So, the worst financial life event happened to me. My identity was stolen. Now that this has happened, I want to share my knowledge of the experience. Maybe it will help if you are ever in this situation. I’m going to take you through my personal experience of how it happened, but if you want to skip to the steps you should take if this ever happens to you, click here.
How it happened.
The one thing I know for sure is they compromised my social security number. This led to rapid-fire events and the aftermaths that lasted for weeks. While I can’t say with 100% confidence what happened, I have some theories. My first theory is that my information was leaked through a hack of Bank of America. A data breach occurred in February or March 2023. Bank of America notified me of the breach and offered free identity monitoring services, but I did not take them. I already have identity monitoring through a credit card. I’m also just kind of jaded and numb to all the alerts and breaches that have been going around, so I didn’t take any other action.
My second theory is that someone got ahold of my tax return. I filed my taxes this year shortly after moving to a new address. Now, I use a CPA i another state and every year they mail me a physical copy of my taxes to sign and for my record. I guess they mailed this to my old address on file and whoever moved to my new address must have thought they hit the identity scam jackpot. My suspicions are strong about this route for reasons that I will explain more about below.
How I found out
Past-Me had a good sense of signing up for credit monitoring in the past. I have been monitoring my credit report via one of my credit cards. I now know this specific card monitors my trans union report.
Every month, they email me to let me know if there have been any changes to my credit report. They prompt me to log in and check my report and score for free and see if there is any unrecognized activity. I do this occasionally but not often. I’m not doing so much activity that anything major is happening. So I can go months without looking. However, this email alert notified me that my score had dropped 20 points.
This was a highly unusual activity when I had done nothing credit-related. I open the report to see an inquiry at Discovery Bank. Meaning they pulled my report in response to a request. Below is another request from Barclays Bank Delaware. Now, alarms are going off in my head.
Now would be a good time to say, if you haven’t signed up for some kind of credit monitoring service like Credit Karma or the like, do so now; better safe than sorry.
The plot thickens
There are two kinds of credit inquiries: a hard inquiry and a soft inquiry. A soft inquiry usually won’t affect your score, and it's how companies can harass you with pre-qualified offers even though you’ve shown no interest in whatever it is they are trying to peddle. A hard inquiry is in response to something requested that affects your score and shows on your credit history. If you want to read more, check out this article from Credit Karma: Hard credit inquiry vs. soft credit inquiry: What they are and why they matter.
Based on the information above, I determined that Discovery made a hard inquiry into my credit report. Besides the inquiring parties, I can see an address for the bank location. I’m in full panic mode now. I googled the bank name and address and found a contact number, and I called to get more information on what was happening. I find out that they have denied my request for a Luxury Card. I replied that I didn’t request this, and they transferred me to the fraud department.
I discovered that whoever applied for the card had my name, social security number, and (previous) address. That last piece of information is why my mail and income tax forms were compromised. Why would they apply for a card and leave the mailing address the same as my old one? If they were approved, the card would be sent to the address, making me think the perp is at the old address. More on this later.
What to do when your information is stolen and being used.
So, now that I know I am officially dealing with identity theft, I have to begin the long and arduous process of freaking figuring out what to do. So here’s what I did step by step with resources in case this ever happens to you.
Step 1. Call the three major credit bureaus and freeze access to your credit report
Experian 1-888-397-3742 https://www.experian.com/fraud/center.html
TransUnion 1-800-680-7289 http://www.transunion.com/
Equifax 1-800-525-6285 https://www.equifax.com/personal/credit-report-services/credit-fraud-alerts/
To freeze your credit report with each, the easiest way is to visit the websites and get more information. Experian was the most annoying one to figure out because they also have a website for which you must create an account. The phone system will also prompt you to go online as well. You have to verify and give them all your personal information (as if it wasn’t already out there), but once the freeze is placed, you are good. They will also give you a PIN; keep this somewhere safe because you will need it to unfreeze your credit report in the future. For Experian and TransUnion, I could call and place freezes on my account fairly easily.
Another learning moment - There are alerts and freezes. Alerts will not stop lenders from inquiring. It places an alert letting them know there’s been fraudulent activity, and they are supposed to follow up with some secondary action to verify before giving out credit. I don’t trust this due diligence and I opted to freeze my accounts until further notice, which puts everything on lockdown and stops them from being able to request your report altogether. I also learned it stops all those pre-approved offers as well. so kind of a win-win there.
Step 1.5 I also contacted the Post office to have them forward any mail from my old address addressed to me to my new address. I had to pay for this service since the original forwarding dates are free, but this was worth it. And it made sense for the next step in the process.
Step 2. Dispute the fraudulent information on your credit report. It takes a while, but when you make an inquiry related to credit, the information is reported to the credit bureaus and tracked and sometimes used to verify identity. You those random verification, which of these addresses are associated with your account, and they have your first apartment address or an old phone number. The people had provided my old address, so I updated my reports with my new address. They also provided a phone number I requested to remove from my account since it was fraudulent.
Step 3. Next, call each bank that requested your credit report and file a dispute. I called each bank, by tracking down their information online to inform them I was a victim of identity theft and any pending application should be denied and sent to fraud. Luckily, most of the banks had already declined the applications, but calling to speak to them also triggered them to write back to the credit bureaus to have those inquiries removed from my credit report. The banks also mailed out confirmations to my new address and sometimes a denial letter was already on the way to my old address (which is why it was important to forward all my mail).
Step 4. Monitor your report for the next few weeks or months.
Over the next week or two, a few more random inquiries popped up on my fraud monitoring. I then had to repeat step 2 with these other banks to report the fraud and get the inquiries removed from my report.
Step 5. Escalate actions.
Although all of this happened months ago, I now have to watch out for more potential fraud since my info is out there. I’m also looking into filing a police report I have the phone number provided by the person and possibly their current address if my tax information was comprised. I am also contacting the IRS should my tax information and/or refund become compromised. Here is a helpful checklist from ca.gov https://oag.ca.gov/idtheft/facts/victim-checklist
I am also being more diligent with tax info. Around tax time, it's hard to control what is out there. Last month, I got a 1098 form from an old employer with my SSN on it. At the same time, you can’t control everything. Do what you can to keep your digital identity safe out there.
Hope this helps!
Yael
Comments