Identity theft after death: how to protect a loved one

Three months after his father died, Marcus opened the mailbox and found a welcome packet for a new store credit card in his dad's name. It had a $2,500 limit. His father hadn't left the hospice bed in the last six weeks of his life, and he certainly hadn't gone shopping for furniture in another state.

Identity theft after death is more common than most families expect, and it tends to show up at the worst possible time, when you're tired, grieving, and buried in paperwork. A 2012 study by the fraud-analytics firm ID Analytics estimated that the identities of about 2.5 million deceased Americans are used to open accounts or apply for credit each year. The good news is that most of it is preventable with a handful of phone calls and letters in the first few weeks. This guide covers what to do, in roughly the order it helps most, and what to do if someone has already used your loved one's name.

Why thieves target the identities of people who have died

A deceased person's identity is attractive because nobody is watching it. A living person notices a strange charge or a credit inquiry within a month or two. A person who has died doesn't check their mail, and the family is usually focused on the funeral, the house, and the will.

There's also a lag in the system. When someone dies, the funeral home typically reports the death to Social Security, which eventually updates the Death Master File that banks and credit bureaus use to check applications. That update can take weeks, and smaller lenders don't always check it at all. In that window, a thief with a name, a birth date, and a Social Security number can open a credit card, file a fake tax return, or take out a phone plan.

Some of the information they need is handed to them. Obituaries often list a full birth date, the town someone was born in, a mother's maiden name, and the date and time of the funeral. Stolen wallets, discarded mail, and data from old breaches fill in the rest. Sometimes, uncomfortably, the person using the identity is someone the family knows.

How to prevent identity theft after someone dies

The core of prevention is telling the right institutions quickly and in writing. Here's the order I'd work through, starting in the first week or two.

1. Order plenty of death certificates. Almost every step below needs one, and some places want a certified copy. Our guide on how to get a death certificate explains how many to order and where.
2. Confirm Social Security has the death on record. The funeral home usually handles the report, but a call to Social Security a week or two later confirms it went through. Our post on how to notify Social Security of a death walks through that call and what benefits stop or start.
3. Notify the three credit bureaus. Contact Equifax, Experian, and TransUnion and ask each one to mark the credit file "deceased, do not issue credit." Ask for a copy of the credit report at the same time. More on this below.
4. Contact banks, credit card companies, and lenders. Tell each one about the death and ask them to note it on the account, close cards, and remove authorized users.
5. Notify the DMV, the passport office, and the voter registration office. These are the agencies that issue the ID documents a thief could use in person.
6. Lock down email and phone accounts. Change passwords where you have access, or ask the provider to memorialize or close the account.

You don't need to finish all of this in one day. Two or three calls an afternoon is a reasonable pace, and keeping a simple log of who you spoke to, the date, and any reference number will save you a lot of repeat explaining later.

Flag the credit file with all three bureaus

Each credit bureau keeps its own file, so you have to contact all three. Telling one does not automatically tell the others, which surprises a lot of people.

Typically the executor, the estate administrator, or a surviving spouse can make the request. Each bureau has its own process, and most ask you to mail a letter along with a copy of the death certificate and a document showing your authority, such as letters testamentary or a marriage certificate. Ask for two things in that letter: that the file be flagged as deceased with a note not to issue new credit, and that they send you a copy of the most recent credit report.

That report is worth reading carefully, line by line. It shows every open account, which helps you know what to close, and it shows recent inquiries. An inquiry from a lender nobody recognizes, dated after the death, is an early warning sign. The report can also turn up accounts the family didn't know about, which ties into the broader work of finding the assets of a deceased person.

Plan to request the report again in three to six months. Marcus did this, and the second report showed the store card had been closed and reported as fraud, which gave him some peace of mind that the first letter had actually worked.

What to leave out of the obituary

An obituary is a public document, and anything in it can be copied. You can write something warm and personal without giving away the details that help someone open an account.

The safest approach is to leave out the exact date of birth. Age alone, or month and year, is enough for friends to recognize who it is. Skip the mother's maiden name, since it's still a common security question, and leave out the home address. Be a little careful with the funeral announcement, too. Listing the service time alongside the family's address tells burglars when a house will be empty. Some families ask a neighbor to stay at the house during the service for this reason.

None of this means the obituary has to be thin. The parts that make an obituary feel like a person are the stories, the people they loved, and what they were like at the dinner table. Those were never the risky parts. Our guide on how to write an obituary has plenty of ideas for the parts worth keeping.

Watch the mail, the tax return, and the inbox

Identity theft usually announces itself through the mail before it shows up anywhere else. Forward the deceased person's mail to the executor through the post office, and open everything for at least a year.

Watch for credit card offers that look like they've been approved, collection notices for accounts you don't recognize, and statements from banks you've never heard of. Any of those deserves a phone call. To cut down on the flood of marketing mail, which is itself a source of personal details for thieves, you can add your loved one's name to the Deceased Do Not Contact list run by DMAchoice, the mail-preference service of the Association of National Advertisers. It takes a few months to take effect, but junk mail does slow down.

Tax fraud is its own category. Thieves sometimes file a return in a deceased person's name early in the year to collect a refund. You'll find out when the real final return gets rejected because a return was already filed under that Social Security number. If that happens, the IRS Identity Theft Central page explains the process, which usually involves filing a paper return with Form 14039, the Identity Theft Affidavit, attached. Filing the final return as early as you reasonably can makes this less likely.

Email matters more than it used to. A deceased person's inbox holds password reset links for nearly every account they had. If someone gains access, they can reset logins one by one. Change the password if you have legitimate access, turn on two-factor authentication, and then work out which accounts to close.

What to do if identity theft has already happened

If you find an account or charge your loved one didn't make, report it, and know that the family generally isn't on the hook for the debt. Fraudulent accounts aren't valid debts of the estate, and they're never the personal debts of children or other relatives.

Start with the creditor. Call the fraud department of the company that opened the account, explain that the account holder has died, and say the account was opened fraudulently. Ask them to close it, stop collection, and send you written confirmation. Follow up with a letter that includes a copy of the death certificate.

Then file a report at IdentityTheft.gov, the Federal Trade Commission's site for reporting identity theft and getting a recovery plan. The report gives you an official record to send to creditors and the credit bureaus. Some creditors will also ask for a police report, so it's worth filing one with the local department in the city where the person lived.

Finally, write to each credit bureau with the fraud report and ask that the fraudulent accounts be removed from the file. Keep copies of everything. In my experience, the families who get these cleared fastest are the ones who can send the same tidy packet of paperwork to every company that asks.

If the amount is large, or a collector keeps pushing after you've sent proof, it's reasonable to talk with the estate's attorney or a consumer protection lawyer. Your state attorney general's office also takes complaints about debt collectors.

Making it easier for your own family

Most of the work in this guide gets harder for one reason: the family has to piece together what accounts existed and where the paperwork lives. It's much easier to protect a name when you know every card, every bank, and every login attached to it.

You can give your family that head start now. A simple list of your accounts, the cards in your wallet, and where your important documents are kept would save whoever handles your estate a lot of guesswork, and it would let them close things before anyone else thinks to open something new. It doesn't have to be elaborate. Something you update once a year, maybe when you do your taxes, is plenty.

When I Die Files is one place to keep that list, next to the letters you'd want your family to read. That way the person sorting out your accounts has what they need to protect your name, and they hear from you while they're doing it.