Identity Theft Recovery Plan and Letters

How the plan is ordered

The first steps are the ones that stop new damage fastest and cost nothing. A credit freeze at Equifax, Experian and TransUnion makes it harder for anyone to open new credit in your name, and federal law makes placing and lifting it free. A fraud alert asks lenders to verify your identity, and the bureau you contact must tell the other two.

Next comes the report. IdentityTheft.gov, run by the Federal Trade Commission, builds an Identity Theft Report and a recovery plan. That report (or a police report) is what unlocks the extended seven-year fraud alert and the right to have fraudulent entries blocked from your credit report.

Then the plan adds only the steps for what happened to you (new accounts, charges on your own cards, a debt collector, taxes, benefits, medical bills, a child’s identity, or an arrest in your name) and the rules of your state.

Your federal rights as an identity theft victim

Blocking. Under section 605B of the Fair Credit Reporting Act, a credit bureau must block information that resulted from identity theft within 4 business days after it receives proof of your identity, a copy of your identity theft report, the items you identify, and your statement that they are not yours (15 U.S.C. § 1681c-2).

Records. A business that dealt with the thief must give you the application and transaction records free of charge within 30 days after it receives your written request, subject to verifying your identity and your claim; it can decline in good faith in limited cases, for example if it cannot confirm who you are (15 U.S.C. § 1681g(e)).

Debt collectors. A collector working for a creditor that is told a debt may be the result of identity theft must notify the creditor and, if you ask, give you the information you would get if you were disputing the debt (15 U.S.C. § 1681m(g)).

Cards. Your liability for unauthorized use of a credit card is capped at $50. For debit cards, how quickly you report a lost or stolen card or an unauthorized transfer on your statement decides how much you can lose (12 C.F.R. § 1026.12, § 1005.6).

Police reports for identity theft, state by state

The FTC report is enough for most federal rights, but some businesses and agencies ask for a police report too. We found a state law requiring police to take an identity theft report in 31 jurisdictions, and a state program for victims (such as an identity theft passport or a court process to clear your name) in 32 jurisdictions. Where we found no such law, you can still ask your local police to take a report.

Is paid identity theft protection worth it?

The FTC describes credit monitoring as a service that keeps an eye on your credit report and tells you if anything suspicious appears, and notes these services usually charge a monthly or annual fee. It also says credit monitoring will not alert you when someone withdraws money from your bank account or uses your Social Security number to file a tax return (FTC).

A credit freeze is free and does what monitoring cannot: it stops new credit from being opened on a frozen report. Do the free steps in your plan first. If you also want alerts afterward, a paid service is optional.