After the Fraud: Understanding Identity Theft Recovery

Getting a job in your name overlaps with government-related identity theft, up to the point where your evil twin commits a new crime. Once your identity is associated with criminal activity, it can take years to be free of that taint, if ever: unlike the credit reporting agencies, law enforcement has no single central database where fraudulent use of your identity can be reported and checked.

Child Identity Theft: Months

This is another especially insidious form of identity theft. Your kids are typically assigned their SSN shortly after birth but won’t apply for credit in their own names until their late teens, which gives thieves many years’ use of their identity before anyone (usually) notices. This is a fairly niche form of government-related identity theft, and resolving it is complicated by the fact of your children being minors.

If you suspect your child’s identity has been stolen, you’ll need to reach out to each of the main credit reporting agencies individually to request that they manually search for an active file under your child’s SSN. If they have one, you’ll need to file a report in your child’s name at IdentityTheft.gov, and then reach out individually to every company that has done business with the identity thief. Expect it to take months to be resolved, even in a best-case scenario.

Utilities, Phones and Other Random Accounts: Probably Months

Identity theft represents a substantial percentage of all consumer fraud: of the nearly 2.2 million complaints received by the FTC in 2020, identity theft was the single biggest category. You’ll find plenty of online articles about recognizing identity theft and protecting yourself against it (we’ve published several on this very blog), but relatively few focusing on the aftermath of identity theft.

Identity theft recovery can be a long and frustrating process, even when you do everything right. While you can reverse some fraudulent charges within a few days, other outcomes of identity theft can take months or years to fully resolve. To help give you some idea what to expect if you’re the victim of identity theft, we’ve compiled guidance and figures from across multiple agencies and sources.

Don’t Procrastinate: A Quick Response Is Crucial to Identity Theft Recovery

Before we get into specifics, it’s important to understand that the speed and thoroughness of your response to an identity theft incident are really, really significant. The sooner you report your incident to the FTC and the credit reporting agencies (and pull your credit reports to check for anomalies), the better.

For one thing, there’s a limit (typically 30 days, sometimes less) to how long you can wait to report or challenge a fraudulent charge. A 2019 study by Javelin Strategy & Research showed that 23 percent of victims incurred out-of-pocket expenses because of identity theft; there’s no reason you should be one of them if you can avoid it.

More importantly, the more quickly you respond, the less opportunity there is for criminals to take advantage of your identity. It’s pretty simple logic: prevention is better than repair.

Credit Cards: As Little as a Day, but Sometimes Weeks

Credit cards are low-hanging fruit for fraudsters and identity thieves: they represent the easiest, most versatile way to tap into the credit you’ve earned through years of handling your finances well. Because of this, there’s a well-established process you can use to challenge any fraudulent purchases you may find on your statements. Typically, that part takes just a few days, or even as little as one day.

If you need to close down your existing card entirely and have a new one issued with a different account number, that will take a bit longer. Working with your card issuer to close the old account and open the new one takes just days, but there can be secondary effects. If you’ve used that card as your default payment method for subscriptions, for example, you’ll need to contact those merchants or publications and arrange to change your default payment method. It can take weeks, but shouldn’t go much longer than that.

Bank Accounts: Days or Weeks (Usually)

Like credit card issuers (often, that’ll be your bank as well), banks and credit unions have well-honed processes you can use to report identity theft and fraud and to challenge fraudulent purchases. If the identity thieves have opened new accounts in your name, requested additional credit cards on an existing account or taken out a line of credit in your name, you’ll need to deal with all of those as well.

Depending on the specific policies in place at your institutions, you may need to include a copy of the identity theft report you’ve filed with the FTC’s IdentityTheft.gov website in order to have the existing accounts — and any fraudulent purchases — purged.

Insurance/Medical Fraud: Can Take Months

Criminals can use your identity to exploit the health care system in different ways: they may use your stolen identity to receive treatment themselves, for example, or sell it to someone else who will; or they might use it to be fraudulently reimbursed for bogus treatments or medications (that one also requires them to steal a health care provider’s billing number or find a crooked health care provider).

You’ll generally need to provide your insurer with proof that you’ve reported the identity theft at IdentityTheft.gov, and you’ll also need to reach out to every health care provider you deal with — and those where the identity thief has made claims or received treatment — to request copies of your medical records. Maddeningly, some may stonewall you on the grounds of protecting the scammer’s privacy, but you can pursue an appeal through the federal Department of Health and Human Services.

Because there are so many players involved, and privacy issues as well, sorting out medical identity theft (and the related insurance issues) can take many months. It’s entirely possible that some parts of the fraudulent medical records may still show up in your own record for years to come.

Government Identity Theft: Probably Months

If scammers are able to learn and use your Social Security Number, things can get really complicated. They can potentially hijack your Social Security benefits or other government benefits (COVID stimulus payments and unemployment benefits were a popular target in 2020), be employed illegally by using your SSN or even file a fake tax return in your name in order to steal your refund.

Unwinding the threads will typically take several months. After you report the theft at the website IdentityTheft.gov, you’ll also need to contact each government agency that’s involved (federal, state or local); and if it relates to your taxes, you’ll need to fill out an Identity Theft Affidavit. You’ll need to do a lot of legwork, and may need to appear in person at an IRS or SSA branch office to have your identity officially verified.

Plan on this process taking several months at least, especially if you need to have government-issued IDs reissued.

Criminal Impersonation: Years, Potentially Decades

One of the most problematic forms of identity theft arises when the thief doesn’t victimize you directly but uses your identity to commit crimes or evade detection for crimes they’ve already committed. Possibilities include using your identity to be hired for a job they’d otherwise be ineligible for (a burglar working as an alarm installer, for example, or a sex offender at a day care) and giving a fake ID in your name to a police officer at a roadside stop.

Getting copies of your credit reports from the major agencies is one of the first steps in the restoration process. Checking for fraudulent accounts and charges (and any corresponding collection actions) will be your highest priority, but don’t overlook the section that tells you who has run credit checks on you recently.

This is often where you’ll find out if anyone has used your identity to get utilities or a cellular phone, apply for a rental property or otherwise take advantage of you in ways that don’t immediately or obviously show up elsewhere. To find fraudulent utility accounts, you can contact your state’s Public Utility Commission and request a report; for cellular phones, internet service or cable TV, you can reach out to the National Consumer Telecom and Utilities Exchange (basically a niche credit reporting agency specifically for the telecom industry) for your data report.

You can contact the NCTUE directly to report fraudulent accounts, and it’s also a good idea to contact any individual utilities or telecom companies directly. Like the mainstream credit reporting agencies, the NCTUE gives you the option of credit freezes and extended fraud alerts to nip any future problems in the bud.

Full Restoration of Your Credit: Sometimes Days, Sometimes Years

Bringing your credit score back to its pre-incident level could be a complicated process, depending on how long the criminals were able to exploit your identity (as we mentioned earlier, a quick response helps a lot) and how they did so.

Chasing down fraudulent charges and bogus accounts is tedious and time consuming (you’ll spend a lot of time on hold), but you should be able to get most of those charges reversed and the accounts shut down. Those can be expunged from your credit records pretty quickly (within days), but there’s always a risk some creditors may drag their feet or even report new derogatory information to the credit reporting agencies, which would put them in violation of the Fair Credit Reporting Act. You might need to consult a lawyer who specializes in post-identity theft recovery to help you navigate complications like this.

The timeframe can stretch unpredictably if there are multiple undetected criminals out there using your identity (sometimes years after the initial breach) to fraudulently obtain new credit and duck out on new bills. Sadly, once your data is out there, it’ll never completely go away.

Psychological Impact: Years, Maybe Lifelong

One underappreciated (and under-studied) impact of identity theft is on your health, both mental and physical. It’s completely understandable: any theft can feel like a violation, but the theft of your identity is especially so.

In its 2018 Victims of Identity Theft report, published in April 2021 as a supplement to the National Crime Victimization Survey, the Bureau of Justice Statistics found that about 1 in 12 victims of identity theft reported new (and sometimes lasting) mental and physical ailments as a result of the related stress.

The stress was directly related to how long each respondent needed to clean up the mess left by the identity theft. The good news is that for the simplest cases — a single, isolated incident that could be cleared up with a phone call — lasting damage was minimal, with only 3 percent of respondents reporting “severe emotional distress”; but that figure rose to 32 percent (almost one third) of those who needed six months or longer to get their affairs sorted out. The Identity Theft Resource Center, using a different methodology and a broader definition of identity theft, found that a significant majority of victims reported feeling angry, violated, unsafe, powerless or depressed.

Resources You Can Lean On

If you’ve been the victim of identity theft, there are several resources available to help you put things right. The FTC’s IdentityTheft.gov website is an important starting point, not only as a place to report the fraud but also for the detailed, personalized recovery plan it will generate for you. If you don’t opt to create a personalized plan, you can still browse a checklist of recovery steps. Your state may offer a similar guide, customized with local resources.

The IRS maintains a Taxpayer Guide to Identity Theft to help you cope with any tax-related steps, and is stepping up its game with a whole new set of resources for consumers, as required by 2019’s Taxpayer First Act. The Social Security Administration has an informative pamphlet on Social Security-related identity theft.

The Identity Theft Resource Center, a nonprofit affiliated with numerous government agencies and corporations, offers both a help center and a range of informative articles to help you navigate the recovery process. The FTC’s own Consumer Information page on identity theft is an excellent resource as well, though it focuses less on recovery than prevention.

Never Again: Protecting Yourself From Identity Theft

Once you’ve had the experience of coping with identity theft and the various problems that come in its wake, you’ll probably never want to go through that again. Unfortunately, that’s easier said than done, but security-conscious habits can help minimize the risk and minimize the damage if it does happen.

These habits include:

Checking your account statements diligently, every month, without fail
Monitoring your credit score by pulling credit reports regularly (each of the three agencies is obligated to give you one free report per year, so if you stagger them you can check every 4 months)
Placing a credit freeze or extended fraud alert with each of the main credit reporting agencies, which makes it significantly harder for scammers to use your data
Setting up alerts with your financial institutions, so they’ll contact you directly if they spot suspicious activity
Setting up an Identity Protection PIN with the IRS
Using strong passwords, and having a separate password for every site or app you use (you might need to use a password manager)
Familiarizing yourself with common phishing scams, text-message scams, phone scams and romance scams so you’re less likely to fall for them
Checking your email address, phone number and passwords regularly to see if they’ve been compromised in a known data breach
Minimizing your online digital footprint, so there’s less of your data out there to be stolen
Sharing less on social media, strengthening your privacy settings and periodically auditing your followers to make sure they’re legitimate
Taking advantage of Spokeo Protect’s dark-web monitoring to receive real-time alerts that let you know if your information is offered up for sale in the dark corners of the internet

These steps can’t guarantee you’ll never suffer another identity theft, but they’ll significantly reduce the odds of it happening again. And if it does, you’ll be much more likely to catch it before it becomes a serious problem.

It’s not perfect, but you’ll have the peace of mind that comes from knowing you’re in control to the greatest extent possible.