Protect Your Identity and Recover If It's Stolen

A thief who has your Social Security number (SSN) may try to open credit cards, loans, or phone plans in your name. Two free tools make this harder. Both work through the three nationwide credit bureaus: Equifax, Experian, and TransUnion.

A freeze gives stronger protection, and it does not affect your credit score. You can have a fraud alert and a freeze at the same time. Both are about new credit. They do not stop someone from using a card or account you already have, so keep checking your statements.

1. Set aside about 30 minutes. Have your SSN, date of birth, and current address ready.
2. Go to each bureau's website yourself: equifax.com, experian.com, and transunion.com. Type the address. Do not use a link from an email or a text.
3. Create an account at each site and answer the questions that check your identity. You can also ask for a freeze by phone or by mail.
4. Choose the free "security freeze" or "credit freeze." You do not have to buy anything or sign up for a paid service. When you ask online or by phone, the bureau must place the freeze within one business day.
5. Save your account login, and any PIN the bureau gives you. You will need them to lift the freeze later.
6. Repeat at the other two bureaus. A freeze at only one bureau leaves the other two open.

When you need credit, lift the freeze for a short time

Before you apply for a loan, a credit card, an apartment, or a phone plan, ask the company which bureau it uses. Then lift the freeze at that bureau for a few days, or at all three. When you ask online or by phone, the bureau must lift the freeze within one hour. By mail, it can take up to three business days.

Parents can also freeze the credit of a child under 16 for free. Some people with an Individual Taxpayer Identification Number (ITIN) have credit files and some do not. If an online form asks for an SSN you do not have, call the bureau, or ask a nonprofit credit counselor for help.

IRS Identity Protection PIN (IP PIN)

An IP PIN is a 6-digit number that keeps someone else from filing a federal tax return with your SSN or ITIN. This stops a thief from filing a fake return and taking your refund. Anyone with an SSN or ITIN who can prove who they are can get one. It is free, and you get a new number every year. Once you have one, use it on every federal tax return you file.

• The fastest way to get one is online, through your IRS account at irs.gov/ippin.
• If you cannot prove who you are online, you may be able to use IRS Form 15227 if your income is below a limit, or make an appointment at an IRS Taxpayer Assistance Center.
• The IRS will never call, email, or text you to ask for your IP PIN. Anyone who asks is a scammer.

A PIN on your phone account

Banks and apps often send codes to your phone. A thief who moves your phone number to their own phone gets those codes. Ask your phone company to add a PIN or passcode to your account, and ask about a lock that stops your number from being moved to another phone or company. If your phone suddenly loses service for no clear reason, call your phone company from another phone right away.

A freeze at ChexSystems

Many banks and credit unions check new customers with ChexSystems, a consumer reporting company. A security freeze there helps stop someone from opening a bank account in your name. Ask for it at chexsystems.com, by phone, or by mail.

Warning signs include charges or bills you do not recognize, debt collectors calling about debts that are not yours, accounts on your credit report that you did not open, and regular bills that stop arriving. Act the same day. IdentityTheft.gov gives these steps:

1. Call the companies where the fraud happened. Ask for the fraud department. Ask them to close or freeze the accounts. Change your passwords and PINs.
2. Place a free fraud alert with one credit bureau. It must tell the other two. Then get your free credit reports at AnnualCreditReport.com and look for anything you do not recognize.
3. Report it to the FTC at IdentityTheft.gov (in Spanish at RobodeIdentidad.gov) or by calling 1-877-438-4338. To report in another language, call and press 3. You will get an Identity Theft Report and a personal recovery plan.
4. File a police report if you need one. Do this if you know something about the thief, or if a company asks for a police report. Ask the police for a copy.
5. Fix the damage. Use your Identity Theft Report to close new accounts opened in your name, remove fake charges, and correct your credit reports.
6. Protect yourself for the long term. Think about a 7-year extended fraud alert or a credit freeze, and an IP PIN if your SSN or ITIN was taken.

"Hello. My name is [your name]. Someone stole my identity and opened an account with your company in my name. The account number is [number, if you know it]. I did not open this account or make these charges. Please close the account, remove the charges, and send me a letter that says so. I have an Identity Theft Report from IdentityTheft.gov. What is your name, please?"

For every call, write down the date, the person's name, and what they said. Send copies of papers, and keep the originals.

Tax identity theft

Signs include: your e-filed tax return is rejected because a return was already filed with your SSN or ITIN, an IRS letter about a return you did not file, or a W-2 or 1099 form from an employer you never worked for.

• If you get an IRS letter, make sure it is real, then follow its instructions.
• If your e-filed return is rejected because a return was already filed with your number, you may need to file your return on paper. The IRS says to keep filing and paying your taxes as usual.
• You may also need Form 14039, Identity Theft Affidavit. The IRS says not to file it if the IRS already sent you a letter about the problem.
• Get free help at a VITA tax site (see our lesson on filing for free), or call the IRS identity theft line at 800-908-4490.

Medical identity theft

Signs include: a bill for medical care you did not get, a debt collector calling about a medical bill that is not yours, a medical debt on your credit report that you do not recognize, or a notice from your health insurance that you reached your benefit limit.

What to do: ask each provider for a copy of your medical records and bills, and tell the provider about any errors in writing. Check your credit reports, and report the theft at IdentityTheft.gov.