Identity Theft: What to Do if It Happens to You You apply for a credit card and get turned down because of a low credit score. Yet you know that you’ve always paid your accounts on time. A debt collector calls to demand payment on a six-month overdue account for a credit card you have never had. You receive a credit card in the mail that you’ve never applied for. What’s happening? You could be a victim of identity theft, where an imposter is using your personal information. The identity thief could use your personal information for any of the following: • They may call your credit card issuer to change the billing address on your credit card account. The imposter then runs up charges on your account. Because your bills are being sent to a different address, it may be some time before you realize there’s a problem. • They may open new credit card accounts in your name. When they use the credit cards and don’t pay the bills, the delinquent accounts are reported on your credit report. • They may establish phone or wireless service in your name. • They may open a bank account in your name and write bad checks on that account. • They may counterfeit checks or credit or debit cards, or authorize electronic transfers in your name and drain your bank account. • They may file for bankruptcy under your name to avoid paying debits they’ve incurred under you name or to avoid eviction. • They may buy a car by taking out an auto loan in your name. • They may get identification such as a driver’s license issued with their picture, in your name. • They may get a job or file fraudulent tax returns in your name. • They may give your name to the police during an arrest. If they don’t show up for their court date, a warrant for arrest is issued in your name. How did this happen? Identity Thieves get your personal information by a variety of ways: • They get information from businesses or other institutions by: - stealing records or information while they’re on the job - bribing an employee who has access to these records - hacking these records - conning information out of employees • They may steal your mail, including bank and credit card statements, credit card offers, new checks, and tax information. • They may rummage through your trash, the trash of businesses, or public trash dumps in a practice known as “dumpster diving.” • They may get your credit reports by abusing their employer’s authorized access to them, or by posing as a landlord, employer, or someone else who may have a legal right to access your report. • They may steal your credit or debit card numbers by capturing the information in a data storage device in a practice known as “skimming.” They may swipe your card for an actual purchase, or attach the device to an ATM machine where you may enter or swipe your card. • They may steal your wallet or purse. • They may steal personal information they find in your home. • They may steal personal information from you through email or phone by posing as legitimate companies and claiming that you have a problem with your account. This practice is known as “phishing” online, or “pretexting” by phone. This guide provides victims of identity theft with instructions on how to regain your financial health and who to contact for more help. You must act quickly and assertively to minimize the damage. 1. Notify credit bureaus. Immediately report the situation to the fraud units of the three credit reporting companies -- Experian (formerly TRW), Equifax, and TransUnion. When you notify one bureau that you are a victim of identity theft, it will notify the other two for you. Report that your identifying information is being used by another person to obtain credit fraudulently in your name. Ask that your file be flagged with a fraud alert and that creditors call you before extending credit. Consider using your cell phone number if you have a mobile telephone. Equifax: P.O. Box Experian: P.O. Box TransUnion: P.O. 740241, Atlanta, 9532 Allen, TX Box 6790, Fullerton, GA 30374-0241. 75013. CA 92834-6790. Report fraud: Call Report fraud: Call Report fraud: (800) (800) 525-6285 (888) EXPERIAN 680-7289 and write to and write to (888-397-3742) and address above. address above. write to address TDD: (877) 553-7803 TDD: (800) 255- above. E-mail (fraud victims 0056 TDD: Use relay to only): Web: fraud number [email protected] www.equifax.com above. Web: Web: www.transunion.com www.experian.com Under new provisions of the Fair Credit Reporting Act (FCRA, §605A) you can place an initial fraud alert for only 90 days. The credit bureaus will then mail you a notice of your rights as an identity theft victim. Once you receive it, write each of the three bureaus immediately to request two things: (1) a free copy of your credit report, and (2) an extension of the fraud alert to seven years. You may request that only the last four digits of your Social Security number (SSN) appear on the credit report. You must include an identity theft report (police report) with your letter in order to establish the seven-year alert. You may cancel fraud alerts at any time. In all communications with the credit bureaus, you will want to refer to the unique number assigned to your credit report and use certified, return receipt mail. Be sure to save all credit reports as part of your fraud documentation. Once you have received your three credit reports, examine each carefully. Report fraudulent accounts and erroneous information in writing to both the credit bureaus and the credit issuers following the instructions provided with the credit reports. The Federal Trade Commission’s identity theft guide provides a sample letter to send to the credit bureaus requesting that fraudulent accounts be blocked. http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt04.pdf Once you notify the credit bureaus about fraudulent accounts, the bureau is required to block that information from future reports. The bureau must also notify the credit grantor of the fraudulent account. (FCRA, §605B) Ask the credit bureaus for names and phone numbers of credit grantors with whom fraudulent accounts have been opened if this information is not included on the credit report. In addition, instruct the credit bureaus in writing to remove inquiries that have been generated due to the fraudulent access. You may also ask the credit bureaus to notify those who have received your credit report in the last six months in order to alert them to the disputed and erroneous information (two years for employers). 1a. Monitor your credit reports. Be aware that these measures may not entirely stop new fraudulent accounts from being opened by the imposter. Credit issuers do not always pay attention to fraud alerts, even though the law now requires it. Once you have received your first free copy of your credit report and have requested that the fraud alert be extended to seven years, follow up in a few months with a request for your second free copy, which federal law enables you to receive. In addition, every consumer, whether or not a victim of identity theft, can receive one free report every twelve months from each of the three national credit bureaus. (FCRA §612) For more on free credit reports, see www.ftc.gov/bcp/menus/consumer/credit/rights.shtm as well as www.annualcreditreport.com . Laws in several states give individuals additional opportunities to obtain free credit reports . Missouri State Statute allows for one free annual credit report from each of the three credit bureaus. See the Federal Trade Commission’s (FTC) list of states that offer a free credit report or a report at reduced rates, even if you are not a victim of identity theft. http://www.consumer.gov/idtheft/ 1b. Security freeze. A “security freeze” is stronger than a fraud alert because it prevents anyone from accessing your credit file for any reason until and unless you instruct the credit bureaus to unfreeze your report. A security freeze is authorized in Missouri under State Statute 407.1400 RSMo. The security freeze is also available in several other states, according to the National Conference of State Legislatures. www.ncsl.org/programs/banking/SecurityFreeze_2005.htm 2. Law enforcement. Report the crime to your local police or sheriff’s department. You might also need to report it to police department(s) where the crime occurred, if it’s somewhere other than where you live. Give them as much documented evidence as possible. Make sure the police report lists the fraud accounts. Get a copy of the report, which is called an “identity theft report” under the FCRA. Keep the phone number of your investigator handy and give it to creditors and others who require verification of your case. Credit card companies and banks may require you to show the report in order to verify the crime. 3. Federal Trade Commission. Report the crime to the Federal Trade Commission. Include your police report number. They share such information with investigators nationwide who are fighting identity theft. • Call the FTC’s Identity Theft Hotline: (877) IDTHEFT (877-438-4338) • Or use its online identity theft complaint form: www.ftc.gov/ftc/cmplanding.shtm • Or write: FTC Identity Theft Clearinghouse, 600 Pennsylvania Ave. N.W., Washington, DC 20580. 4. What to do with new credit accounts opened by the imposter. If your credit report shows that the imposter has opened new accounts in your name, contact those creditors immediately by phone and in writing.