Finance 101 Uh-Oh… Your Identity Has Been Stolen! Now What?

by Karen Gibbs | January 29, 2019

You see an unfamiliar charge on your credit card statement or a random bill arrives in the mail for an account you didn’t open.

Odd, but nothing that warrants too much suspicion. Until it happens again next month — and the next.

Suddenly it becomes apparent that you could be the victim of identity theft. Give yourself a minute to deal with the panic and confusion. Then shake off the shock and spring into action with this step-by-step plan.

Six steps to take right now

1. Call the fraud departments of each account affected

Explain that there’s a suspicious charge and you think your identity has been stolen. Close or freeze the account; change the log-ins, passwords and PINs on this and all of your other accounts. “If no new charges appear within two weeks, the thief likely only had your credit card number,” says Carrie Kerskie, director of the Identity Fraud Institute at Hodges University in Naples, FL. “However, if new charges are made on the new account, or if there are wire transfers out of your bank account, or a change of address on your bank or credit card statement, then the thief has access to your name, address and Social Security number.”

In that case, close the account and ask that the new one be password-protected from further inquiries or changes. If you even suspect that a thief tampered with your bank accounts, checks or ATM card, close the accounts, and request password-only access to the replacements. In the case of compromised ATM cards, cancel the card and get another with a new PIN. If your investments are tampered with, immediately contact the investment company and notify the Securities and Exchange Commission at (202) 942-8088. Always write down whom you contacted and when.

2. Contact leading credit bureaus

Get in touch with Experian, TransUnion, Equifax, and Innovis (a lesser known bureau). Place a free, 90-day fraud alert on your account and ask each credit bureau to send you a letter confirming that this has been done. With a fraud alert in place, a business should verify your identity before issuing new credit in your name. Kerskie says to be aware, however, that there are unscrupulous businesses that do not verify identity. A fraud alert can be renewed after 90 days; an extended fraud alert costs nothing and lasts for seven years.

By federal law, when you initiate a fraud alert with one of the three major credit bureaus one must notify the other two. Since Innovis collects data on a smaller scale, it is your responsibility to request a fraud alert be placed on your Innovis credit report, too.

3. Place a credit freeze

Contact each credit bureau directly by telephone, mail, or online to place a credit freeze. You can still open new accounts under a freeze, but you may be charged a fee (up to $15) to establish the freeze and another fee each time you temporarily lift it. If you place a credit freeze by phone, you may be talked into buying credit monitoring or a credit lock. These are not the same as a credit freeze. If you do not have a PIN at the end of the conversation, then a credit freeze has not been established.

Kerskie also advises placing a credit freeze with the National Consumer Telecom Utilities Exchange (NCTUE) to protect against thieves opening a cell phone or other utility account in your name. NCTUE is a credit-reporting company used by the telecommunications, pay TV and utility industries. Since participating companies check credit for new accounts through NCTUE and not through the other bureaus, it is vital to place a credit freeze with NCTUE, too.

4. Request credit reports from all major credit bureaus

Consumers can request their credit report from each of the three major credit bureaus once per year, at no cost, by visiting To obtain your Innovis or NCTUE report, contact the organization directly and review the reports to make sure your Social Security number, address(es), name and employers are correct.

Notify a credit bureau of any discrepancies or additional evidence of fraud, such as unrecognized charges or new accounts. This information is needed when you report the theft to the Federal Trade Commission (FTC) and the police. If “Inquiries” appear from companies where fraudulent accounts were opened, request that those “Inquiries” be removed. In a few months, request copies of your credit reports again. Verify that all corrections have been made and that no new fraudulent activity has taken place. Again, keep a record of the person with whom you spoke and the date.

African American man looking at his computer while sitting at a desk

5. File a report of identity theft with the FTC

An identity theft report is required by police and companies with whom fraudulent accounts were opened. [Citibank customers can call (800) 950-5114.] Once it’s been determined that your identity has been stolen, a specialist will guide you through the process of reclaiming your identity. Non-Citi customers may contact for detailed instructions for creating an Identity Theft Report and recovery plan. With this account, you’ll receive help to follow and update your recovery plan, track progress and pre-fill forms and letters.

You may also want to file a report with your local police department. To do so you’ll need: a copy of your FTC Identity Theft Report, a government-issued photo ID, proof of address (mortgage or utilities bill), and any proof of the theft (bills, IRS notices, etc.).

6. In special cases, consult an expert

You may need to contact an attorney or an identity theft restoration professional when identity theft involves: fraudulent criminal charges; bankruptcy; government benefits; investment accounts; phones; utilities; house rental/purchases; medical identity theft; tax identity theft, and child identity theft.

How to repair the damage

Close any new accounts opened in your name

Call the fraud department of each business where an account was opened and explain that someone stole your identity. The business may request a copy of your Identity Theft Report or ask you to complete a form to dispute that you opened the account. Ask the business to close the account and send you a letter confirming that: the fraudulent account isn’t yours, you aren’t liable for it and it was removed from your credit report. Keep this letter; you’ll need it if the account appears on your credit report later on. Always write down whom you contacted and when.

Remove bogus charges from your account

Again, call the fraud department of each business, and explain the situation. Tell them which charges are fraudulent, and ask for their removal along with a confirmation letter that they have been removed. Save that letter, too, in case the charges reappear on your credit report. You’ll likely have to send a copy of your Identity Theft Report or complete a special dispute form. Take notes on whom you spoke with and when.

Call the fraud department of each business where an account was opened and explain that someone stole your identity.
End Quote

Correct your credit report

Write a letter to each of the three credit bureaus. Include a copy of your Identity Theft Report and proof of your identity, like your name, address and Social Security number. Explain which information on your report is fraudulent and ask that fraudulent information be blocked (removed). Credit bureaus must honor this request if you have an Identity Theft Report. Once blocked, these charges can no longer appear on your credit report nor can companies attempt to collect that debt from you.

Take charge of your future

Monitor your accounts regularly

Monitor your accounts at least once a month. “Reconcile, don’t just scan them,” advises Kerskie. “Why? Federal law mandates that you must notify your bank within 30 to 60 days of fraudulent activity. If you do not, you could be responsible for the loss.” This time period varies from bank to bank, so check with your own bank to be sure.

Set up online accounts

It may seem counterintuitive, but Kerskie recommends setting up online accounts for all life’s businesses — medical, Social Security, banking, investment, credit cards, etc. “If not, you have a greater risk of becoming a victim of identity theft. If you’re not marking your territory, a criminal will do it on your behalf.” Using your name, address, date of birth and Social Security number, a thief could request online access to your account. Once the online access has been set up, thieves can change mailing addresses, initiate wire transfers and more. For those who do not have a computer, Kerskie advocates adding an extra layer of protection (a password or security question) to your account. In the event a criminal calls the general number for your bank, he would be denied access without that extra piece of information.

Kerskie also advises clients not to use real answers to online security questions that ask you to supply information like the name of a childhood pet or grammar school. Instead, use information from someone else, like a son or daughter, or friend.

If you’re not marking your territory, a criminal will do it on your behalf.
End Quote

Get identity theft protection

Consider signing up with an identity theft protection service or adding an identity theft rider to your homeowner’s insurance policy if you do not already have one, says Kerskie. (These riders offer reimbursement for identity theft restoration services and/or fraudulent charges that aren’t covered by banks or creditors.) If you choose to purchase an identity theft protection service, look for one that requires you to give temporary power of attorney so they can work on your behalf if your identity is stolen. If the company does not require this, it will most likely just provide a game plan or point you in the right direction, leaving you to shoulder the job of restoring your identity. 

In the end, remember this: Thieves may have robbed you of your identity but they have not stolen your power to fight back. With vigilance, persistence and determination, you can reclaim your identity — and your peace of mind. 

Karen Gibbs

is a freelance journalist, regular contributor to and content creator for brands such as Procter & Gamble and Bed Bath & Beyond.