Identity-Theft Rights, Fraud Alerts, and Credit Freezes

What to Do First After Suspected Identity Theft

1. Contact affected banks, card issuers, lenders, or service providers.
2. Freeze or lock compromised accounts and replace cards where necessary.
3. Change passwords and enable multi-factor authentication.
4. Review recent transactions and credit reports.
5. Place a fraud alert or security freeze.
6. Report the identity theft at IdentityTheft.gov.
7. Create a written list of every fraudulent account, inquiry, address, and transaction.

Fraud Alert vs. Security Freeze

How an Initial Fraud Alert Works

An initial fraud alert generally lasts one year unless removed sooner. It tells businesses that check your credit report to take reasonable steps to verify your identity before opening a new account, issuing an additional card, or increasing a credit limit based on a consumer request.

Placing an alert with one nationwide credit bureau generally requires that bureau to notify the other two.

Extended Fraud Alerts

Eligible identity-theft victims may request an extended fraud alert that generally lasts seven years. An identity-theft report or other required documentation is generally needed.

Extended alerts can also provide additional free credit-report disclosures and removal from certain prescreened offer lists for an extended period.

How a Security Freeze Works

A security freeze prevents prospective creditors from accessing your credit file. Because many lenders will not open a new account without reviewing a report, a freeze can make new-account identity theft more difficult.

Freezes are free to place, lift, and remove. You generally must contact Equifax, Experian, and TransUnion separately.

What a Credit Freeze Does Not Do

• It does not prevent fraud on an existing bank or credit-card account.
• It does not stop tax, medical, employment, utility, government-benefit, or account-takeover fraud by itself.
• It does not remove inaccurate information already in a report.
• It does not prevent all companies with existing legal access from reviewing a file.
• It does not lower or raise a credit score.

Continue monitoring existing accounts even when every bureau file is frozen.

Use IdentityTheft.gov

IdentityTheft.gov is the Federal Trade Commission's official identity-theft recovery website. It can help you create an FTC identity-theft report and a personalized recovery plan.

The report may support:

• Credit-report blocking requests.
• Fraudulent-account disputes.
• Requests for records related to identity theft.
• Extended fraud alerts.
• Communication with creditors, collectors, and reporting companies.

Blocking Fraudulent Information From Credit Reports

The FCRA provides a process for identity-theft victims to request that fraudulent information be blocked from consumer reports when required documentation is supplied.

A request commonly includes:

1. Proof of identity.
2. An identity-theft report.
3. Identification of the fraudulent accounts or information.
4. A statement that the information did not result from your transaction.
5. Any bureau-specific form or required documentation.

A block is different from an ordinary dispute and is intended for genuine identity theft.

Dispute Fraudulent Accounts and Inquiries

Review all three credit reports and identify every fraudulent account, inquiry, address, employer, and personal-information variation.

Dispute with:

• The credit-reporting company displaying the information.
• The business that furnished the information.
• The creditor or collector associated with the fraudulent account.

Request Records Related to Identity Theft

Identity-theft victims may have rights to obtain application and transaction records from businesses where fraudulent transactions occurred, subject to identity-verification and documentation requirements.

These records may help identify:

• The address, telephone number, or email used.
• The application date and channel.
• Items purchased or transferred.
• Shipping or delivery information.
• Payment methods or linked accounts.

Protect Existing Accounts

A freeze mainly helps with new-account fraud. Existing-account takeover requires separate action.

1. Change passwords and security questions.
2. Sign out of other sessions and remove unknown devices.
3. Replace compromised cards and account numbers.
4. Review authorized users and linked payment methods.
5. Enable transaction alerts.
6. Review statements and digital-wallet activity.
7. Contact the institution's fraud department.

Review Specialty Consumer Reports

Identity theft can affect more than the three nationwide credit bureaus. Depending on the fraud, review specialty reports involving:

• Bank and checking-account history.
• Tenant screening.
• Employment screening.
• Insurance claims.
• Utility and telecommunications accounts.
• Medical records or benefits.

Use the adverse-action notice or account records to identify which specialty reporting company may have relevant information.

Medical, Tax, and Government-Benefit Identity Theft

Credit freezes do not fully protect against fraud that does not require a credit check.

For medical identity theft, review explanation-of-benefits statements and contact providers and insurers. For tax identity theft, follow IRS identity-theft procedures. For government-benefit fraud, contact the administering agency promptly.

Protecting a Child's Credit File

A parent or legal guardian can request a protected-consumer security freeze for a minor child. The bureaus may require proof of identity, authority, and the child's identifying information.

Child identity theft can remain hidden for years because children usually do not apply for credit. Unexpected bills, collection letters, or credit offers may be warning signs.

Protecting the Credit File of a Deceased Person

An authorized representative may notify the nationwide bureaus of a death and request protective steps. The bureaus generally require documentation such as a death certificate and proof of authority.

Also notify financial institutions, benefit agencies, insurers, and other relevant organizations.

Monitor After the Immediate Recovery

Avoid Identity-Theft Recovery Scams

• Do not pay someone to place a credit freeze; freezes are free.
• Do not give one-time security codes to an unsolicited caller.
• Do not allow remote access to your device.
• Do not file a false identity-theft report to remove legitimate debt.
• Do not trust a guarantee that every negative account will be deleted.
• Verify government and bureau contact information independently.

Your Identity-Theft Recovery File

• FTC identity-theft report and recovery plan.
• Police report when appropriate.
• Dated credit reports.
• Freeze and fraud-alert confirmations.
• Fraudulent-account lists.
• Dispute and blocking requests.
• Delivery confirmations and case numbers.
• Creditor, collector, and bureau responses.
• Transaction records and account statements.
• A master timeline of every action.

Common Identity-Theft Recovery Mistakes

• Placing a freeze with only one bureau.
• Assuming a freeze protects existing accounts.
• Failing to review all three reports.
• Using a standard dispute without an identity-theft report when a block is appropriate.
• Deleting scam messages before preserving evidence.
• Missing fraudulent addresses and inquiries.
• Paying for services that are available free from official sources.
• Filing a false identity-theft report.

Your Identity-Theft Checklist

1. Secure affected accounts and devices.
2. Change passwords and enable multi-factor authentication.
3. Place fraud alerts or freezes.
4. File a report at IdentityTheft.gov.
5. Review all three credit reports.
6. List every fraudulent account, inquiry, address, and transaction.
7. Submit blocking and dispute requests with documentation.
8. Request fraud-related records from affected companies.
9. Monitor existing accounts and specialty reports.
10. Keep the recovery file organized.
11. Continue to Lesson 10 for credit-repair scams and consumer protections.