What to do if you suspect your identity was stolen

If you suspect your identity was stolen, how can you find out for sure? What steps should you take?

I have been representing identity theft victims for nearly 10 years now and this is what I tell potential clients who call me with suspicions that their identities have been stolen.

First, obtain your credit reports from Experian, Equifax and Trans Union. When you receive your credit reports, the first place to look is the inquiry section of the credit report, which is towards the end of the report. An inquiry is a notation of each access to your credit report, so if someone obtains your credit report, the corresponding inquiry will tell you who obtained it and when.

The inquiry section on a "consumer disclosure" (which is what the credit bureaus call the credit report they provide directly to the consumer and not a third party) is usually separated into two sections - inquiries seen by third parties and inquiries only seen by the consumer. The inquiries seen by third parties are generally initiated by the consumer when he or she applies for credit, insurance, etc. I call these hard inquiries. There are also soft inquiries, the kind that do not show up on credit reports provided to third parties but are shown on the consumer disclosures sent to consumers. These include promotional inquiries (think for junk mail purposes), and accesses by the credit bureau when they edit the consumer's credit report. Also, account reviews conducted by existing creditors are soft inquiries.

If you suspect you are a victim of identity theft, you should first look to the hard inquiries. You should recognize all of these inquiries as related to credit transactions that you initiated. If you do not recognize them, they were probably initiated by someone else ... i.e. the identity thief. You should then contact the creditors identified in those inquiries and find out what prompted the inquiry and, if it was indeed a credit application that you did not submit, then you are the victim of identity theft.

Your first step should be to obtain a police report regarding the theft of your identity. Start with your local police. If they won't take the report (i.e. because the crime occurred outside their jurisdiction, perhaps), then try to get a police report from the police where the identity theft occurred, if you know where that is. If you can do neither, you can make an identity theft report with the U.S. Postal Inspector by going to any post office. Your police report and/or identity theft report should identify the fraud accounts of which you are aware.

Each creditor that allowed the identity thief to open an account using your name and/or social security number should have procedures for reporting the opening of the fraudulent account. Technically, you do not have to follow their procedures, since under the Fair Credit Reporting Act, the duty of a creditor to investigate a dispute of identity theft only arises when a dispute is made to the credit bureau(s) which are reporting the fraudulent account(s). However, it is a good idea to comply as fully as possible with the fraudulent credit grantor for two reasons. First, if their procedures work, the fraudulent account should be removed from your credit report and you should be done with it forever. Second, should the fraudulent credit grantors fail to remove the fraud accounts from your credit report, they can not complain in defense of your eventual FCRA lawsuit that they would have removed the fraud account had you simply complied with their procedures.

Also, you need to be sure to dispute the fraud accounts to the fraudulent credit grantors in writing, even if their procedures do not require it and even if you have already disputed the accounts verbally. Make sure your written dispute includes as much detail and proof regarding the theft of your identity as you can. Even though these disputes directly to the fraudulent credit grantors do not trigger any duty under the FCRA, they are important to provide a history for the credit grantor when you do make a dispute that triggers the credit grantor's duty to reasonably investigate your dispute.

After you have disputed the fraud accounts to the fraudulent credit grantors in writing, you should also send written disputes to the credit bureaus disputing the inclusion of the fraud accounts on your credit reports. This triggers two duties on the part of the credit bureau. First, they must perform a reasonable investigation of your dispute. Second, they must forward your dispute and "all relevant information" to the fraudulent credit grantor, which triggers the credit grantor's duty to perform a reasonable investigation of the dispute. This is why it is important for you to have already disputed the fraud account to the credit grantor, so the credit grantor can not argue that the credit bureau did not supply it with sufficient information to reasonably investigate the dispute.

The credit bureau must report the results of the investigation to you within 30 days of the dispute.

The best advice I can give you is to be diligent and persistent. If the credit bureau does not fix your credit report after the first dispute, dispute again. Provide more detail. Provide more proof. And if that doesn't work, dispute again. The more chances you give the credit bureaus and credit grantors to remove the fraudulent accounts, the more likely they will do it and, if they don't, the better your eventual FCRA lawsuit will be.

If you have any questions or are an identity theft victim in need of help, please feel free to contact me through comments or directly at ckittell@merkel-cocke.com.