Greetings all,

​

Firstly, if you're reading this post because you have been a victim of identity theft, then I am truly sorry. As someone who has had their identity stolen multiple times, I understand the frustration and anxiety that it causes. I've put this information together as a guide to assist you with finding out what to do next in the event that you have had your identity stolen, as well as some tips to ensure it doesn't happen again.

Remember to document EVERYTHING. Save every letter or email you get. Take screenshots when applicable of any potential evidence. Write down every case number or confirmation number given to you by the authorities/credit bureaus.

******** CONTAINMENT ********The first step is to prevent any further usage of your identity. To do this, follow the steps below.

1.) FREEZE your credit immediately. -- A credit freeze is designed to ensure no further lines of credit or accounts can be opened with your information. A credit freeze will remain in place until YOU decide to unfreeze your credit. I believe there was a recent change made during 2020 which eliminated the fees associated with freezing and unfreezing your credit, so it SHOULD be free. Once your credit is frozen, the 3 bureaus will give you a special PIN that is only provided ONCE. Ensure you save this pin for when you are ready to unfreeze your credit. (*NOTE: This PIN may also have been removed from the process as of 2020). Freezing your credit DOES NOT interfere with your credit score, and your financial behavior can still cause your Credit Score to go up or down. The freeze also does not remediate any accounts that may have been opened already, but it will prevent the thief from opening any further accounts.(Opinion: Even if your identity hasn't been stolen, or confirmed stolen, there is no harm in freezing your credit. You will just need to remember to unfreeze it whenever you are ready to apply for a loan, open a credit card account, etc etc. The credit bureaus will even allow you to set a specific date/time range to unfreeze your credit temporarily)Experian Fraud Division: 888-397-3742Equifax Fraud Division: 800-525-6285TransUnion Fraud Division: 800-680-7289

2.) Place a fraud alert on your account. -- This can be done when you call the Credit Bureaus in order to freeze your credit. A fraud alert is mostly what it sounds like. It places an alert on your account that will let lenders know that fraudulent activity may have taken place on the account, and that they need to take further steps to verify your identity. You can associate the alert with a phone number, so that a lender will need to call the number, and speak with you before extending any lines of credit or opening an account. If you do not answer the phone when they call, it is an automatic rejection. A fraud alert is good for one year, but with a police report, you can extend this fraud alert to last for 7 years.

3.) Contact your bank, credit card company, or any financial institution you have to let them know you were a victim of identity theft. It doesn't matter if the card, or bank was even used in the theft, it's better to let them know so that they can be extra vigilant and ensure they take appropriate steps when verifying your identity.

Also consider using a credit monitoring service such as Identity Guard or LifeLock. They will monitor activity relating to your identity and notify you when something happens. Often times a victim's identity is stolen, but they do not find out until several days later when they receive strange letters in the mail regarding credit inquiries. Having a monitoring service like this will notify you within hours, instead of days which will save you precious time.

***** REPORTING THE INCIDENT ****\*

There's quite a few people you may need to contact depending on what was done. Here's a list of who to contact: (*NOTE: please let me know if there are any other entities that need to be contacted, as this is not a complete list)

1.) Your local Police Department. -- If the thief used your identity to buy something in another state or county, it is likely that your local PD will not be able to assist. However, what they can do is provide you with a police report so that it can be used to have an extended fraud alert on your account. Even if they say no. be adamant (politely adamant) that you would like a report so that you can keep it for your (and the PD's) records. This is especially true if you believe YOUR identity may have been used to commit a crime.

2.) Contact the Federal Trade Commission (FTC) -- 1-877-438-4338 or https://www.identitytheft.gov/

3.) The Office of the Inspector General -- 1-800-269-0271 or https://oig.ssa.gov/

4.) Any relevant Police Departments -- For example, if you live in Atlanta, but someone in Orlando purchased an $18,000 jet ski in your name (is that oddly specific?), contact the Orlando Police Department. It helps to have a local Police Department's police report, but isn't necessary. Every Police Department does things a bit differently, so don't be amazed if they ask you to report a crime in person, even if you live 4 states away. Your local PD may be able to assist if that is the case. Remember to stay polite, but firm with every request. YOU are the victim, and YOU have rights.

5.) USPS (If necessary) -- In my case, the thief also put a mail forward on my physical mail, ensuring it went to another address. This may not be relevant in your case, but remember to think outside the box, because the thief probably will be.

***** NOW WHAT? *****

- Change passwords to everything. Depending on the level of access the thief was able to obtain, your passwords may not be safe anymore, specially if you reuse the same password, which you shouldn't.

- I would strongly suggest you enable multifactor (2FA) authentication on as many online accounts as possible, if available. An authenticator app such as the Google or Microsoft authenticator will work best. You can also use SMS (text messages) or phone calls as another form of 2FA, but this also comes with its share of exploits, but it is better than nothing.

-Ensure to use strong passwords on all your accounts. You can use applications such as KeePass to help securely store your passwords, especially complex ones, so that you can easily retrieve them.

- Keep yourself informed!!!!!!!! If you have an identity monitoring service, ensure you access the account or the email account it is associated with it AS OFTEN AS POSSIBLE. If you only check your email once a week, you may miss important notifications that an incident or change has occurred using your identity.

-Protect your email address. Your email address is more important than most people realize. It's often used as the username for online accounts, and the emails contained within can be highly sensitive in nature and even personal. Take appropriate steps to protect your email address such as enabling 2FA, and only accessing your email address from secure locations.

-- Use multiple email addresses and ensure you use each one for different purposes. I'm not saying you should have an individual email account for every online account you have, but often times people have an email address that easily identifies who they are. Something such as first initial, last name at yahoo.com. Something like that makes it easy for a thief to find or guess your email address. Not a necessity, but the less information is displayed to the outside world, the better.

- Use credit cards as opposed to debit or ATM cards. The money associated with your credit card is insured, and can be disputed if someone steals the card info to make purchases, but when you have a debit card that is directly attached to a bank account, then it is much, much, much harder to get that money back.

- Contrary to popular belief, YOU CAN GET A NEW SSN, however, however, however HOWEVER... you must qualify in order to do so. If your identity has been stolen only once, they may not approve a new number. However, if your identity is constantly under attack (like mine was), you may be approved for a new SSN. It never hurts to call the SSA and at least ask if you qualify, you can find more information about it here: https://faq.ssa.gov/en-us/Topic/article/KA-02220

-USPS Informed Delivery -- This is a service offered by the United States Postal Service. You can go on their website and request this service FREE. Essentially what they do is scan your mail (just the outside, they DO NOT open mail) and will email you what mail you will be receiving for that day. This helps ensure that you are receiving all your mail, and that no one is stealing important documents out of your mailbox.

Best of luck to you all.

This post is primarily intended as a guide for United States residents on how to help prevent identity theft from occurring. If you have already had fraudulent accounts opened in your name, you should ALSO follow the steps here.

TL;DR: The MOST IMPORTANT preventative steps are to:

• Freeze your consumer reports at Equifax, Experian, TransUnion, ChexSystems, and LexisNexis
  • A "freeze" is not the same as a "lock." I would suggest freezes over credit locks because they provide more legal protection and are generally harder than credit locks for identity thieves to remove
  • If you've been a victim of identity theft, I also recommend placing 7-year extended fraud alerts at the main three agencies
  • Don't create an online Experian account if you haven't already due to their arbitration agreement. Preferably freeze Experian by phone or mail. But, If you are very careful during account creation and create using the security freeze page specifically, you can create a so-called "service" account, which is NOT the same as the "free membership" (though the service account is also free). An Experian "service" account doesn't include this arbitration agreement, so if you must create an Experian account, do it this way
• Get an IRS identity protection PIN
• Opt out of LexisNexis if eligible (has a different effect than freezing LexisNexis)
  • Before opting out of LexisNexis, you should 1) attempt to create an account with the ChexSystems consumer portal, and 2) create an account with login.gov and link it to the Social Security Administration online service
  • If using an FTC identitytheft.gov report to opt out, select identity theft as the reason, enter "federal" as the jurisdiction where prompted, attach a PDF of the FTC report, and enter the FTC report number from the PDF where prompted
  • After opting out of LexisNexis, make sure to record the exact information you submitted in the opt out request and save the email you get after the opt out request is processed. This email will include a link that you can use to temporarily opt back in, which is helpful for when you intend to apply for credit or deposit accounts

Taking all of the steps in this post may be a pain, but will be a lot easier than dealing with preventable identity theft.

If you haven't already, you should freeze your credit reports at Equifax, Experian, and TransUnion. However, you should create an E-Verify account before doing this because you might not be able to create an E-Verify account if your Experian report has a freeze or fraud alert.

Using your E-Verify account, you can place an E-Verify lock on your SSN, which can help prevent identity thieves from obtaining employment in your name.

Although freezing your reports at the main three credit bureaus is essential, it is not enough.

This is the case in part because there are several other bureaus that may be checked instead of one of the main three reports.

It is possible to pin-point each freezable credit bureau and freeze them, as the CFPB maintains a list of bureaus, and notates which ones are or are not freezable.

If you are a victim of identify theft, I would highly recommend placing security freezes on ALL of the bureaus in the list below (in addition to Equifax, Experian, and TransUnion)

Bureaus used for bank account applications:

• ChexSystems: IMO this one is really important to freeze, even if you're not a victim of identity theft
  • You may want to order a copy of your ChexSystems consumer report or create an account with the ChexSystems consumer portal before you place a security freeze
• LexisNexis: holds public records, but often used by financial institutions to verify identity
  • SageStream is now part of LexisNexis, so freezing LexisNexis will also freeze SageStream
  • ChexSystems sometimes pulls from LexisNexis, so when unfreezing ChexSystems to apply for bank accounts, you should unfreeze LexisNexis as well
  • LexisNexis also shares non-FCRA information for identity verification purposes, but freezing LexisNexis only restricts the sharing of FCRA information. You can also opt out of LexisNexis which only restricts the sharing of non-FCRA information. To restrict both FCRA and non-FCRA information from being shared, you'll need to both freeze LexisNexis and opt out of LexisNexis
• Note: Early Warning Services (EWS) is also used to review bank account applications, but they do not offer security freezes or fraud alerts, however
  • Many of the major banks that use EWS (including BoA) also use LexisNexis Accurint to verify identity, and since this LexisNexis service is non-FCRA, freezing LexisNexis won't affect this service but this service can be blocked by opting out of LexisNexis
  • Since EWS compares the email address and phone number on account applications against the email addresses and phone numbers on your existing accounts when assessing identity confidence, it may be a good idea to change the contact information tied your bank accounts listed on EWS to only include a secret email address and phone number. This needs to be done through the banks, not through EWS. If there are any fraudulently-opened accounts on your EWS report, do not provide those banks with the secret email address or phone number. Instead make an identitytheft.gov report in which you report the fraudulent accounts, and unless those accounts are already marked as "fraud victim" on your EWS report, dispute those accounts as fraudulent with EWS, and include the identitytheft.gov report with the dispute. This largely prevents EWS from "verifying" your identity unless the identity thief gets their hands on the secret email address or phone number. EWS customer service representatives do not appear to be aware of how their identity confidence score works, but luckily, this is partially explained in their product sheet intended for business use
  • You may wish to use an identity monitoring service that monitors EWS such as Aura, IDShield, Zander Elite Cyber Bundle, Discover Identity Theft Protection, or Lifelock Ultimate Plus (cheaper Lifelock plans don't currently include EWS inquiry monitoring). This will alert you whenever a new account inquiry is made to your EWS report, so you will be able to act promptly

Alternative credit bureaus:

• Innovis: a smaller credit bureau that some services use for identity verification
• NCTUE: a credit bureau which specializes in keeping track of utility payments. You can only freeze your report with this agency if you have a file with them, which is generally only the case if you have phone or utility accounts that report to NCTUE. Some mobile carriers and utility companies use this report instead of or in addition to traditional credit reports. If you freeze it online, make sure to securely save a copy of the confirmation letter, as it contains the freeze PIN
• The Work Number: a company owned by Equifax that collects information about employment history and salary. Like NCTUE, you can only freeze your report with this agency if they already have a file on you

Low income / subprime credit bureaus:

• Factor Trust: security freeze can be requested online provided that you already have a file with them
• DataX: security freeze must be requested by mail
• Microbilt: security freeze can be requested by phone or by mail
• Clarity Services: security freeze can be requested online if you already have a file for them, but if not, it must be requested by mail or fax

If you are a victim of identity theft, I would strongly recommend placing freezes and/or extended fraud alerts on your reports at all of the bureaus above.

Aside from the main three credit bureaus (TransUnion, Experian, and Equifax), the most important ones to freeze or place extended fraud alerts with are ChexSystems and NCTUE.

That being said, do note that failure to freeze the low income / subprime ones may result in payday loans being taken out in your name. This is why I recommend doing all of them.

Also, keep in mind that in some states, security freezes automatically expire after 7 years.

You should also contact the USPS and ensure that a mail forwarding order hasn't been placed on mail addressed to you. Once you have confirmed that a fraudulent mail forwarding order hasn't been placed, you should sign up for USPS informed delivery.

To prevent identity thieves from filing tax returns in your name, you should also look into getting an IRS Identity Protection PIN.

If you haven't already, you should register online accounts with MyEquifax, the TransUnion freeze/unfreeze/dispute service, ID.me, login.gov (link the login.gov account with the Social Security Administration online service), and studentaid.gov. If allowed in your state, you should also register an online account at your state's unemployment office even if you do not intend to apply for unemployment benefits. It's important that you register accounts at these sites even if you don't intend on using them so as to help prevent someone else from doing so first. When you create the accounts, do not pick answers to the security questions that anyone you know would be able to answer. Instead, pick long and complex answers so that identity thieves can't use the security questions to take control of your account.

Due to Experian's current arbitration agreement, I do not recommend registering an Experian account if you do not already have one.

If you are eligible, you should also opt out of LexisNexis (not the same as freezing LexisNexis). But before you do this, create an account with the ChexSystems consumer portal and with login.gov and link the login.gov account with the Social Security Administration online service. Identity theft victims are eligible to opt out of LexisNexis. This prevents LexisNexis from sharing non-FCRA information with companies. Non-FCRA information is unaffected by a security freeze, which is why freezing LexisNexis needs to be done in addition to opting out. This can help because it typically prevents LexisNexis from using their data to "authenticate" your identity at institutions that use LexisNexis. It is possible to temporarily opt back in when you need to use a service that requires LexisNexis. I would suggest using a secret email address in your opt out form, as this makes it more difficult for identity thieves to cancel the opt out. If you are using an FTC report to opt out, enter "federal" as the jurisdiction and upload your FTC report.

Non-FCRA opt outs with the main three bureaus: In serious cases of identity theft, you might also want to 1) purchase a California virtual address (unless you already live in California), and 2) use the California address to make CCPA "do not sell or share" and "limit the use of my sensitive personal information" requests with Equifax, Experian, and TransUnion. California is not the only state with data privacy laws, but at the time I last edited this post, California's data privacy law is the only one that doesn't include an exception for identity verification. These opt out requests can prevent certain non-FCRA identity verification tools offered by the three main credit agencies from being used to "verify" your identity. However, this can mess up a lot of things and it is in my experience much harder to undo than a credit freeze or a LexisNexis opt out, so I only recommend this if you have a severe case of identity theft or if identity thieves have been able to remove your credit freezes.

If allowed by your bank/credit union, you should add verbal passwords to your banking profiles. This typically requires calling the bank or credit union. The reason for doing this is to prevent someone with your personal information from calling your bank and pretending to be you, since they would also need to provide the password to the customer service representative.

I would also recommend enabling 2fa on your online accounts - particularly your email accounts. This can make it more difficult for your accounts to be hacked. If possible, avoid SMS/phone-call 2fa and only enable it if no other 2fa options are available, as it is surprisingly easy to take over a phone line. Different 2fa options ranked from most secure to least secure (in general) are: Physical security key, OTP authentication app (what I personally use), VoIP phone number, email, non-VoIP phone number.

To the extent possible, you should also secure your account with your cell carriers to prevent someone from pretending to be you to perform a SIM swap.

Additional note: In some cases, identity thieves may be so persistent that they will manage to lift your freezes.

• If this happened with an Experian account, see my comment here on how you can mitigate this and prevent it from happening again
• If this happened with TransUnion and/or Equifax, try following the aforementioned strategy of using non-FCRA opt outs with the three main bureaus after ensuring that you either have control over or have shut down any online accounts with the TransUnion freeze/unfreeze/dispute service and MyEquifax. In my experience, this stops TransUnion and Equifax from generating security quizzes which makes it more difficult for someone to take over your TransUnion or Equifax accounts
• If this is still an issue, you should document every attempt at this and look into getting a new SSN as soon as possible. In the meantime, write a letter to the credit bureaus by Certified Priority mail demanding extra security and threatening legal action

If you do end up getting a new SSN due to persistent identity theft, see my comment here on how to prevent your reports from being linked in such a way that could allow the identity thief to use your old SSN to discover your new SSN.