How identity theft at the bank actually happens

Someone can open a checking account in your name by using your Social Security number, date of birth, and address — information that may already be public or stolen from a data breach. Banks verify identity through a combination of these details and a credit check, but they do not always require you to be present or to sign anything in person. If a thief has your basic information, they can often complete an application online or by phone and have a debit card mailed to an address they control.

The account opener does not need your permission or knowledge. They need enough of your personal details to pass the bank's identity verification system. Once the account is open, they can deposit bad checks, receive fraudulent transfers, or simply drain money if they somehow link it to an existing account of yours. You typically discover this weeks or months later when you check your credit report or receive mail about an account you never opened.

This is different from someone using your existing account without permission — that is account takeover. This is a new account created in your name from scratch, which is a form of identity theft that can damage your credit and create legal complications.

Key Takeaways

  • A thief needs your Social Security number, date of birth, and address to open an account in your name; they do not need your signature or permission.
  • Banks use credit checks and automated verification systems to confirm identity, but these systems can be fooled with stolen personal information.
  • You can place a fraud alert or credit freeze with the three credit bureaus to block new accounts opened in your name.
  • If you discover an account opened fraudulently, contact the bank immediately, file a report with the Federal Trade Commission, and place a fraud alert on your credit file.
  • Monitoring your credit report regularly and setting up account alerts at your own bank are the fastest ways to catch unauthorized accounts early.

What information a thief needs to open an account

The minimum information required varies by bank, but most will open an account with your name, Social Security number, date of birth, and a current address. Some banks also ask for a phone number and email address, which the thief can provide as their own. A few banks require a government-issued ID, but many do not — they rely instead on matching your Social Security number against credit bureau records and running a ChexSystems check, which is a banking history database.

The thief does not need to match your ID photo or sign anything in your handwriting. Online applications do not require a signature at all. Phone applications can be completed with a voice that is not yours. The bank is verifying that the person on the other end knows your Social Security number and can answer security questions based on your credit history — information that may have been exposed in a breach or purchased on the dark web.

Your address is particularly vulnerable because mail can be intercepted or redirected. If a thief has your Social Security number and knows your address, they can often request a new address change during the application process, ensuring the debit card and statements go to a location they control instead of yours.

How banks verify identity during account opening

Most banks use a system called knowledge-based authentication, which asks questions only you should be able to answer — things like "Which of these addresses have you lived at?" or "What was the loan amount on your car?" These questions are pulled from your credit file and public records. A thief who has access to your credit report or has purchased your information from a data broker can often answer these questions correctly.

Banks also run a ChexSystems check, which is a record of your banking history. This system flags accounts opened and closed quickly or with fraud history, but it does not prevent a new account from opening — it just adds a note to your file. Some banks use Experian, Equifax, or TransUnion to verify your identity by checking your credit report, but again, this confirms that someone knows your information, not that you authorized the account.

A few banks require an in-person visit or a video call where you show a government ID, but many of the largest banks do not. Online-only banks almost never require in-person verification. If a thief targets a bank with weaker verification, they can open an account in minutes.

Signs that an account has been opened in your name

You may not notice for weeks or months. The first sign is often a piece of mail — a debit card, a welcome letter, or a statement — arriving at your address or at an address you do not recognize. If mail is being redirected, you might not see anything at all until you check your credit report.

Pull your credit report from AnnualCreditReport.com, which is the official site run by the three major credit bureaus. Look for accounts you do not recognize, especially checking or savings accounts (which may show up as "deposit accounts" or "bank accounts"). You may also see a hard inquiry from a bank you never contacted — this is the credit check the thief triggered during the application.

If you have set up account alerts at your own bank, you may receive a notification that someone tried to log in or change your password. This can mean a thief is trying to take over your existing account, which is a separate threat but often happens alongside new account fraud.

Steps to take if you discover unauthorized account opening

Contact the bank that opened the fraudulent account immediately. Tell them you did not open the account and ask them to close it. Get the name of the person you spoke to and the date and time of the call. Ask the bank to send you written confirmation of the closure and to flag your file so no further accounts can be opened without additional verification.

File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record of the fraud and generates an Identity Theft Report, which you can use to dispute the account with credit bureaus and to prove to creditors that you are a victim. The FTC report is free and takes about 10 minutes to complete online.

Contact all three credit bureaus — Equifax, Experian, and TransUnion — and place a fraud alert on your file. A fraud alert tells creditors to take extra steps to verify your identity before opening new accounts. You can place a fraud alert by calling one bureau; they are required to notify the other two. The alert lasts one year and is free. If you want longer protection, you can place a credit freeze, which blocks all access to your credit file unless you temporarily unfreeze it. A freeze lasts until you remove it and is also free.

Dispute the fraudulent account with the credit bureaus in writing. Send a letter to each bureau explaining that the account is not yours, include a copy of your FTC Identity Theft Report, and ask them to remove it from your credit file. Keep copies of everything you send.

How to prevent accounts from being opened in your name

A credit freeze is the strongest prevention tool. When your credit file is frozen, no creditor or bank can access it without your permission. This makes it nearly impossible for a thief to open a new account in your name, because banks cannot verify your identity without seeing your credit report. You place a freeze by contacting each of the three credit bureaus online or by phone. It is free and takes about 15 minutes total. When you need to open a legitimate account yourself, you temporarily unfreeze your file, which takes a few minutes.

A fraud alert is weaker but easier to manage. It tells banks to call you at a phone number you provide before opening any new account in your name. This does not block the account — it just adds a verification step. Fraud alerts last one year and are free.

Monitor your credit report regularly. You can check it free once per year at AnnualCreditReport.com. Some people check it every four months by rotating through the three bureaus, so they see changes throughout the year. Many credit card companies and banks also offer free credit monitoring to their customers.

Set up account alerts at your own bank. Most banks let you receive a text or email notification when someone tries to log in, change your password, or make a large transfer. This will not stop a thief from opening a new account elsewhere, but it will alert you quickly if they try to take over an existing account.

What happens to your credit if an account is opened fraudulently

A fraudulent account can lower your credit score, especially if the thief misses payments or maxes out a credit line. Even if the account is closed and removed from your credit report, the damage may take months to repair. Hard inquiries from the fraudulent application also stay on your report for about a year.

Once you have filed an FTC Identity Theft Report and disputed the account with the credit bureaus, the bureaus are required to investigate and remove the account if they cannot verify it is legitimate. This process usually takes 30 to 45 days. Until then, the account may still appear on your report and affect your score.

If you are denied credit or offered worse terms because of the fraudulent account, you can use your FTC Identity Theft Report to explain the situation to the creditor. Some creditors will reconsider your application once they see proof of identity theft.

Frequently Asked Questions

Can someone open a checking account in my name if they only have my Social Security number?

Yes. Your Social Security number combined with your date of birth and address — information that may be public or from a data breach — is often enough for a bank to open an account. Some banks do not require anything else. This is why a credit freeze is so effective: it blocks access to your credit file, which most banks need to verify your identity.

Will the bank contact me before opening an account in my name?

Not always. Some banks send a welcome letter or debit card in the mail, which is how you find out. Others do not contact you at all until a statement is due. If a thief has changed your address on file, you may not receive any mail. Checking your credit report regularly is the most reliable way to catch this early.

Am I responsible for money stolen from a fraudulent account?

No. Once you report the account as fraudulent to the bank and file an FTC Identity Theft Report, you are not liable for charges or transfers made by the thief. The bank absorbs the loss. However, you must report it promptly — waiting months to report can complicate your case.

How long does it take to close a fraudulent account?

The bank should close it immediately once you report it, but it may take a few days for the closure to process. Ask the bank for written confirmation. Removing it from your credit report takes longer — usually 30 to 45 days after you dispute it with the credit bureaus.

If I place a credit freeze, can I still open accounts at my own bank?

Yes, but you will need to temporarily unfreeze your credit file first. You can do this online or by phone in a few minutes. Once the account is open, you can freeze your file again. It is a small inconvenience that prevents most identity theft.