Fraud Alert on Your Credit Report
You have the right to place a temporary fraud alert on your credit report. With a fraud alert, lenders are asked to verify your identity before processing any applications for loans or credit cards. This can prevent criminals who've stolen your personal information from obtaining credit in your name and then tarnishing your credit score when they fail to repay.
Placing a fraud alert with any of the three national credit bureaus automatically notifies the other two bureaus to do the same. So if you request a fraud alert from Experian, Equifax and TransUnion will follow suit.
A temporary fraud alert lasts for one year. You can remove a fraud alert at any time by notifying each credit bureau separately.
You also have the right to request an extended fraud alert, which lasts seven years but requires proof you've made an identity theft complaint to law enforcement (see more on that below), or add a security freeze or credit lock at each of the credit bureaus, to further restrict access to your credit reports.
2. Report Identity Theft to the FTC
Use the Federal Trade Commission website IdentityTheft.org to file a theft report. The interactive form asks questions about your incident, guides you to appropriate resources based on your answers, and generates an Identity Theft Victim's Complaint and Affidavit you can provide to law enforcement agencies—and use to place an extended fraud alert on your credit reports.
3. Review Your Credit Reports
Check your credit reports from all three national credit bureaus for signs of unfamiliar accounts or credit applications. Each account listed on your credit report should include contact information for the creditor that you can use to inquire about any suspicious entries. As appropriate, let the creditors know the activity was unauthorized and ask them to investigate.
Once you've alerted all creditors about potential fraud, be aware that you have the right to dispute credit report information with each credit bureau. By filing a dispute, you're requesting to have unauthorized activities and accounts removed from your credit reports.
4. Assess the Damage and Report the Fraud
Unfortunately, a single incident of identity fraud may just be the tip of the iceberg. Once criminals have your personal information, they may attack you on multiple fronts and/or sell your credentials to other crooks via exchanges on the hidden "dark web." If you've been victimized, It's therefore important to look for signs of additional fraud and report them as appropriate:
- Review bank and credit card statements for unauthorized transactions. Unfamiliar charges and withdrawals are obvious signs of potential trouble, but unexplained credits and deposits can also indicate trouble. Sometimes crooks make small deposits to verify your account information before attempting a big withdrawal. Regularly check your account for any unfamiliar charges and report any unexplained transactions to the financial institution or lender as soon as possible. First, though, make sure they aren't authorized transactions to businesses using unfamiliar names or third-party payment processors.
- Check for your personal information on dark web sites. A credit monitoring service such as one included in an Experian Premium membership can search the dark web for instances of your email addresses, Social Security number (SSN), passwords and account numbers, alerting you to potential vulnerabilities. Carefully check the status of each account, change passwords and notify the account issuers as needed if you find evidence of fraud or theft.
- Check your Social Security statement. A compromised Social Security number can be big trouble because SSNs are associated with credit reports and federal income taxes as well as government retirement benefits and Medicare. Check your Social Security user account (set one up for free if you haven't already done so) for signs that your benefits are being misappropriated.
- Check your personal account at the IRS. A popular use of stolen SSNs is to impersonate victims and claim their federal tax refunds. Check your personal online account at the IRS to make sure no one has tried to file a tax return in your name. If you don't have an online account at the IRS, you can set one up in a few minutes. If you can't access an existing account, or if you're told an account already exists when you try to set up a new one, someone may have hijacked your tax information, and you should contact the IRS to investigate.
5. Contact Your Creditors and Financial Institutions
Notify creditors and financial institutions immediately if you believe a fraudulent account has been opened in your name, or if you discover transactions you didn't authorize. The sooner you notify them, the sooner the institutions can investigate, halt future bogus transactions and, as appropriate, look into restoring stolen funds or removing unwarranted penalties incurred because of fraudulent activity.
6. Notify Appropriate State and Federal Agencies
Identity theft and identity fraud can take many forms, and it's important to notify the appropriate law enforcement agencies for the type of crime you've experienced. In addition to the agencies listed below, it's probably wise to inform the appropriate law enforcement agency, and to share a copy of your FTC complaint and affidavit with them. This may help them coordinate with state federal authorities as appropriate.
| Type of Identity Theft | Who to Notify |
|---|---|
| Driver's license fraud | Your state's department of motor vehicles |
| Social Security fraud | The FTC and U.S. Social Security Administration |
| Passport fraud | U.S. State Department, Passport Services Department |
| Tax fraud | The FTC and IRS |
| Mail theft or fraud | U.S. Postal Inspection Service |
7. Change Your Passwords
If any account information turns up in dark web scans, or you receive information about a data breach at any company or institution where you have an online account, it's important to update your passwords immediately. It's also a good idea to:
- Update passwords that are more than a year old.
- Activate multifactor authentication on password-protected accounts, which requires access to your phone or email as well as a password when logging in to your accounts.
- Enable fingerprint or facial recognition access on smartphone apps, to thwart fraudsters who might steal your phone.
- Consider using a password manager that can generate complex, highly secure passwords and remember them for you. Free versions of several excellent ones are available.
The Bottom Line
Repairing a damaged credit report can take months and even years, so it's important to act quickly and relentlessly if you or a family member has been a victim of identity theft. Notify creditors, financial institutions and law enforcement immediately, follow up by securing your credit reports and doubling down on security with all your personal accounts.
Also be watchful for follow-up attacks by monitoring account statements and activity. To help in these efforts, consider using one of Experian's identity theft protection plans, which alert you when there's new activity on your Experian credit report, include a one-time scan of the dark web for your personal information and more.