Scams proliferate during the holidays. In addition, tax season starts soon, and fraudsters may file as you. There are many guides on how to avoid being a victim (for example, by having a smart system for strong passwords that are easy to remember). Yet despite best efforts, identity theft can strike anyone. This is a guide on what to do if it happens to you.

It is, sadly, a common enough occurrence. For example, you may get informed that someone opened a credit card in your name and made large-item purchases. What to do?

Immediately:

1. Alert the financial organization that was affected. If it was your bank account – call the bank. If it is a new credit card, contact that credit card company. Report any stolen credit cards or missing checks to their respective banks or issuers. Make sure you account for each card and check, and contact every lender. Prompt reporting will limit your liability in the event of fraudulent usage.
2. Report identity theft with Gov and get an FTC affidavit. Notarize it in front of a notary – most banks provide this service for free.
3. File a formal police report to your local police station. Bring along your filled out FTC affidavit, a form of government-issued ID, proof of address, a copy of the FTC memo to law enforcement and any info you have regarding the fraud if you go in person. Sometimes you may be able to file a police report online. Or you may be able to call and have a patrolman stop by to take your statement. Make note of your police report number and cite it in all future correspondence. Provide this police report and your FTC affidavit to any and all involved companies. Often financial companies act very different and take you more seriously if you have these.[1]

As soon as possible:

4. Send the police report and the FTC affidavit to the credit bureaus with a personal statement outlining the identity theft, along with a copy of FCRA Section 605(b) and a copy of the Notice to Furnishers of Information. Also, mail copies to the credit card company. Your account should get blocked from your credit reports within four days of receipt of your letter, and the creditor cannot sell, transfer, or place for collection the fraudulent debt (see section 615(f)).
5. Freeze your credit at each of the credit agencies:
   • Experian Security Freeze
   • Equifax Security Freeze
   • TransUnion Security Freeze
   • Innovis Security Freeze (Innovis is smaller than the other three, but you should still place a freeze with them.)
   • You file a separate report with each agency. It does not cost you anything. Once frozen, no bank or lender can pull your credit reports. This will prevent identity thieves from opening lines of credit, credit cards, or other loans in your name. This will also prevent you from taking out your own loans or credit lines. You will be mailed a confirmation letter with a PIN code, that can be used to temporarily or permanently unfreeze your accounts. Keep the PIN code safe.[2]

6. Get a copy of your credit reports for free at annualcreditreport.com, or through a credit monitoring service. While doing that, check the list of companies that have pulled your credit report. That may lead you to other accounts that a scammer might have opened. There may be more.
7. Log into your bank site and check for options for “Alerts” where you can get text messages for different actions: invalid login, transfers over a given size, etc.
8. Call your cell phone company and ask for a “customer care password” to prevent an unauthorized user from changing your cell-phone info. This is important since your credit alerts will likely go to your cell phone.
9. Call your bank and have them note your file that you had a release of personal information. Ask to have a passphrase of some kind for in-person or phone interactions.
10. Install anti-virus on your computer, check for malware, and remove any malware that is discovered. Use a well-regarded program such as Avast, Avira, Bitdefender, ESET, or F-Secure.
11. If your computer was infected, immediately change your passwords for any financial accounts, social media, email, and any other accounts related to the ID theft.

Don’t forget to:

12. Sign up for a credit alert that will alert you if someone tries to open a checking account, for example, ChexSystems, Credit Karma (uses TransUnion and Equifax) or Mint (uses Equifax). American Express customers may want to consider CreditSecure Unlimited and USAA members may want to consider USAA CreditCheck Monitoring. The three large credit bureaus (Equifax, TransUnion, and Experian) offer paid credit monitoring.
13. Fill out an IRS form 14039: Identity Theft Affidavit. Be sure to include the police report number and FTC affidavit.
14. If you already have any credit monitoring, consider reaching out to them and let them know you had a “release of personally identifiable information.” If they do any fraud monitoring, they will have a better idea to escalate if something looks unusual.
15. Opt out of pre-screened credit card offers.
16. If you had dependents (spouse, children) that may also be compromised – do all of the above for each of them. Children are especially vulnerable since they usually do not have their credit checked regularly.
17. Immediately dispute fraudulent activity as soon as you learn of it. Dispute debt collection notices within 30 days (to protect your rights under FDCPA), and send all disputes via certified mail, return receipt requested.
18. Remain skeptical of any links provided (including the ones in this article). Google them, do your own research to ensure their validity.

Remember: Send all mail regarding identity theft using USPS certified mail (or equivalent), return receipt requested, and keep track of what you sent to whom with each certified mailing number. It is important to have a paper trail for documents. Keep good records.

[1] You can also request to be added to the NCIC identity theft file. NCIC is a national database that police departments use in all 50 states. The police will add your personal information to the database which will essentially add a flag to your personal info. You will provide a “password” to the police that will verify you are you. If you or anyone claiming to be you are stopped by the police, the database should flag that there was a prior incident of identity theft. The officer should then request the “password.” If the person does not have it, the police should investigate the person further. This could ultimately lead to catching the fraudster. You can read more here.

[2] If a freeze is inconvenient, you can place an online fraud alert. Unlike a freeze you only have to do it with one agency, they will report the alert to the others. With an active fraud alert, businesses must verify your identity before issuing new credit. Fraud alerts last for one year, but it is also possible to get an extended fraud alert that lasts for seven years if you have filed a police report or an FTC Identity Theft Report.