Stop! Thief!

Victims of identity theft must overcome enormous hurdles to restore their good names. Here are some pointers.

IN RETROSPECT, Linda Foley wishes she turned down that job offer.

Just four months after taking an advertising-sales position in June 1997, Foley discovered that her new boss had stolen her identity and racked up big debts in her name. She spent the next several years trying to undo the damage.

The scam? Using information from Foley's W-4 tax forms, her employer obtained a cell phone and a credit card in her name. When a creditor called her to confirm her new address -- Foley hadn't moved in years -- she realized something was wrong.

Back then, "I didn't even know what the words identity theft truly meant," she says. She became a quick learner. Today, Foley runs the Identity Theft Resource Center (ITRC) in San Francisco, which she created in 1999 to help other identity-theft victims.

The police eventually caught up with Foley's employer, who served three months' jail time in 2000. As for Foley, even though she estimates she spent hundreds of hours working to clear her records, she considers herself lucky in that the damage was limited to one credit card and a cell phone. "What saved me was (that) I caught her early in the game," she says. "It was sheer luck."

The Federal Trade Commission estimates that there were 10 million victims of identity theft in 2003, bringing the total number of victims for the past five years up to a staggering 27 million. Many aren't as fortunate as Foley was. Nearly a quarter of those who've had one or more credit cards opened in their names discovered the fraud six months or longer after it started.

Once identity theft is discovered -- 85% of victims find out after a call from a creditor or a collection agency, according to the ITRC -- it's up to the consumer to clean up the mess. And that's "typically a long and drawn-out process that can go on for months or even years," says credit expert Gerri Detweiler, author of "The Ultimate Credit Handbook."

Since in most cases consumers aren't liable for fraudulent accounts or charges, their out-of-pocket expenses are usually limited to paying for things like credit monitoring and phone calls to creditors. In fact, 63% of identity-theft victims have no out-of-pocket expenses, according to the FTC.

But that doesn't mean that there aren't lingering scars. "The most damaging part of identity theft is the pollution on your credit report and the effect it's going to have on your credit score," says Evan Hendricks, editor of the online newsletter Privacy Times and author of the book "Credit Scores and Credit Reports."

And the truth is that, these days, your credit report and the almighty credit score can affect you in more ways than you might realize. A poor credit rating could cause you to have trouble getting a mortgage or auto insurance. It could also cause you to pay more on your credit-card debt or other loans. In the worst-case scenario, you could be denied credit altogether -- through no fault of your own.

Needless to say, it's crucial to know what to do if you believe you're a victim of identity theft. The FTC has established guidelines for victims, and the three major credit bureaus, Experian, Equifax and TransUnion also do their best to educate consumers. "Consumers really need to be aware of all their rights...and have a good understanding of how this system works," says Hendricks.

Here's how to go about restoring your good name.

Stemming the Damage
The first thing an identity-theft victim should do is call all three credit bureaus and place a 90-day fraud alert in each of the credit reports. This is supposed to prevent crooks from opening more accounts, since it requests that creditors call you before they extend any credit on your behalf.

Unfortunately, this isn't foolproof. "The fraud alerts are only a request (for the creditors)," says Foley. "They're often not observed and the applications go through anyway." In a study conducted by the ITRC in 2003, most victims reported that they had three to six credit applications approved without their permission after placing an alert. This happens most often with "companies that don't want to lose the quick sale," according to Foley, like car dealerships, electronic stores, cell-phone companies. Even if it's not 100% effective, however, this is still an important step.

Once you've alerted the credit bureaus, they'll send you a free copy of your credit report. Before removing fraudulent information, credit bureaus will ask for a police report stating that you were a victim of identity theft. You can get one from your local precinct.

You will also need to fill in and mail an Identity Fraud Affidavit, which is available on the FTC Web site. Remember to keep copies for yourself and mail everything certified, return-receipt requested.

Next, alert all creditors of the situation, old and new alike. According to the FTC, a third of all identity-theft cases last year involved opening new accounts with the victim's information. The rest involved misuse of already existing credit or bank accounts.

David Rubinger, spokesman for Equifax, even suggests freezing your existing credit accounts to make sure they won't be used by a thief. Creditors will issue replacement cards with different account numbers.

Protecting Your Credit Report and Credit Score
As soon as the credit bureaus receive the police report and affidavit, they will remove any fraudulent accounts or other information described in the documents, according to Heather Greer, a spokeswoman for Experian.

But the problem is, the fraudulent information may -- and often does -- reappear, says Hendricks. That's because the creditors' automated systems keep reporting the accounts, by mistake, to the credit bureaus. Some consumers have even taken the credit-card companies or the bureaus to court, says Hendricks, who's often called as an expert witness on such cases. "I've seen a lot of people who have only been able to stop the mistakes from reinsertion after getting a lawyer," he says.

Your credit score, in the meantime, will reflect the commotion in your credit report, says Ryan Sjoblad, a spokesman for Fair Isaac, the company that calculates the scores. "Identity theft could be a serious damper to your score," he says. Once you start the process, it should get back to where it was because disputed accounts are temporarily not counted against the consumer's FICO score. "So if a person files a dispute with the credit bureaus and they put an investigation-pending status on an account, the consumer's FICO score will probably go up while the investigation is ongoing," Sjoblad says. However, should the fraudulent accounts reappear in your credit report, your credit score will take the hit again.

The good news: Freezing your current credit accounts and opening new ones with your creditors shouldn't be a problem. According to Sjoblad, when an account is listed as "lost or stolen" in the credit report and a new one is opened with the same creditor, it will carry the exact same credit history as before (without the fraudulent charges, if any). FICO calculations will ignore the closed account, so having a card reissued will have no bearing on your score.

Introducing the FACT Act
As any victim will tell you, fighting identity theft requires the patience of Job. But Congress has taken notice. In December 2003, it signed an amendment to the current Fair Credit Reporting Act, known as the FACT Act, which attempts to make the process easier for consumers. To start with, it entitles everyone to one free credit report each year. It will require creditors to give consumers information about fraudulent accounts (transaction records, applications and so on) that can help victims prove the fraud. It mandates that creditors "take reasonable steps" to make sure the person opening the account is legitimate if there's a fraud alert in their report. And finally, it forbids creditors from selling accounts in dispute to collection agencies, which happens all too often now, according to Detweiler.

Whether this new law is good news or bad depends on which state you call home. In some -- like California -- the existing state law, which will be replaced by the federal law is more favorable to consumers. For example, the credit bureaus in California have 10 days to investigate a disputed account; the FACT Act will give them 30. "We won some, but we lost some," says Foley.

The Long-Term Protection Plan
As soon as you establish that you've become a victim of identity theft, you may also want to place a seven-year victim statement in your credit reports. It works like the 90-day alert in that it requests that creditors notify you before extending credit on your behalf, according to Experian's Greer, and it will stay in your record for seven years.

But keep in mind that having an alert or a victim statement could inconvenience you as well. "Consumers can be delayed when trying to get credit, and the company could just decide to deny them credit if they don't want to deal with the procedures," says Naomi Lefkovitz, a staff attorney with the FTC. "You have to weigh the options." On the upside, she adds, consumers can always request that the bureaus take the alert off.

It's also important to keep a careful eye on credit reports in the future. "I would absolutely sign up for a credit-monitoring service for at least a couple of years," says Detweiler. All three credit-reporting bureaus, as well as Fair Isaac, offer credit-monitoring products at reasonable prices. For $4.95 a month, Fair Isaac will monitor your credit for any changes that may signal theft, send you an updated FICO score and three credit reports every three months, and provide an insurance policy that will cover your expenses if identity theft occurs. (This includes legal fees, long-distance phone calls, even up to $2,000 of lost wages.) The insurance benefit is up to $25,000, with no deductible.

Of course, even after you've cleared your name, chances are you'll never feel completely safe from identity theft. "(My perpetrator) has been a cancer in my life since June 1997," says Foley, who is still afraid to give out her Social Security number to anyone, even her insurance company.

But some would say that, when it comes to protecting one's identity, a little paranoia isn't a bad thing.