You’re looking through recent transactions on your credit card, when you see a purchase at an online electronics store you’ve never shopped at. Or maybe it’s plane tickets (as was the case with one of our forum members).
Should you cancel the card? Freeze your credit? Panic? We asked two identity theft experts to help us put together a step-by-step guide of what to do next.
1. Make sure it’s really fraud
First, rule out the possibility the transaction was made by anyone with access to your account, such as an authorized user, recommends Michael Bruemmer, vice president of consumer protection at Experian.
Also understand that a legitimate transaction may appear fraudulent because it’s showing up under a merchant name you don’t recognize, Bruemmer notes. For example, drinks at a familiar venue or a stay at a local hotel may bear the unfamiliar name of the parent company on your statement.
2. Call your card issuer
Once you’ve determined that the transaction is fraudulent, call your issuer — and use the inevitable hold time to your advantage.
“You’ll probably be on hold for a few minutes, so you’ll want to look really closely through that statement and see if there are any other transactions you don’t recognize,” says identity theft and security expert Rob Douglas. “Maybe even go back a month.”
While some issuers may require paperwork, most will remove the fraudulent transaction immediately, Bruemmer says. Most card issuers also have zero-liability policies, meaning you won’t be held responsible for charges made by thieves.
“So it’s just a question of getting it corrected,” Bruemmer says. “In most cases with fraudulent card charges we see, working with members who use our [ID-theft protection] products, it’s handled literally within minutes.”
Even so, Bruemmer recommends taking down your case number and the name and direct extension of anyone you talk with to save yourself time, should you need to call again.
The issuer will probably cancel your current card and issue you a new one, Douglas says. So be sure to update any autopay bills accordingly.
3. Change your passwords
If thieves got ahold of one card’s account number, it’s possible they might have gotten other personal information. So change the passwords on all your financial accounts, including cards, bank accounts and investment accounts.
“The odds are it’s just that one card,” Douglas says. “But depending on how the breach took place, your others could be in jeopardy.”
In the habit of using the same password across all your accounts? Install unique passwords on each account now.
“That way, if one is compromised, you don’t have all the others at risk as well,” Douglas says.
4. Check and monitor your financial accounts
In the months after discovering a fraudulent charge, keep a close eye on all your financial accounts. Don’t forget to include your mobile phone account, Douglas says, as a thief who gains access could buy a phone with it – and you may never notice if you let autopay handle your phone bill.
Both Bruemmer and Douglas encourage setting up alerts on your credit card and bank accounts.
“Most institutions have made that easy,” Bruemmer says. “You can set up alerts for every transaction during a time frame or over a dollar limit. There are different ways to set the filter.”
5. Check and monitor your credit reports
Don’t stop at your financial accounts. It’s possible thieves got the additional personal information necessary (such as your Social Security number) to open new accounts in your name.
AnnualCreditReport.com allows you free access to your reports from the three major bureaus (Equifax, Experian and TransUnion) once per year. Go through your reports for anything suspicious or incorrect. Then check back again in a few months, Douglas emphasizes.
“That’s the only way you’re going to figure out if there’s been any new-account fraud,” he says.
Even if thieves didn’t get all your personal information, you might still see odd things on your credit report due to what’s called synthetic identity theft, Bruemmer says. Thieves may breach one database that has names and addresses, and another with Social Security numbers. This information can be cobbled together to create fake identities (with one person’s Social, for example, and another’s address and birth date).
It’s an especially sneaky form of fraud, as some financial institutions’ fraud-detection systems aren’t sophisticated enough to realize that a Frankensteined phantom identity is applying for credit.
“The system may only be checking, ‘OK, is that a valid address? Is that a valid Social?’ Bruemmer says.” It may not be checking if all those pieces of information lead back to the same person.
Bruemmer has found four different Social Security numbers tied to his credit report. Two seemed to be transcription errors, while the other two likely stemmed from synthetic identity fraud, he suspects.
“That’s why it’s important always, in addition to monitoring your financial accounts, to do a spring cleaning of your credit file,” Bruemmer says.
6. File a police report
This step may seem like overkill, and it’s not as if detectives are going to doggedly hunt down the guy who used your card to buy a TV.
“Ninety-nine times out of a hundred, nothing else is going to happen after you file that report,” Douglas says.
Still, having that paperwork and police report number can come in handy if you become a victim of full-blown identity theft. Douglas recommends filing a report with the FTC while you’re at it. The FTC recently launched a site that helps guide you through the process.
“Maybe someday you get a call and they say you’re three months behind on your mortgage, and you’re like, ‘What mortgage?’” Douglas says. “It’s going to be tremendously to your benefit if you can say you’re a victim of identity theft, you’ve filed a police report, you’ve filed an FTC report and here’s all your paperwork.”
7. Consider a credit freeze
A credit freeze is somewhat of a nuclear option, as it involves completely locking down your credit so that no new accounts can be opened in your name (even by you). Although some states require the associated fees to be waived, you’ll generally have to pay to instate a freeze and lift it.
However, the idea of a stranger slithering their way into your identity far enough to use your credit card may very well have you considering the kill-it-with-fire method.
Experian’s ProtectMyID service handles about 27,000 cases of identity theft per year, Bruemmer says. About 30 percent of those involve credit card fraud. So, the fact that someone used your card number doesn’t automatically mean full-blown identity theft (the kind where a thief can apply for cards and mortgages under your Social Security number). Out of all those who use Experian’s identity-protection products, only about 2 to 3 percent ultimately end up placing a freeze on their credit, Bruemmer says.
“A security freeze would be two or three steps down the line, when you have evidence of full identity theft, Bruemmer says.
Plus, while a fraudulent charge on your card may have you fearing the worst, many thieves, Bruemmer says, are content with one-off card fraud, since it’s a relatively low-risk crime with a quick dollar return.
“Most financial institutions aren’t going after credit card fraudsters doing it one time,” he says.
Even so, the decision of whether to place a freeze is personal – and the only way to protect yourself from new-account fraud, Douglas points out.
“Could [a fraudulent transaction] be an indication of a larger problem? The answer is ‘absolutely,’” Douglas says.
Douglas notes that many industry professionals have come to see card fraud as a “routine” nuisance — and not on par with devastating blow of full identity theft.
“For the victim, though, they don’t see the difference,” Douglas says. “They know somebody used their card number. So I still consider that identity theft. If you’re using my credit card to buy something and you’re not me, you’ve used my identity. Our financial and personally identifiable information, that’s who we are.”
If you do go for the powerful protection of a credit freeze, keep in mind that, while it offers protection against new-account fraud, it offers no protection for already-compromised accounts. So continue to monitor your card transactions.
“Any of your existing accounts can still be manipulated or used,” Bruemmer says.