Someone Opened a Credit Card in My Name: What to Do

Finding a credit card account you never opened (through a letter, a card in the mail, an alert or your credit report) can mean someone applied for credit using your personal information. Below are the steps the FTC recommends, in order, for shutting the account down, reporting it and getting it off your credit reports. The main tools are free: fraud alerts, credit freezes, credit reports and the FTC’s recovery plan.

1. Call the card issuer’s fraud department

Start here. IdentityTheft.gov’s recovery checklist says to call the fraud department, explain that someone stole your identity, and ask the company to close or freeze the account so no one can add new charges.

Use a phone number you trust:

• If the card arrived in the mail, the CFPB says to call the number on the back of the card, explain that you didn’t apply for it, and tell the company to cancel it.
• If you heard about the account by phone, text or email, don’t use the number or link in that message. The FTC warns that scammers fake caller ID. It says to contact the organization using a phone number, website or email address you know is real, such as the issuer’s official website.

A card you never asked for is a red flag for a reason. Under federal Regulation Z, a credit card can be issued only in response to a request or application, or as a renewal or replacement of a card you already accepted.

Write down the date, the person’s name and any reference number. Then change the logins, passwords and PINs for your other accounts, as the checklist recommends. You might have to contact the issuer again once you have your FTC Identity Theft Report (Step 4).

2. Place a fraud alert or freeze your credit

IdentityTheft.gov’s checklist calls for a free one-year fraud alert right away. Later, it suggests considering an extended fraud alert or a credit freeze, which “can help prevent further misuse of your personal information.”

	Initial fraud alert	Extended fraud alert	Credit freeze
What it does	A business must verify your identity before it issues new credit in your name	A business must contact you before it grants new credit in your name	Limits access to your credit report until you lift or remove it
Who can get it	Anyone who thinks they are or may become a fraud victim	People whose identity was stolen	Anyone
How long it lasts	1 year, and you can renew it	7 years	Until you lift or remove it
How to set it	Contact one bureau; it must tell the other two	Contact one bureau and send your FTC Identity Theft Report (the FTC says a police report also works)	Contact each of the three bureaus
Cost	Free	Free	Free

While a freeze is in place, the FTC says, “nobody can open a new credit account in your name, including you.” You can lift it when you need new credit. Neither a freeze nor an alert closes the account that is already open. Steps 5 and 6 handle that.

Official bureau pages:

• Equifax: credit freeze · fraud alerts
• Experian: credit freeze · fraud alerts
• TransUnion: credit freeze · fraud alerts

Phone numbers are on IdentityTheft.gov’s credit bureau contacts page. For a full walkthrough, see How to Freeze (and Unfreeze) Your Credit, and use the credit freeze tracker to keep track of all three bureaus.

3. Pull your credit reports and look for other accounts

You can get free reports from Equifax, Experian and TransUnion every week at AnnualCreditReport.com or by calling 1-877-322-8228. The FTC says the three bureaus have made the weekly program permanent. It also says AnnualCreditReport.com is the only website authorized to fill orders for the free reports that federal law provides.

Look for:

• accounts you don’t recognize
• credit checks from companies you’ve never done business with, which TransUnion lists as a sign of identity theft

Write each one down. IdentityTheft.gov says this list will help when you report the theft to the FTC and the police.

Credit reports don’t show everything. For checking accounts, IdentityTheft.gov points to your ChexSystems report; for phone and utility accounts, to your NCTUE report.

4. Report it at IdentityTheft.gov

Go to IdentityTheft.gov or call 1-877-438-4338. Give as many details as you can, including every account you found in Step 3. Based on your answers, the site creates your FTC Identity Theft Report and a personal recovery plan.

IdentityTheft.gov says the report “proves to businesses that someone stole your identity” and guarantees you certain rights, including the block in Step 6.

If you create an account, the site walks you through each step, tracks your progress and pre-fills letters for you. If you don’t, print and save your report and plan right away. Once you leave the page, you can’t get back to them.

Do you need a police report? The FTC calls it optional: “You may choose to file a report with your local police department.” The CFPB’s identity theft page suggests reporting to both local police and IdentityTheft.gov. A police report can help if:

• a business asks for one before giving you records about the fraudulent account (the law allows this; see Step 5)
• a credit bureau accepts it as proof. TransUnion, for example, says it can block fraudulent information if you send an FTC identity theft report or a police report.

If you go, IdentityTheft.gov says to bring a copy of your FTC Identity Theft Report, a photo ID, proof of address and any other proof of the theft. Ask for a copy of the police report.

5. Follow up with the issuer in writing

With your FTC report in hand, contact the issuer again. IdentityTheft.gov suggests asking for a letter confirming that the account isn’t yours, that you aren’t liable for it, and that it was removed from your credit report. Keep that letter. If the account ever reappears, it’s your proof.

IdentityTheft.gov’s sample letter for a new account asks the company to close the account, clear the charges and stop reporting it to the credit bureaus. The issuer may want a copy of your FTC report or its own dispute form. According to the FTC’s summary of victims’ rights, once a company has a valid FTC Identity Theft Report from you, it may not report the fraudulent account to the credit bureaus.

Ask for the application. When a credit card was opened in your name, IdentityTheft.gov suggests asking for a copy of the application and the applicant’s signature. According to the FTC, businesses must give identity theft victims copies of application and transaction records free of charge within 30 days of a written request. They can first require proof of identity, a police report and a completed affidavit, such as your FTC report. Use the records request letter.

6. Ask the credit bureaus to block the account

Write to each bureau whose report shows the account. Include your FTC Identity Theft Report, proof of identity, and a letter that identifies the fraudulent information, says it isn’t from any transaction you made, and asks the bureau to block it. IdentityTheft.gov’s sample letter to a credit bureau includes the mailing addresses.

Under section 605B of the Fair Credit Reporting Act, a bureau must block the information within 4 business days of receiving those documents. It must also promptly notify the company that reported it. The CFPB says that once notified, creditors can’t turn identity theft debts over to debt collectors. IdentityTheft.gov says blocked information won’t show up on your credit report, and companies can’t try to collect the debt from you.

A block isn’t guaranteed in every case. The law lets a bureau decline or undo a block if it reasonably decides that the request was made in error, that it was based on a material misrepresentation, or that you got goods, services or money from the account. If that happens, the bureau must tell you.

No FTC report? You can still dispute the account as an error, and the bureau has 30 days to investigate. IdentityTheft.gov warns that this route can take longer and there’s no guarantee the information will be removed.

Keep a paper trail

• Log every call: the date, the company, the person and what was agreed. IdentityTheft.gov’s checklist repeats this at almost every step.
• Send dispute letters by certified mail with a return receipt, as the FTC and the CFPB suggest.
• Keep copies of everything you send and receive, especially your FTC report and the issuer’s confirmation letter.
• Keep checking your credit reports. IdentityTheft.gov notes that weekly checks can help you spot new fraud quickly.

Will I have to pay the charges?

It depends on state law. The FTC puts it this way: “Under most state laws, you’re not responsible for any debt incurred on fraudulent new accounts opened in your name without your permission.”

You may have heard of a $50 federal cap. That rule, in Regulation Z, covers unauthorized use of a card you requested and accepted. That is a different situation from an account a thief opened.

If a debt collector contacts you about the account, IdentityTheft.gov says to write to the collector within 30 days of getting the collection letter. Explain that someone stole your identity and you don’t owe the debt, and send copies of your Identity Theft Report. There’s a sample letter for that, too.

If a company or credit bureau won’t fix the problem, you can submit a complaint to the CFPB. It accepts complaints about credit reports, credit cards and debt collection.

How to report it

• The card issuer’s fraud department: first by phone, then in writing.
• The FTC: at IdentityTheft.gov or 1-877-438-4338, for your Identity Theft Report and recovery plan.
• Local police: if you choose to, or if a business asks for a police report.
• The CFPB: if a company or credit bureau doesn’t resolve your dispute.
• ReportFraud.ftc.gov: for scam calls, texts or emails that follow.

Watch for the follow-up scam

• Fake FTC calls. IdentityTheft.gov warns that scammers are impersonating the FTC and telling people that someone used their information to open accounts. The FTC will never threaten you, tell you to move your money to “protect it,” or tell you to withdraw cash or buy gold and give it to someone.
• Fake fraud departments. Caller ID can be faked. Don’t call numbers or click links in unexpected messages. Reach the company through a number you know is real.
• Emails asking for your Social Security number. The FTC says AnnualCreditReport.com and the credit bureaus won’t email you asking for your Social Security number or account information.
• Paid “recovery” help. The FTC says government agencies and legitimate organizations never ask for money to help you get a refund.
• Paid credit repair pitches. According to the FTC, anything a credit repair company can legally do, you can do yourself for little or no cost. It’s also illegal for these companies to charge you before they help you.

Report these contacts at ReportFraud.ftc.gov.

What varies

• Your liability depends on state law. The FTC says “most” state laws protect you from debts on fraudulent new accounts.
• Issuer paperwork differs from company to company.
• Police reports are optional in FTC guidance, but a business may require one before it releases records.
• Blocks aren’t guaranteed in every case (see Step 6).
• Other damage may need more steps. If the thief also has your Social Security number, your IdentityTheft.gov recovery plan may include steps for taxes, government benefits or other accounts. See also I Gave a Scammer My Social Security Number: What to Do Now.