What to Do If You've Been the Victim of Identity Theft
Like many medical conditions, the more time that passes before you get a diagnosis and begin treatment for identity theft, the more painful and substantial the treatment can be. If it does happen and you address it quickly, you can often reduce the pain and fix it in less time and for less hassle.
Say you've found that an unauthorized account has been opened. Or you've been notified that one of the companies you do business with has been breached, and hackers have all of your information. What do you do first?
The first step is to put a specific fraud alert on your credit file with each of the three bureaus. This requires them to notify you if anyone requests to see your credit or if an attempt is made to open a new credit account in your name.
You only have to request this from one of the individual bureaus, and they're required to notify the other two, but you must renew this request every 90 days. You can find the contact information for each bureau and where to call on my website.
Go through all your reports from all three bureaus to identify any kind of unauthorized activity. Hackers will often open a small and hopefully unnoticeable account and test it out to see if the victim notices what's going on. Your job is to go through and identify any accounts you didn't open, inquiries you didn't authorize, and balances and debts you don't recognize. You also need to go through and make sure there are no variations of your name, address, and Social Security number on the report.
If you see an address you don't recognize, it could be the result of an honest mistake—or it could be evidence that a hacker put new information into your report.
Keep detailed notes on any discrepancies you find, and bring the information to your local police precinct to file a report. That report establishes the baseline for what has happened—and is something you're probably going to need to give to your creditors later on. When you get to the precinct, they're going to ask you a series of basic questions about what happened and to provide a statement of the facts. You'll also probably be asked for a copy of the account numbers and the credit report that shows the infiltration.
Resist the temptation to believe that the police are going to go out and immediately start beating the bushes to find the person who hacked you. They almost never do—and it's almost never somebody nearby that did it. What you're doing is simply establishing a record and proving to the creditors and bureaus that you jumped through the right hoops.
Once you've found the compromised accounts, call those creditors and ask to speak to their fraud department. Tell them you have reason to suspect identity theft, and ask them to close or freeze the affected accounts. Different companies might have slightly different policies and timelines for how to do this, but they all have to follow the law—and they have to freeze the accounts at your request. Let each creditor know you'll be sending (in writing) requests for applications and records pertaining to those accounts, and ask what documentation and forms they will need from you—and where to send them.
If it's your bank that has been affected, go to a branch in person and request to speak to a fraud specialist. Tell them about the breach, and request that all of your accounts—checking, savings, credit cards—be assigned different account numbers or closed. This is extremely important in a world where so many accounts are connected to each other digitally. Crooks will quickly try to transfer cash between your accounts, and your checking and savings could be drained before you even notice. That's a bigger headache to deal with in comparison to a credit card dispute because credit card companies have very specific rules in place about disputes that are built in your favor. It's harder—and takes longer—to get cash restored to checking, savings, and debit card accounts, so it is crucial that you act on those issues very quickly.
Next, go to the identity theft website for the Federal Trade Commission, IdentityTheft.gov, and fill out the online Identity Theft Report form. This will create a specific file you can print out and use in conjunction with your police report to prove to creditors that you've been victimized.
From the time you file your paperwork with the FTC and your creditors, it usually takes about 60 days for the compromised accounts to be deleted from your credit report. That's obviously something you have to continuously monitor.
How to Freeze Your Credit
Once the affected accounts have been frozen or cancelled and you've created new, legitimate accounts, you can activate the one tool that can almost guarantee you won't experience identity theft in the future. In fact, you might want to use this tool even if you haven't been victimized.
I first learned about credit freezing when I was talking to a colleague about a series of high-profile entertainers who had been the victims of identity theft. The thieves had secured the complete identity credentials of a bunch of famous people, including many members of President Obama's cabinet. The representatives of one of the celebrities involved asked me to help untangle the issues their client faced. As they described what had happened, a question popped into my head.
Why hadn't President Obama's identity been compromised?
Simple, said the folks from the entertainer's office. The president had a complete credit freeze on his account.
In a freeze, nobody can even inquire about your credit without your direct, authorized permission through the use of a secret PIN. Nobody will be able to open an account in your name because nobody will be able to see your credit information and make a decision about it. It can certainly make some day-to-day activities more clunky to accomplish—because the freeze has to be specifically lifted for you to, say, get a car insurance quote. But there's no more effective way to lock down your information so that only those people you authorize can see it. It's very different than a fraud alert, which only tells you about activity as it goes on. The freeze stops things from happening before they start.
Obviously, the credit bureaus aren't super excited for you to be able to do this because they're in the business of doing business. They (and the credit card companies) accept a certain amount of inevitable credit card fraud as the price of making transactions go through quickly and smoothly. But the rules are in place for you to do it, provided you follow these specific steps.
First, use the numbers and websites on my website to contact each credit bureau separately to request the credit freeze. You'll be required to give your name, Social, address, and date of birth, and pay a nominal fee ($10 per bureau, sometimes free if you've already been the victim of identity theft). Once you register, you'll get a letter in the mail from each bureau with a PIN. If you ever want to lift the freeze—say, to apply for a mortgage—you need to call each bureau and use the PIN to give access to your credit, which will be provided within three days. You can either provide access to a specific creditor or open your account to anybody for a specific period of time. Lifting the freeze also costs $10 for each bureau.
To re-freeze your account afterward, you'll have to go through the process again with all three bureaus and pay the fee again. It's designed to be a headache, but an hour of effort each time you have to do it will give you the ultimate peace of mind.
After you've sorted out the affected accounts, it's important to go back to each creditor and request a letter from them that recounts the basic facts—that your account was fraudulently opened or tampered with and that it has been closed. That documentation will help down the line if you have a dispute with one of the credit bureaus about something that is appearing on your credit report when it shouldn't.
You should also consider removing yourself from the national databases that marketers use to send you unsolicited offers for things like credit cards. To opt out of mailings, go to DMAChoice.com and fill out the online form. You can do the same for telemarketing by going to the Federal Trade Commission's registry at donotcall.gov.
Most of all, don't get discouraged. Identity theft can be scary and demoralizing, but even the worst cases can be turned around with some knowledge and persistence.
Excerpted from YOUR SCORE by Anthony Davenport. Copyright © 2018 by Anthony Davenport. Reprinted by permission of Houghton Mifflin Harcourt Publishing Company. All rights reserved.