Identity Theft, Credit Reports, and You

What problems can this advice help with? What can’t it?

If you want to see what is on your credit report, you’re legally guaranteed three free reports a year; once every 4 months is plenty for most people. You can also get free ones through banks these days; American Express and Capital One, among others, will give them for free as a customer acquisition/retention tool.

Do not use the following advice to correct a problem with an account which is factually yours

Was an account opened in your name without your consent? Great, you’re in the right place.

Understanding the players

There are three big credit reporting agencies (CRAs) in the US: Equifax, TransUnion, and Experian. Their business model is keeping records, organized on a per-person basis, about debts. They sell this information to banks for the banks to use in underwriting processes. They also sell credit scoring, a product which gives the bank a single number (or small set of numbers) to evaluate your creditworthiness.

A brief note about credit scoring

The CRAs get data from financial institutions (“banks) and non-bank creditors (“debt collectors”)

The most interesting items on your credit reports are called tradelines […and includes mainly] when the account was opened, a monthly balance history, and a monthly report of what state the account was in (paid as agreed, late by 30 days, late by 60 days, defaulted, etc).

A CRA can’t “close an account.” A bank maintains an account. A CRA only has a tradeline. The action you want is them to correct and/or delete that tradeline.

CRAs do not collect debts. Debt collectors (or original creditors, or lawyers hired by either of the two) collect debts.

Never pay a penny of a debt which isn’t yours. Paying waives your legal rights, because the system assumes that nobody would pay something they didn’t actually owe. Paying also doesn’t help you, because in most cases paying debts which were once delinquent doe not improve your credit scores.

Understanding a CRA’s incentives

Your data is their only product. If they could never talk to you ever, they’d love to do that, because talking to you costs them money but doesn’t make their product (you) much more valuable in most cases. Luckily for you, the CRAs are regulated in the United States, so just plugging their fingers in their ears isn’t an option… but they’ll certainly push that to the limit.

The main regulation CRAs care about is the Fair Credit Reporting Act.

Assume the CRAs will do the bare minimum to comply with the law, always. They are among the most odious and user-unfriendly institutions in the United States. You want to minimize your interactions with them; you want to minimize discretion that you give to them about your situation.

You should never call a CRA, ever. They have phone centers staffed with people whose only job is getting you off the phone. They have very limited availability to help, for the same reason that the phone center does not have anyone who can help a shoe. You will deal with CRAs only in writing.

I suggest that you only send them paper letters. […] when you send paper letters, you can establish and own a “paper trail.”

Communicate with them only over postal mail. Keep a log of every mail you send (including what you said) and when it was sent; keep a copy of every letter they send you and when it was sent. You don’t need physical copies; digital is fine. I like organizing all of mine on a per-incident basis in Dropbox.

Retain copies of all correspondence with a bank or a CRA forever. Erroneously reported debts which you thought were taken care of can be resurrected years later by someone failing to check a box during a CSV export, resulting in the debt getting sold to a new debt collector, who will not know that you spent weeks resolving it. You want your paper trail so that your first and only letter to that debt collector credibly promises armageddon.

Presenting like a professional

Banks deal with lots of angry people, and are optimized to treat this like a customer service problem. Some do better and some do worse at this, but you never want identity theft treated like a customer service problem. Their CS department is scored on number of tickets resolved per hour, and each rep’s incentives are simply to classify you as something requiring no followup and get you off the phone.

Instead, you want to communicate with the bank in a manner which suggests that you’re an organized professional who is capable of escalating the matter if the bank does not handle it themselves. […] present as if you’re collecting a paper trail.

Mean words cannot hurt a bank. Threats cannot hurt a bank. Paper trails, though, are terrifying to regulated institutions. Your bank’s customer support representatives are taught to evaluate whether someone looks like they’re competent and collecting a paper trail. If they are, the CS rep is supposed to stop touching the case immediately and instead escalate them to a supervisor or to the legal department.

The legal department (or an analogous group–it is different at every bank) is not scored on cases resolved per week. They are scored on regulatory incidents per quarter, and their target for success is likely zero. Shockingly senior people will be involved to avert regulatory incidents.

What causes a regulatory incident? Bad behavior on the part of the bank? No. Banks screw up all the time; the screwups are literally forecast and budgeted for. Do regulators cause regulatory incidents? Generally no; they’re understaffed and underfunded, and they don’t go on fishing expeditions. The thing which causes regulatory incidents is well-organized people taking paper trails to regulators which allow a regulator to trivially follow up with an investigatory letter. Accordingly, anyone who sounds like a well-organized professional with a paper trail is a problem to be swiftly addressed.

That, dear reader, can be you.

Form letters and the inadvisability thereof

Regulation of CRAs is in some ways consumer-friendly and in some ways is designed to be of advantage to the CRAs. For example, the CRAs told the regulators that there were business and websites offering form letters which correctly cited the FCRA and FDCPA, and that this let people send in a vexatious number of “frivolous” form letters. (Translation: Walmart is annoyed at how many showed found out how to speak.) So the regulators offered the CRAs an olive branch: they’re allowed to close without actioning any case which involves a form letter.

Is that fair? No. CRAs are allowed to respond to you with a form letter, and in fact will, and in fact in many cases it will literally include checkboxes so that they can most efficiently tell you the rationale for not helping you.

how should you write a bespoke, artisanal letter such that people reading it read you as a Dangerous Professional?

Professional mien: You’re a professional, and not someone straining to pretend to be one.

a lot of folks suddenly adopt electutory tendencies which they believe approximate legal professionals […]. This is not the way actual professionals write, which is generally clear and to-the-point. Write clearly and concisely. You want to outline relevant facts and omit long, windy narrations.

Restrained emotions: You’re a professional. Someone in the economy has made a mistake; you require it to be fixed with alacrity, but you’re not angry at either the bank or anyone working at it. Why be angry? This is just business to you. It’s business that you will, with night-turns-into-day certainty, cause consequences if your legitimate requirements are not met, but you won’t bear anyone ill will over it.

Showing anger decreases the perception of risk of you filing a regulatory action or a lawsuit. This is counterintuitive to many people. The vast majority of people who show anger are showing anger because they want to show anger. They want someone to validate their emotions. […] You don’t particularly care about the individual you’re writing to or whether they’re emotionally supportive of you. You want a resolution, no more no less. Professionals know that if they want emotional support they could just buy a dog.

People who can file a regulatory action while being emotionless about it are terrifying, because they suggest that their day job is e.g. administrator for a hospital, that they’re very comfortable with pushing papers around government agencies, and that they will remember deadlines, keep copious records, and consult with other professionals where appropriate. People like this have an annoyingly predictable tendency to convince bureaucracies to give them what they want.

Micro-tip: I never phrase an initial letter with “I demand you…” because I’m a professional. Angry people demand; professionals “require.”

Be very clear about what you want. What you do not want is to give someone the excuse to read your letter and conclude that no further action is required or that a form letter trivially answers it. You want a specific set of actions, you want those actions to be confirmed to you in writing, and you want them done by a specific date.

The FCRA and FDCPA have a variety of timelines embedded in them. For example, incorrect information on your credit report has to be investigated and corrected within 30 days. There are varying penalties for the bank/CRA if they exceed a statutorily defined timeline. You can either learn all of the timelines and specific consequences, or you can just suggest that you’re aware that timelines exist. The clock(s) start typically counting when the bank or CRA has a specific, written complaint, so you want to both make sure your initial letter constitutes that and signal that you are aware they are now on the clock. People who are aware of legal deadlines and sound like they are going to count to 30 days and then immediately cause consequences on day 31 are much scarier than people who scream “I NEED AN ANSWER FROM YOU TODAY!”

Please correct this tradeline and confirm this to me in writing within the timeframe specified by law. If you cannot correct this tradeline, provide me with your written justification for why your investigation concluded that this tradeline was accurate.

There are some subtleties here, but you’re playing this game and look to be playing it well. Non-response is documentable non-response. Any response is either non-responsive to your request (which activates a regulatory machine) or commits in writing to the fact that an investigation has occurred. This is an important Rubicon to force the CRA to cross, because (if you are factually innocent of the debt) then any investigation which concludes that you owe it likely includes blindingly obvious errors which will be discovered on review.

Blindingly obvious errors lead to punitive damages and very incensed regulators, so even if the CRA has a low-ceremony way for “validating” a trade line […] they will not trust their usual process to do it. Instead, you’ll get escalated internally, then a lawyer will say “My time is valuable; you’re creating legal risk; just give the shoe what they want.”

Don’t say untrue things. Don’t say “I will file a suit” unless your true intent is to file a suit. Don’t say that you’ve involved a lawyer if you haven’t involved a lawyer. People bluster all the time and your counterparty is immune to bluster. People who have factually involved an attorney don’t need to announce that; their attorney will for them.

You can, however, be a professional who says things that have some strategic ambiguity. “I will avail myself of remedies available under the law” could imply that you’ll involve an attorney, that you’ll write your local attorney general or another bureaucrat, or that you’ll write letters. Can you write letters? Great; avail away.

Who do I write first?

If an account was opened without your knowledge and consent, you’re going to write the bank, but you’re going to make a quick stop at your local police department first.

Why? Well, the most common genre of identity theft is what is variously called “family fraud” or “friendly fraud” and what is informally called “a household cannot agree about financial decisions and asks the bank to be the adult for them.” If your spouse opens an account in your name, the bank will say “Did you file a police report? No? Alright, best of luck resolving that at the dinner table.” If an unrelated person opens an account, the bank will (explicitly or implicitly) assume that they might well be a romantic partner, business associate, friend, cousin, etc who opened the account with your active or tacit consent. Resolve the ambiguity immediately by filing a police report.

Police departments will give a written copy of a police report or receipt for a report for virtually anyone who comes in and asks for one. They will likely not investigate or “catch the bad guy”, but you don’t require that. You are just using the police to validate that you’re willing to make expensive statements. (This is an “expensive” statement because lying to the police is a crime [and] signals seriousness.)

You will have your first letter be to the bank and include a copy of your police report. It will be short and to the point: when you learned the account was opened, a clear statement that you did not open the account, and your requirement that they investigate and take appropriate action immediately.

Don’t write like a supplicant. Yep, they’re a big bank… but you’re a crime victim and they are, as of this minute, and instrumentality of the crime committed against you. You’re not angry, but you expect immediate resolution of this, and if they don’t immediately resolve it well then they aren’t an unwitting participant in the crime against you any more, are they.

You may get a letter back requesting additional information. In general, read the letters and reply accordingly, but my general theme in follow-up letters was [to reiterate the clear request and the legally mandated deadline, while also providing additional information as requested]

Why write like this? Because the bank will […] default to asking for additional information, sometimes multiple times, just to wear you down and make you stop responding, then they will close the case for non-response. You will say “No, what the law actually says is that you get 30 days to investigate from the day where I sent you a specific written complaint. Your legal obligations date from that letter, not when you decide they date from. Your letter to me saying you need additional information does not excuse your inability to comply with your legal obligations.”

You can choose to write the CRAs in parallel with the banks or after writing the banks. It will require the least number of letters from you if you do it after you have written confirmation from the bank that the account is not yours.

Non-response to your specific written demand within the timeframe is concession; you should then send them a letter taking notice of the non-response and requiring immediate and permanent deletion of the tradeline. (You will frequently not receive a letter within the timeframe.) Response which includes deletion means no new letters from you, but verify that the deletion happened and keep the correspondence forever.

What happens if you get a verification back? Well, you can either continue sending pointed letters about how they’re in violation already, or you can just proceed directly to involving your local attorney general and/or suing them.

Where exactly should I address these letters?

Remember, you’re dealing with very large corporations which have many divisions. They can pass messages between each other. You do not want to send to the Department of Fobbing People Off when you can send to the Legal department. Even if the actual pushing-of-buttons you require can only be done by the Department of Fobbing People Off, you want the request to push buttons to come from someone who cannot be fobbed off, like an annoyed attorney whose time is being wasted but who, because they are an attorney, does not ever want to have not responded to an issue which could credibly create a legal or regulatory risk.

If you cannot route letters to the legal department, go as high up as required. Pro-tip: virtually every major US company has a department called Investor Relations which is trivially discoverable, very well-funded, publicly routable, and very bored during 80% of the year. You can excuse any letter to Investor Relations with:

I am a shareholder in BigBank. I was therefore profoundly displeased when I learned…

What’s a well-paid bored professional in Investor Relations going to do with your account information? Nothing? Nothing is a great way to get fired.

“But I’m not a shareholder!” A surprising amount of Americans are shareholders in large financial institutions. Do you have an IRA? Does it invest in e.g. mutual funds? If you own a mutual fund or index fund, you are highly likely to beneficially own fractional shares of US financial institutions. Someone who owns 0.01 shares is a shareholder; welcome to the magic of capitalism.

(Note that there is no register of shareholders kept by Investor Relations–they don’t know who owns their company, except for the few largest holders. You could own $20 million of their company and they’d be totally ignorant of that fact–the records are kept elsewhere. […])

No help from investor relations? Try the highest part of the company you can find an address for; this can be named e.g. the Office of the President / CEO or similar. A secretary will read your letter, come to the conclusion that it is not worth the boss' time, and does something that she does a few dozen times a day: “$BOSS got this letter from a customer. Thanks in advance.” The Department of Fobbing People Off fobs off people but it doesn’t fob off the CEO.

I got a call from a debt collector

“What is your address?” Get it then hang up. Never speak to debt collectors.

Write the debt collector.

Say that you will accept further communication about this matter ONLY in writing and all other forms of contact are inconvenient.

If you were told enough to know that the debt isn’t yours, write so. Otherwise, write that you have no knowledge of the debt. Ask them to verify it with the original creditor. Remind them that they can take not action until they do so.

You will likely get follow-up calls, because this industry is rife with illegal behavior. “I’ve given you written notice that calls are inconvenient. This is a per-se FDCPA violation. I am writing down the day and time of this call. Goodbye.”

After you’ve had the bank verify that the account is closed, the letter to every debt collector is fairly similar. The term of art in the industry is FOAD, and it does not stand for Fly Off and Die.

Do I need a lawyer?

You can involve a lawyer, but the sums of money involved are generally not cost-effective for most people. My per-incident resolution time was generally 2-3 letters (total cost: < $20 – I was sending “certified mail, return receipt requested”, which is Dangerous Professional for “Do you like paper trails? I like paper trails. I particularly like paper trails where the United States Federal Government attests to the exact minute your firm learned the contents of this letter."); my max in my personal situation was six. Total resolution time is generally on the order of 3 to 10 weeks.

Taking low-complexity matters to a lawyer generally results in a bill of a few hundred dollars. They will likely not sue on your behalf; they might (depending on temperament and your paper trail) either send a letter that you could have sent (but which is signed Dangerous Professional, Attorney At Law) or perhaps file suit to get the attention of the legal department at the CRA or bank. Defending a lawsuit is symmetrically costly (finally!) and, because you have a paper trail, all parties know what the likely outcome will be in advance, so ask your lawyer on what their estimate is regarding probability of settlement.