Identity Theft After Death: What Families Need to Know

Why Deceased People Are Prime Targets

A living person who gets a suspicious credit alert can call the bank and dispute it the same day. A deceased person can't do any of that. Their accounts may sit unmonitored, and their credit files may remain active until agencies process the death record or an authorized representative places a deceased alert. That window — between the moment of death and the completion of notifications — is when criminals can strike.

The FTC documented over 1.35 million identity theft complaints in 2025, with total fraud losses exceeding $15.8 billion. Deceased individuals represent a particularly lucrative target because the fraud can go undetected for months or years. Nobody is checking the mail, reviewing statements, or getting phone alerts.

Criminals find their targets through obituaries, probate court filings, and people-search websites. A published obituary that includes a full name, birth date, and city of residence can help a fraudster build a profile and seek a matching Social Security number through dark-web sources.

How Posthumous Identity Theft Works

Two main attack patterns dominate:

Traditional identity takeover can happen before a deceased alert is placed. Someone may use the deceased's existing credit profile to open credit cards, apply for loans, redirect mail to a new address, or file a fraudulent tax return to intercept the refund.

Synthetic identity fraud is slower and harder to detect. The criminal pairs the deceased's real Social Security number with a fake name, fake date of birth, and a new address. This hybrid identity gets nurtured over months — building a clean credit history, getting approved for small lines of credit, then gradually increasing limits until a final "bust-out" where every line is maxed and the person vanishes. Because no living victim exists to receive alerts, synthetic fraud can run for years.

Both types create real problems for the estate. Fraudulent debts can surface during probate as creditor claims that the executor may need to dispute with supporting documentation. That process can consume estate funds, delay asset distribution to beneficiaries, and add legal costs to an already expensive process.

Warning Signs to Watch For

If you're settling an estate, watch for these indicators of posthumous fraud:

• Mail addressed to the deceased from unfamiliar banks or lenders — especially account statements, credit card offers with "pre-approved" language, or collection notices
• Credit report entries you don't recognize — new accounts, hard inquiries, or address changes that appeared after the date of death
• IRS notices about tax returns you didn't file — particularly notices about duplicate filings or refund claims
• Medical bills for services the deceased didn't receive — medical identity theft uses the deceased's insurance information
• Calls from debt collectors about unfamiliar debts — the collector may not know the person is deceased

If you spot any of these, file a report at IdentityTheft.gov immediately. The FTC report number becomes your evidence for disputing fraudulent accounts with creditors and credit bureaus.

The First Steps That Matter Most

The order and timing of your actions directly affect how much damage can happen. These aren't optional tasks you can get to eventually — each day of delay is another day the deceased's identity is exposed.

Within the first week:

• Verify that the funeral director reported the death to the Social Security Administration — call 1-800-772-1213 to confirm
• Secure all physical mail at the deceased's address — either redirect it through USPS or arrange for someone trusted to collect it daily
• Lock the deceased's phone, computer, and any devices that store passwords or financial information

Within the first month:

• Mail deceased alert requests with certified death certificates to all three credit bureaus (Equifax, Experian, TransUnion)
• File IRS Form 56 to establish your fiduciary relationship and redirect the deceased's tax correspondence
• Register with the Deceased Do Not Contact list to stop marketing mail

Within three months:

• Request and review the deceased's credit reports for unauthorized activity
• Submit data broker opt-out requests to remove the deceased's information from public search databases
• Close or memorialize all digital accounts (email, social media, online banking)

The Identity Theft Prevention After Death toolkit organizes all of these steps into a chronological action plan with pre-drafted letters, communication scripts, and tracking templates — built specifically for families who are handling this process alongside everything else that comes with settling an estate.