Identity theft after a death

Why the institutions do not simply find out

Everyone assumes there is a central switch. Social Security is told, and the news travels. It does not, and the reason is a statute rather than an oversight.

Social Security's record of reported deaths — the Death Master File — is withheld by law from anyone who has not been certified, for the first three calendar years after a death. Certification is open to an organization with a legitimate fraud-prevention interest or a business purpose under a law or fiduciary duty. A bank can be certified. A family cannot, and does not need to be. The effect is that an institution which has not gone through that process simply does not learn that its customer has died — for exactly the period in which the fraud happens.

This is why every after-a-death checklist tells you to notify each institution separately, and why none of them explains it. The obligation is not administrative tidiness. It is the consequence of a restriction Congress put in place to prevent fraud, which has the side effect of leaving the family as the only channel.

A deceased alert is not a freeze, and not a fraud alert

Three different markers can sit on a credit file and people use the words interchangeably. They are not the same thing and only one of them is meant for a person who has died.

• A security freeze locks the file so a new account cannot be opened against it. It is designed to be lifted and re-applied by the person it belongs to — which is the problem after a death, because that person is not there to lift it and the executor may need the file read for the estate's own purposes.
• A fraud alert tells a lender to take extra steps to verify identity before extending credit. It is temporary, and it assumes someone will answer the verification call.
• A deceased alert is a notation on the file recording that the person has died. It is the one the IRS tells families to ask for, and it is the one that gives a lender a reason to stop rather than a hurdle to clear.

The Internal Revenue Service — not the Federal Trade Commission — is the federal agency that states the step. Its identity theft guide for individuals tells a family to send the credit bureaus a copy of the death certificate and have them put a deceased alert on the credit reports, and then to keep watching the reports for unusual activity.

California's Department of Justice publishes the operative detail that the federal material leaves out: the request goes in writing to all three national bureaus, from the surviving spouse or the executor, and it must carry a copy of the death certificate and proof of executorship or marriage. That is a state agency describing a national procedure, not California law — nothing in it is confined to Californians — but it is a government source that says it, which is why Sahvelo quotes it rather than a credit bureau's own help page.

The alert is a notation, not a lock. It gives a lender a reason to refuse; it does not make an application impossible. Asking for it does not replace watching the reports afterwards, and the watching is the part families stop doing.

The obituary is a disclosure, and it is permanent

The IRS gives one piece of prevention advice for a death, and it only works before the funeral: avoid putting too much information in an obituary that identity thieves could use. It is worth saying plainly what that means, because the advice as written is too vague to act on while grieving.

New York's definition of the information its identity theft offenses turn on is a useful checklist read backwards. It opens with a person's name, address, telephone number, date of birth, place of employment and mother's maiden name. The first six items of a statutory definition of stealable identity are, almost exactly, the contents of a conventional obituary and the family history in a eulogy.

• Full date of birth. A year is enough for a death notice; the day and month are what an application form asks for.
• The home address. It tells a thief where the post arrives and where the house is empty during the service.
• Mother's maiden name, and the maiden names of grandmothers. These are still security questions at institutions that have not updated in twenty years.
• The names of every surviving child and their cities. This is what makes a call to a bereaved relative sound informed.
• Employer and job title, where the pension or benefit is administered by that employer.

None of this means publishing nothing. An obituary is for the living and a family should write the one it wants. It means knowing that it is a public, permanent, indexed disclosure, and that leaving out the date of birth costs the reader nothing.

The kind nobody checks for: medical identity theft

Financial identity theft has obvious instruments — a freeze, a report, a dispute. The medical kind has none of them, and the natural assumption is that a dead person's records are simply closed to everybody, so there is nothing to check and no way to check it. The opposite is true, and the tools are better than the ones on the financial side.

A dead person's medical records stay protected for fifty years after the death — the provider does not stop owing duties about them — and whoever has authority under state law to act for the person or their estate is treated as their personal representative for those records. The letters or small-estate document that work at the bank work here too. The authority is limited by relevance rather than by relationship: it reaches information relevant to the representation, which is the phrase a provider will quote if the request is broader than the reason for it.^{Source: 45 C.F.R. § 164.502 (Uses and disclosures of protected health information: general rules) (opens in a new tab)•}

How to find out, in one letter

The instrument is an accounting of disclosures, and it is close to unknown outside the profession. It is a written list of everyone the provider sent the records to in the six years before the request — each entry carrying the date, the name and, if known, the address of who received them, a description of what was disclosed, and a statement of why. That is what makes an unfamiliar recipient visible. The provider has sixty days, may take one extension of no more than thirty days and only with a written statement of the reasons and the date it will deliver, and the first accounting in any twelve-month period is free.^{Source: 45 C.F.R. § 164.528 (Accounting of disclosures of protected health information) (opens in a new tab)•}

Read the exceptions before expecting a complete picture. Disclosures to carry out treatment, payment and health care operations are excluded, and so are disclosures made under an authorization, disclosures to the person themselves, incidental disclosures, facility-directory and care-notification disclosures, national security and law enforcement disclosures, and anything in a limited data set. An accounting is not a list of everywhere the records went. It is a list of the places that had to be recorded, which is a different and still useful thing.^{Source: 45 C.F.R. § 164.528 (Accounting of disclosures of protected health information) (opens in a new tab)•}

How to get it fixed, and what to do if they refuse

Finding somebody else's treatment inside a relative's file is the characteristic damage here, and it does not fix itself. There is a right to have the record amended for as long as it is kept. A provider may refuse on four grounds — that it did not create the information, that it is not part of the designated record set, that it would not be available for inspection, or that it is accurate and complete — and it has sixty days to act either way.^{Source: 45 C.F.R. § 164.526 (Amendment of protected health information) (opens in a new tab)•}

A refusal is not the end, and the denial letter has to tell you so. It must be written, in plain language, and must state the basis, your right to file a written statement disagreeing with it and how to do that, that you may instead ask for the request and the denial to accompany any future disclosure of the information, and how to complain to the provider or to the Secretary. File the statement of disagreement. It becomes part of the record and travels wherever the record travels. Where an amendment is granted instead, the provider must make reasonable efforts to push it to anyone it knows holds the information and might foreseeably rely on it to the person's detriment — so a correction chases the bad record rather than sitting in one file.^{Source: 45 C.F.R. § 164.526 (Amendment of protected health information) (opens in a new tab)•}

One limit worth stating plainly. Misuse of a Medicare number specifically is not covered here — Sahvelo has not found a rule it can quote that gives a family a route of its own for that, as distinct from the general fraud-reporting channels. Nothing on this page is a substitute for reporting suspected fraud. What these provisions give you is the evidence a report needs, which is usually the part that is missing.

How to make an institution act, rather than ask it to

Most of what a family does after a death is a request. Two things in this area are not requests, and knowing which is which changes the phone call. A police report is a duty in Arizona and California, not a favor. And in California a report — or the FTC identity theft report, which anyone can file online — turns into a right to the fraudulent paperwork itself.

1. Ask the local police for an identity theft report and for a copy of it. In Arizona and California they must take one; elsewhere they usually will.
2. If a police report is refused or is slow, file an FTC identity theft report instead. In California it does the same work as the police report for the next step.
3. Send the report to the bank, card issuer, utility or mobile provider that opened the account, and ask in writing for the application and the transaction records. In California those must come free within ten business days.
4. Keep every reply. The application itself is the document that proves a person who had already died did not sign anything.

An honest limit. California's identity theft offenses expressly reach a victim who has died, but the sections that create these remedies are written for the person whose information was used and do not say who may exercise them on behalf of someone who has died. Sahvelo does not resolve that from silence. In practice an executor with letters and a death certificate should ask as the estate's representative, and should expect the question to be asked back.