How to Prevent Identity Theft of a Deceased Person

Preventing identity theft of a deceased person means moving quickly in the first days and weeks after death to notify the agencies and companies that hold their information, before the gap between the death and the update of federal databases gives a thief room to work. Criminals use a deceased person’s Social Security number to open credit accounts, file fraudulent tax returns, and claim benefits, and they often start within days of an obituary appearing. The steps below are in rough priority order, and almost every one of them will ask for a certified copy of the death certificate.

Start With Certified Death Certificates

The death certificate is the document every bank, credit bureau, government agency, and insurance company will ask for. Certified copies come from the vital records office in the state where the death occurred, and most funeral homes will order them on your behalf.¹

Order at least 10 to 15. Institutions almost always want an original certified copy rather than a photocopy, and you will be sending them out to several places at once. Running out and waiting weeks for replacements creates exactly the kind of delay identity thieves rely on. Ordering extra copies up front is significantly cheaper than reordering later.

Notify the Social Security Administration

Getting the Social Security number flagged in federal databases is the single most time-sensitive step. Funeral directors often report the death through the Electronic Death Registration System, but confirm this was actually done rather than assume it. If you need to report the death yourself, call the SSA at 1-800-772-1213 or visit a local Social Security office in person. The SSA does not accept death reports online or by mail.²

Once the SSA processes the notification, the death is added to records that credit bureaus and other agencies use to screen applications. That is the biggest systemic barrier against anyone using the deceased’s Social Security number to apply for new credit or benefits. The SSA also stops benefit payments as of the month of death, so any payment received for that month or later must be returned.² If benefits arrived by direct deposit, contact the bank right away and ask them to return the payment.

Place a Deceased Alert and Freeze Credit

Contacting the credit bureaus adds a second layer of protection. A “deceased alert” on the credit file signals to any creditor pulling the report that new applications should be rejected. A credit freeze goes further by blocking anyone from viewing the report at all.³ Ask for both.

Experian says notifying one bureau is enough because they will notify the other two.³ In practice, mailing all three yourself gets faster coverage and removes the risk of a notification getting lost. The mailing addresses:

Each bureau needs a copy of the death certificate along with the deceased’s full legal name, Social Security number, date of birth, and date of death. Only a surviving spouse or someone with legal authority over the estate can make the request. If you are not the spouse, include a copy of your court-appointed Letters Testamentary or Letters of Administration and a copy of your own government-issued ID.⁴

Pull the Deceased’s Credit Report

While you are dealing with the bureaus, request a copy of the deceased’s credit report from all three. This is how you find out whether fraud has already started. An executor or personal representative can get the report by mailing a written request with the death certificate and proof of legal authority to act on behalf of the estate.⁶ Not every creditor reports to every bureau, so pull all three. Any account or inquiry you don’t recognize needs to be investigated immediately.

Protect the Tax Account With the IRS

Fraudulent tax returns filed under a deceased person’s Social Security number are one of the most common forms of identity theft after death, and they can hold up estate settlement for months. Two IRS forms address this threat, and filing both is worth the effort.

Form 14039 (Identity Theft Affidavit)

Form 14039 alerts the IRS that the taxpayer has died and that the identity should be protected from fraudulent filings. It has a specific section for someone filing on behalf of a deceased person. A surviving spouse can submit it without attaching a death certificate. A court-appointed personal representative must attach a copy of the court certificate showing their appointment. If no personal representative has been appointed, the next of kin can file by attaching a copy of the death certificate and indicating their relationship.⁷

Form 56 (Fiduciary Notice)

Form 56 formally notifies the IRS that you are the fiduciary for the deceased’s tax matters. Once filed, the IRS treats you as the taxpayer for purposes of filing returns and receiving correspondence about the estate. If you are handling both the deceased’s final personal return and the estate’s return, file two separate copies of Form 56, one under the deceased’s name and one under the estate’s name.⁸ Attach your Letters Testamentary or court certificate as proof of authority.

File the Final Return Promptly

The deceased’s final Form 1040 covers income from January 1 through the date of death and is due on the normal April filing deadline for that tax year.⁹ Filing it promptly closes a window that identity thieves use to submit a fraudulent return in the deceased’s name and claim a refund.¹⁰

Close or Retitle Financial Accounts

Work through the deceased’s financial accounts systematically. For individual bank and investment accounts, contact each institution to begin closure. Joint accounts can usually be retitled into the surviving owner’s name alone. Every institution will want a certified death certificate, and most will also require Letters Testamentary or Letters of Administration from probate court to prove your authority.

Notify credit card companies quickly. An open credit card account is a straightforward target for fraud, and any charges that post after death complicate estate settlement. If you were an authorized user on the deceased’s card, you are generally not liable for the existing balance. If a debt collector insists you co-signed the account, you can ask them to provide proof such as a signed contract.¹¹

Life insurance companies, mortgage lenders, and any other financial service providers also need a death certificate and your proof of authority. Start life insurance claims early, since payout timelines vary. Contact the deceased’s employer about workplace benefits like a 401(k) or group life policy, which are easy to overlook.

Cancel Identity Documents

A valid passport or driver’s license sitting in a drawer is a gift to an identity thief. Canceling these documents removes them from active databases.

U.S. Passport

To cancel a deceased person’s passport, mail the valid passport, a certified copy of the death certificate, and a letter requesting cancellation and either the return or destruction of the passport to:¹²

U.S. Department of State
Consular Lost and Stolen Passport Unit (CLASP)
44132 Mercure Circle
P.O. Box 1227
Sterling, VA 20166-1227

Driver’s License

Contact the DMV or equivalent agency in the state that issued the license. Requirements vary, but most states accept a certified death certificate and the physical license, submitted in person or by mail. Canceling the license also removes the deceased from the DMV’s mailing list, which cuts down on pre-approved credit offers arriving at the deceased’s address.

Secure Email and Online Accounts

An active email account is especially dangerous because it can be used to reset passwords on financial accounts. If you have the deceased’s login credentials, change the email password immediately and enable two-factor authentication. If you don’t, most major platforms have a process for executors to request closure or content from a deceased user’s account, though they will not hand over passwords. Google, for instance, will review requests from immediate family members or representatives and may close the account or provide limited content, but once the account is closed, no further content requests can be processed.

Social media platforms including Facebook, Instagram, and LinkedIn have their own procedures for memorializing or deleting a deceased user’s profile. These generally require a death certificate and proof of legal authority. Memorializing locks the account so no one can log in; deletion removes it. From an identity-theft standpoint, deletion is the safer choice because it eliminates a source of personal information that scammers can mine.

Forward the Mail and Stop the Marketing

Mail is where many identity-theft schemes start. Pre-approved credit offers, bank statements, and tax documents arriving at an unoccupied residence or an unlocked mailbox are easy pickings. Forwarding the deceased’s mail to the executor’s address catches these items and helps you identify accounts or subscriptions you didn’t know about.

You cannot forward a deceased person’s mail online. The change of address must be submitted in person at a U.S. Post Office location, and you must bring documented proof that you are the court-appointed executor or administrator. A death certificate alone is not enough.¹³

To cut down on marketing mail, register the deceased on the Data & Marketing Association’s Deceased Do Not Contact List through DMAchoice.org. Advertising mail should decrease within about three months.¹³

Keep the Obituary Sparse

The IRS specifically warns against putting too much personal information in obituaries, since identity thieves actively monitor them.¹⁰ A full date of birth, mother’s maiden name, or home address in a published obituary gives a criminal most of what they need. Keep the obituary focused on the person’s life and leave out identifying details that could be used to answer security questions or fill out credit applications.

If You Discover Fraud

If you find unfamiliar accounts or inquiries on the deceased’s credit report, act fast. Report the identity theft at IdentityTheft.gov, the FTC’s reporting portal, which generates a recovery plan tailored to your situation.¹⁰ If you haven’t already filed IRS Form 14039, file it now to flag the tax account. Contact each creditor where a fraudulent account was opened, provide the death certificate, and request the account be closed as fraud. Keep records of every communication, including dates, names of representatives, and reference numbers. Resolving identity theft of a deceased person is slower than resolving it for a living victim, because you can’t simply call up and verify your identity over the phone. Documentation and persistence are what get it done.

1
USAGov. How to Get a Certified Copy of a Death Certificate
2
USAGov. Report the Death of a Social Security or Medicare Beneficiary
3
Experian. How to Report a Relatives Death to Credit Bureaus
4
Equifax. After a Relatives Death Do I Need to Contact Each Nationwide Credit Bureau
5
TransUnion. Reporting a Death of a Loved One to TransUnion
6
Experian. How to Obtain a Deceased Persons Credit Report
7
IRS. Identity Theft Affidavit Form 14039
8
IRS. Instructions for Form 56 Notice Concerning Fiduciary Relationship
9
IRS. File the Final Income Tax Returns of a Deceased Person
10
IRS. Identity Theft Guide for Individuals
11
Consumer Financial Protection Bureau. Authorized User on Deceased Relatives Credit Card Account Liability
12
Travel.State.Gov. Report Your Passport Lost or Stolen
13
USPS. How to Stop or Forward Mail for the Deceased