Let’s assume the worst for a moment. You’ve checked on Equifax’s website and discovered that you’re one of 143 million Americans whose personal information may have been accessed by hackers. In the following days, you notice unexplained withdrawals from your bank account or charges on your credit card — some of the clues that your identity has been stolen. What do you do now?
First, take a deep breath, the Federal Trade Commission advises. Then steel yourself for a lot of paperwork and phone calls. The FTC’s goal is to protect consumers, and its website has a wealth of resources for consumers on how to recover from identity theft. Here are some of them:
Take care of those fraudulent charges. Call the fraud department of companies where the fraud occurred and ask them to remove those charges or close or freeze the accounts in question so no new charges can be added. Change your logins, passwords and personal identification numbers for the account. You may need to come back to this step after getting an Identity Theft Report from the FTC.
Place a fraud alert on your credit report by contacting one of the three major credit bureaus (it must tell the other two): Equifax, Experian or TransUnion. A fraud alert ensures that your identity has to be verified before an account can be opened in your name. It’s free and is renewable after 90 days. Each reporting company will send you a confirmation letter.
Get a copy of your credit report. It’s free once a year from each of the credit bureaus at annualcreditreport.com. Look for suspicious accounts and transactions.
Tell the FTC. Report the theft to identitytheft.gov — it proves your identity was stolen. Create an account on the website, and the FTC will take care of a lot of the details for you: “We’ll walk you through each recovery step, update your plan as needed, track your progress and pre-fill forms and letters for you.” It will generate an Identity Theft Report for you that will be helpful down the road.
|A new form of ID theft: account takeover|
|Protecting yourself from fraud protection|
|With breach after breach, why are our Social Security numbers tied to everything?|
File a police report. Take your Identity Theft Report with you, along with a government-issued photo ID, proof of your address and documentation of the identity theft. Get a copy of the police report.
Correct your credit report. Credit bureaus must honor your request to remove or “block” the fraudulent information on your credit report if you have an Identity Theft Report. That will keep it from showing up on your credit report. You need to write Equifax (P.O. Box 105069 Atlanta, GA 30348-5069), Experian (P.O. Box 9554 Allen, TX 75013) and TransUnion (Fraud Victim Assistance Department P.O. Box 2000 Chester, PA 19022-2000). The FTC has a sample letter here. Include a copy of your Identity Theft Report and driver’s license or state ID.
Freeze your credit report or extend the fraud alert. As mentioned above, a fraud alert lasts for 90 days and means that your identity has to be verified before an account can be opened in your name. The extended version lasts seven years. Credit freezes lock down your credit report so that no one can access it — even you — unless you temporarily lift the freeze or remove it. This chart details the differences between the two.
The FTC also covers what to do in special cases, like tax, child and medical identity theft, and how to handle specific accounts that have been compromised, like government benefits and student loans.