On several occasions, I've been asked to help individuals whose identities have been stolen. However, most of the time, it's not cost-effective for a lawyer to handle the majority of the initial steps in responding to the theft of an individual's identity. Instead, the affected person is usually best advised to handle most of the first steps themselves.*
As a public service, I'm providing the following step-by-step guide for individuals who suspect that credit has been obtained in their name without their consent. (There are other kinds of identity theft, but credit theft is most common.) Although the Federal Trade Commission has an a good
guide for victims of identity theft, it (i) requires you to read several different webpages instead of just one, and (ii) does not explain the state-law-specific aspects of recovering from identity theft. This is intended to be a simplified guide for North Carolina residents.
1. Put a Fraud Alert on Your Credit Report. Call any one of the three major credit reporting agencies and instruct them to place a fraud alert on your credit report. (Tell the agency you contact to tell the other two to do the same...although there's no harm in calling all three yourself). You'll be required to prove your identity when placing a fraud alert. There will be no cost. The purpose of a fraud alert is to make it harder for an identity thief to open more accounts in your name. An initial fraud alert lasts 90 days, but can be renewed.
You can contact the credit reporting agencies at the following:
- Equifax - 1-800-525-6285, www.equifax.com, P.O. Box 740241, Atlanta, GA 30374-0241;
- Experian - 1-888-397-3742, www.experian.com, P.O. Box 2104, Allen, TX 75013-0949;
- TransUnion - 1-800-680-7289, www.transunion.com, P.O. Box 1000, Chester, PA 19022.
2. Order Your Free Credit Reports. When placing a fraud report, you are entitled to a free credit report from each of the three major credit reporting agencies. The agency that you call (as instructed in #1 above) will explain your rights and how you can get a free copy of your credit report. You could also use
this form.
3. Submit an Affidavit to the FTC. Write out a description of how you learned about the suspected identity theft and everything you've learned about it since, in as much detail as you can. Next, you need to put this information into the form of an affidavit (a sworn written statement). The Federal Trade Commission has a helpful tool (called the "FTC Complaint Assistant") to put your information into the proper form, which you can use for free at
https://www.ftccomplaintassistant.gov/. When finished, submit the affidavit to the FTC through the website. Print or save a copy for your records. (Alternatively, you can use
this form.)
4. File a Police Report. Call the local law enforcement agency (a) where the theft appears to have occurred, or (b) where you live, or (c) both. In North Carolina, this is usually a police department if you live in a city or town, or a county sheriff's department if you live outside a municipality (though there are exceptions to this general rule). File a police report. (Either they will send an officer to you, or will ask you to come to the station.) Give the officer a copy of your FTC Identity Theft Affidavit. Also give the officer a copy of the FTC's official memo to local law enforcement agencies, a copy of which is available
here. Ask to be given a copy of the police report once it's ready.
5. File an FTC ID Theft Report. Together, your FTC Affidavit and the police report comprise an "FTC ID Theft Report." An FTC Report can help you (i) get fraudulent information removed from your credit report; (ii) stop a company from attempting to collect debts from you that result from identity theft, or from selling the debt to another company for collection, (iii) extend the fraud alert on your credit report; and (iv) get information from companies about any accounts the identity thief opened or misused. Send the ID Theft Report to the credit bureaus and to any organization affected by the ID theft (such as a retailer or credit card company).
Send an ID Theft Report to the credit reporting agencies, and tell them whether you want to extend the fraud alert or initiate a security freeze (see #6 below). In either case, you should notify all three of the credit reporting agencies.
6. Decide Whether You Want to Extend the Fraud Alert or Institute a Credit Freeze. Next, you need to decide whether to (a) extend the fraud alert or (b) initiate a security freeze.
Once you have created an ID Theft Report (FTC affidavit plus police report), you are entitled under federal law to extend your fraud alert for seven years. When you extend the fraud alert, you can get two free credit reports within 12 months from each of the three major credit reporting bureaus, and they must take your name off marketing lists for prescreened credit offers for five years, unless you ask them to put your name back on the list.
North Carolina residents are entitled by state law to "freeze" their credit reports. When a security freeze is in place, a consumer reporting agency may not release
your credit report or information to a third party without your prior
express authorization. If you want someone (such as a lender or employer) to be able to review your credit report (for a credit application or background check), you must ask the credit reporting agency to lift the security freeze. You can ask to lift the security freeze temporarily or permanently. (The credit reporting agency is required by NC law to give you a unique PIN or password when you initiate the security freeze to be used by you
when requesting a temporary or permanent lift of the freeze.) If you request a lift to the freeze by mail, the agency has three business days to comply, but if you request electronically or by telephone, the agency must comply with the request within 15 minutes. Putting a credit freeze on your credit file does not affect your credit score.
The cost to place and lift a freeze, and how long the freeze lasts, depends upon state law. Here in North Carolina, a freeze lasts as long as you wish, and a consumer reporting agency cannot charge a fee to put a security freeze in
place, remove a freeze, or lift a freeze
if your request is made electronically. If you
request a security freeze by telephone or by mail, a
consumer reporting agency can charge up to $3.00 (unless you are 62 or older, or have submitted a police report--see #4 and #5 above).
So, to summarize, a "security freeze" generally stops all access to your credit report unless you lift it, while an "extended fraud alert" permits creditors to get your report as long as they take steps to verify your identity. My general preference is the freeze, because it gives you the most control.
7. Review Your Credit Reports and Dispute Errors. Carefully review your credit reports for errors. If errors on your credit report are the result of identity theft and you have submitted an Identity Theft Report, you are entitled to tell the credit reporting companies to block the disputed information from appearing on your credit report. Here is a
sample letter that may be helpful.
The credit reporting agency will notify the relevant business of any disputed information, after which the business has 30 days to investigate and respond to the credit reporting agency. If the business finds an error, it must notify the credit reporting agency so your credit file can be corrected. If your credit file changes because of the business’ investigation, the credit reporting agency will send you a letter to notify you. The credit reporting agency cannot return the disputed information to your file unless the business says the information is correct. If the credit reporting company puts the information back in your file, it will send you a letter telling you that.
8. Contact Any Businesses Involved. If you are aware of specific accounts that have been opened in your name without authorization, or existing accounts that have been accessed without your authorization, contact those organizations, even if you have already notified the credit reporting agencies of the problem. Ask to speak to someone in the fraud department. Ask them to reverse any unauthorized charges and to preserve all records for use by law enforcement. You might also want to ask them to simply close the accounts, and open new accounts for you. [Use different access credentials (such as a PIN or password) for the new accounts.] Ask for copies of any documents used by the identity thief. (Here's a
sample letter.) Ask for a letter confirming that any fraudulent information has been removed or transactions reversed. Also ask them to stop reporting information relating to the fraud to credit reporting agencies. As soon as you conclude the conversation, memorialize your discussion in a
certified letter to the organization. Here is a
sample.
9. Stop Debt Collectors from Contacting You about Fraudulent Debts. If an identity thief opens accounts in your name and doesn’t pay the bills, a debt collector may contact you. To stop debt collectors from contacting you, in addition to the steps described above, you can send them a
letter using this form.
10. Additional Tips:
- Remember to record the dates you made calls or sent letters.
- Keep copies of all correspondence in your files.
- A number of sample letters are available here.
I hope you find this guide helpful. Please feel free to share it with your family, friends, and colleagues. Although I hope you never need it, I encourage you to bookmark this post for quick reference, along with the FTC's ID Theft website and the NC DOJ's website, just in case.
___________________
* When the person whose identity has been stolen either (a) lacks the ability to respond themselves, whether due to a disability, age, or otherwise, or (b) is someone whose time is sufficiently valuable that it makes economic sense for them to hire someone else to remedy the situation, a lawyer/paralegal team may be well-position to handle these matters. Otherwise, it makes sense for the affected person to handle most aspects of resolving a stolen identity, with limited guidance from a knowledgeable lawyer.
IMPORTANT: This blog post is for educational purposes only, and does NOT constitute legal advice. You should consult with your own attorney about your specific situation. This blog post does not create an attorney-client relationship, and it will not be updated to reflect changes in law or practices, so you should refer to other sources to ensure you receive the most accurate, up-to-date information.
