How to Prevent Identity Theft After Death: Credit Freeze, Bureau Alerts, and Obituary Safety

Why the Dead Are Easy Targets

Identity thieves target deceased individuals because the crime can go undetected for months or years. There's no one checking their credit report, no one opening their mail, no one noticing new accounts opened in their name. The Social Security Administration's Death Master File — which credit bureaus and financial institutions use to flag deceased accounts — can take weeks or months to update.

During that window, criminals use a deceased person's Social Security number, date of birth, and address to open new credit cards, file fraudulent tax returns, apply for loans, and even claim government benefits. Published obituaries are the starting point: they often contain the deceased's full name, date of birth, hometown, and family members' names — exactly what an identity thief needs to answer security questions.

Step 1: Freeze Credit With All Three Bureaus

This is the single most important protective action, and it needs to happen within the first week after death.

You must contact each of the three major credit bureaus individually — there is no centralized portal. Send a written notification by certified mail with the following documents:

• Certified copy of the death certificate
• The deceased's full legal name, Social Security number, date of birth, and last known address
• Proof of your authority (Letters Testamentary or court appointment as executor)
• A copy of your own government-issued photo ID

Mailing addresses:

• Equifax: P.O. Box 105139, Atlanta, GA 30348
• Experian: P.O. Box 9701, Allen, TX 75013
• TransUnion: P.O. Box 2000, Chester, PA 19016

Within a few business days, each bureau will place a "Deceased Alert" on the credit file and initiate a permanent security freeze. This blocks any new credit applications using the deceased's information.

In Canada: Contact Equifax Canada and TransUnion Canada (the two major bureaus). Both accept death notifications by mail with a death certificate copy.

In the UK: Notify Experian, Equifax, and TransUnion UK. The Bereavement Register (thebereavementregister.org.uk) also stops direct marketing mail, reducing exposure.

Step 2: Request a Credit Report

Before freezing the accounts, pull the deceased's credit report from each bureau. This establishes a baseline and reveals any fraudulent activity that has already occurred. As the executor, you're legally entitled to request these reports.

If you find accounts or inquiries you don't recognize, file a dispute with the bureau and report the fraud to the FTC at identitytheft.gov (or Action Fraud in the UK).

Step 3: Write a Safe Obituary

Published obituaries are the number-one data source for deceased identity thieves. Every personal detail you include is a potential attack vector.

Include:

• The deceased's name (first and last is sufficient)
• General age or age range
• City or region (not the exact address)
• Information about services and memorials
• How to send condolences or contributions

Omit:

• Full date of birth (especially never include the full date and the full name together)
• Mother's maiden name
• Home address — this also tells burglars exactly which house will be empty during the funeral
• School names, employer names, or other security-question answers
• Names of the deceased's children, spouse, or other family members with enough detail to answer security questions

If you use a paid newspaper obituary, remember that these are indexed by search engines and remain online indefinitely. Digital obituaries on funeral home websites are similarly permanent.

Step 4: Notify the IRS

File IRS Form 56 (Notice Concerning Fiduciary Relationship) if you are acting as the estate's fiduciary. It notifies the IRS of your fiduciary relationship; it is not the form for reporting identity theft. If a fraudulent return was filed, follow the IRS identity-theft reporting steps below.

When you file the deceased's final tax return (Form 1040), write "DECEASED" at the top of the return followed by the individual's name and date of death. If a fraudulent return was filed before you could file the legitimate return, report the identity theft to the IRS using its current instructions.

Step 5: Lock Down Accounts and Mail

• Redirect mail to the executor's address. For USPS, the executor or administrator must submit a deceased person's change-of-address request in person at a Post Office and show proof of authority; check Royal Mail or Canada Post for their procedures. Thieves monitor the deceased's mailbox for financial statements, credit card offers, and government correspondence.
• Notify each financial institution and ask how to secure or flag the account. Do not close an estate-critical or beneficiary account until you understand its ownership and the estate steps; monitor accounts that remain open.
• Close or secure email and online accounts. Email access is the master key to resetting passwords and intercepting security codes.
• Remove the deceased from marketing and data broker lists. The Direct Marketing Association's Deceased Do Not Contact list (in the US) reduces targeted offers.

Step 6: Monitor for 12+ Months

Identity theft against a deceased person can surface months after death. Continue monitoring:

• Request the deceased's credit report every few months during the first year
• Watch for unexpected mail — collection notices, account statements, or credit card offers arriving at the deceased's address
• Review the estate's bank account for unauthorized transactions
• Check the IRS's "Get Transcript" service for any tax returns filed in the deceased's name that you didn't submit

What to Do If Fraud Has Already Happened

If you discover identity theft:

1. File a report at identitytheft.gov (FTC) or call 1-877-438-4338
2. File a police report with local law enforcement
3. Notify each affected creditor with a copy of the death certificate and the FTC/police reports
4. Contact the credit bureaus to dispute fraudulent accounts
5. If a fraudulent tax return was filed, submit IRS Form 14039 (Identity Theft Affidavit)

The executor is not personally liable for fraudulent debts opened after the deceased's death. These accounts are the creditor's loss, not the estate's — but they create administrative headaches during settlement if not reported promptly.

Protecting the Estate Starts in the First 48 Hours

The window between death and the credit bureau freeze is the highest-risk period. Our First 48 Hours toolkit includes the complete identity protection protocol — credit bureau notification letters, the obituary security checklist, and the account cancellation tracker — organized chronologically so you know what to do first when you can barely think straight.