Skip to main content

6.3 Personal Data Incidents

Identity Theft

Signs of identity theft:

  • Accounts or loans you didn't open appearing on credit report

  • Calls or mail from debt collectors about debts you don't owe

  • IRS notification of multiple tax returns filed in your name

  • Medical bills for services you didn't receive

  • Mail or email about accounts you didn't create

  • Missing mail or bills

  • Denied credit unexpectedly

  • Unauthorized withdrawals from bank accounts

Step 1: Contain the Damage (IMMEDIATELY)

  • Place fraud alert on credit reports (call ONE bureau, they notify the others)

    • Equifax: 1-888-766-0008

    • Experian: 1-888-397-3742

    • TransUnion: 1-800-680-7289

    • Fraud alert lasts 1 year, requires creditors to verify your identity

  • File FTC Identity Theft Affidavit

    • Go to https://www.identitytheft.gov

    • Click “get started” – you’ll be guided through a series of questions, have ready:

      • Personal information (name, address, SSN, DOB)

      • Details about the identity theft (what happened, when discovered)

      • Information about fraudulent accounts (account numbers, companies, amounts)

      • Any evidence you have (emails, bills, credit reports)

    • Review and submit

    • Download and print multiple copies (keep one safe as a backup)

    • This will be used for police reports and to legally contest any action taken against you on account of the identity theft

  • Get your credit reports

    • Request from all three bureaus immediately

    • Go to annualcreditreport.com (or one of your financial accounts)

    • Or request from the bureau you called for fraud alert

    • Review for accounts and inquiries you don't recognize

  • File police report

    • Contact local police department

    • Bring FTC Identity Theft Report

    • Request a copy of the police report

    • You'll need this for disputing fraudulent accounts

Step 2: Close Fraudulent Accounts (Within 24-48 Hours)

  • For each fraudulent account found

    • Contact the fraud department of the company

    • Explain you're an identity theft victim

    • Provide your Identity Theft Report

    • Request the account be closed

    • Request fraudulent charges be removed

    • Ask for written confirmation

  • For fraudulent credit cards or loans

    • Request investigation

    • Provide police report and FTC Identity Theft Report

    • Follow company's fraud dispute process

Step 3: Secure Your Legitimate Accounts (Within 48 Hours)

  • Change passwords on all financial accounts

  • Enable MFA on all accounts

  • Review recent activity on all accounts

  • Close accounts that were compromised

Step 4: Additional Actions

  • Consider a credit freeze

    • More protective than fraud alert

    • Blocks new accounts from being opened

    • Free at all three bureaus

    • You can temporarily lift when applying for credit

  • Ongoing monitoring (6-12 months)

    • Review credit reports every 3 months

    • Monitor bank and credit card statements weekly

    • Watch for new collection calls or letters

    • Keep detailed records of all actions taken

    • Follow up on dispute resolutions

  • If tax fraud occurred

    • Contact IRS Identity Protection Specialized Unit: 1-800-908-4490

    • File Form 14039 (Identity Theft Affidavit)

  • If medical identity theft

    • Contact your health insurance company

    • Request copies of medical records to review

    • Dispute incorrect information with providers

Lost or Stolen Wallet or Purse

What's at risk:

  • Credit/debit cards

  • Driver's license or ID

  • Social Security card (if you carry it - you shouldn't)

  • Insurance cards

  • Other identification documents

Step 1: Immediate Containment (IMMEDIATELY)

  • Cancel all cards:

    • Call fraud departments for all credit and debit cards in wallet

    • Request new cards with new numbers

    • Note the date/time you report each card

  • Place fraud alert on credit reports (if ID was in wallet):

    • Call one credit bureau (see Identity Theft section above)

  • Check accounts for unauthorized charges

    • Review all recent transactions

    • Report unauthorized charges immediately

Step 2: Replace Documents (Within 24-48 Hours)

  • Driver's license/ID: Contact your state DMV to report and replace

  • Social Security card: Contact SSA (don't carry SSN card in future)

  • Insurance cards: Contact providers for replacements

  • Other cards: Library, gym, membership cards - contact to cancel/replace

Step 3: Monitoring

  • Monitor all financial accounts daily for 2 weeks

  • Review credit reports monthly for 3 months

  • Watch for fraudulent account openings

  • Save all documentation of reported theft

Sent Money to a Scammer

Common scenarios:

  • Wire transfer to scammer

  • Gift cards purchased and codes given

  • Cryptocurrency sent

  • Payment app (Venmo, PayPal, Zelle) transfer

  • Credit card payment to fake website

Step 1: Try to Stop the Payment (IMMEDIATELY)

Document everything:

  • How scammer contacted you

  • What they claimed

  • Timeline of events

  • Amount lost

  • All communications

For wire transfers:

  • Contact your bank (fraud department)

  • Request wire transfer recall

  • Most effective within 24 hours

  • Provide details: amount, date, receiving bank

For credit/debit card charges:

  • Contact card issuer fraud department

  • Request transaction be blocked or reversed

  • File dispute/chargeback

  • Request new card number

For payment apps (Venmo, PayPal, Zelle):

  • Contact app support

  • Report unauthorized transaction

  • Request cancellation/reversal

  • Note: Zelle transfers are usually instant and irreversible

For gift cards:

  • Contact gift card company (number on card)

  • Provide card numbers and receipt

  • Request freeze/cancellation

  • Success rate is low but worth trying immediately

For cryptocurrency:

  • Generally irreversible

  • Report to exchange if applicable

  • Document transaction details

Step 2: Report the Fraud (Within 24 Hours)

  • File FTC report https://reportfraud.ftc.gov 

    • Creates official record

    • Helps track scam patterns

  • File police report:

    • Needed for most theft claims

    • Helps with bank/credit card disputes

    • Bring all documentation

Step 3: Protect Against Further Loss (Within 24 Hours)

  • Place fraud alert on credit reports if you gave personal information

  • Monitor accounts daily for additional unauthorized charges

Gave Out Personal Information

Follow this playbook if you gave out high risk, personal information via email or to a caller in a conversation you did not initiate.

High Risk Personal Information:

  • Passwords or PINs
  • Bank account numbers including any credit card data (number, CVV)
  • Social Security number or date of birth
  • Any answer you use in a security question

Step 1: Immediate Actions (Based on What You Shared)

  • Passwords or PINs: Follow the appropriate account compromise playbook above

  • Bank account numbers or any credit card data: Contact fraud department on back of card, or call banking institution to stop any unauthorized pending transactions and have new card or account issued

  • Social security number or date of birth: Monitor credit report for any queries or new accounts and follow the Identity Theft playbook if anything shows up; consider a credit freeze regardless by calling one of the three credit bureaus (see Identity Theft playbook)

  • Any answer you use in a security question: Change the security question in all sites where it was used

Step 2: Monitor accounts daily for 2 weeks

If you see anything unusual, follow the appropriate playbook

Clicked a Phishing Link or Opened Suspicious Attachment

Your next steps are based on what you did, based on risk.

Low Risk

  • If you ONLY clicked the link and did not enter any information or download any files, close the browser and clear your browser cache.

  • If you downloaded any files, and especially if you opened the file, delete the files and run a full virus scan (see Malware or Virus infection playbook below).

High Risk

  • If you entered a password, follow the playbook for the appropriate type of compromised account above

  • If you entered any other personal information, follow the playbook for Gave out Personal Information based on the type of data you entered

Received Notice of Data Breach

This is when a company notifies you your data was exposed.

Common notification sources:

  • Email from company

  • Letter in mail

  • News article about breach

  • Notification from HaveIBeenPwned.com

Step 1: Verify Notification is Legitimate (IMMEDIATELY)

Beware of phishing! Don't click links in breach notification emails, instead, verify using one of the following:

  • Go directly to company's website (type URL yourself)

  • Look for official breach notification page

  • Verify through news sources

  • Call company using official phone number

Step 2: Understand What Was Exposed (Within 24 Hours)

Read the notification carefully:

  • What specific data was compromised?

  • When did the breach occur?

  • What is the company doing?

  • What services are they offering (credit monitoring, etc.)?

Step 3: Take Action Based on Data Exposed (Within 48 Hours)

If passwords were exposed: Follow the playbook for the type of compromised account above

If email address only: Not much you can do here, just understand you will likely start receiving a lot of spam and potentially phishing attempts, so be extra vigilant in the coming weeks and months.

If Social Security number or financial data:

  • Place fraud alert on credit reports (see Identity Theft section)

  • Consider a credit freeze

  • Monitor credit reports monthly for 12 months

  • Enroll in credit monitoring if offered (only California requires this be offered at the time of this writing, but many companies will offer anyway in a show of goodwill)

  • Review financial statements going back to the date of the breach (US law requires you are notified, but the timeline for notification is somewhat of a gray area)

If medical information:

  • Watch for fraudulent medical bills

  • Contact health insurance if fraudulent claims appear

  • Monitor credit reports monthly for 12 months

Step 4: Accept Company's Offer (If Valuable)

Many companies offer:

  • Free credit monitoring (usually 1-2 years)

  • Identity theft protection

  • Credit freeze assistance

Evaluate the offer:

  • Is credit monitoring included? (worth it)

  • How long is coverage? (longer is better)

  • Do you have to pay anything? (should be free)

  • Read terms carefully before accepting

Step 5: Additional Actions

Document the breach:

  • Save notification letter/email

  • Screenshot relevant information

  • Note what data was exposed

Monitor relevant accounts based on exposure and consider legal action if negligence was involved.

Ongoing monitoring:

  • Check credit reports every 3 months for 1 year

  • Monitor financial accounts for suspicious activity

  • Watch for targeted phishing using your data

  • Stay alert for identity theft signs

SIM Swap Attack

Signs of SIM swap:

  • Phone suddenly has no service/signal

  • Can't make calls or send texts (even after reboot)

  • Notifications of password resets you didn't request

  • Unusual account activity alerts stop arriving

  • Carrier confirms your number was ported to new SIM

Step 1: Regain Control of Phone Number (IMMEDIATELY)

Contact your mobile carrier:

  • Call from a different phone or use online chat

  • Verify account activity and report unauthorized SIM swap if the agent determined your SIM card was ported

  • Verify your identity (have account PIN ready)

  • Request your number be restored to your SIM

  • Ask them to lock your account with additional verification

Step 2: Secure Accounts That Use Phone for 2FA (Within 1 Hour)

Attackers may have targeted accounts using SMS for two-factor authentication. Verify recent logins to new devices in the following priority:

  • Email accounts (especially recovery emails)

  • Financial accounts (banks, investment, PayPal)

  • Cryptocurrency exchanges

  • Social media accounts

  • Any other account using SMS for authentication

If there was an unauthorized login, for each account:

  • Remove any new authorized devices that aren’t yours
  • Change password (from trusted device)
  • Remove SMS as 2FA if possible and replace with authenticator app or hardware key
  • Check recent activity for and perform damage control (see relevant playbook in Account Compromise above)
  • Enable login alerts if not already enabled

No comments to display

Back to top