The Gap Nobody Tells You About
In the weeks after a death, an unusual thing is true: a real Social Security number, attached to a real credit history, is briefly unmonitored. The person it belongs to is not checking statements. The family is planning a funeral. The institutions that would normally notice something odd have not yet been told anything is different.
Fraud that exploits that gap is sometimes called "ghosting," and it is not exotic. The California Attorney General's consumer guidance on identity theft and the deceased describes the mechanism in one sentence: "Sometimes delays in reporting can provide time for identity thieves to collect enough personal information to open credit accounts or take other fraudulent actions using the deceased's information" (Identity Theft and the Deceased, Consumer Information Sheet 3C).
There is also a structural reason the window exists. Federal law restricts who may receive death information from the Social Security Administration's Death Master File for a period after death. Under 42 U.S.C. § 1306c, the Secretary of Commerce "shall not disclose to any person information contained on the Death Master File with respect to any deceased individual at any time during the 3-calendar-year period beginning on the date of the individual's death," unless that person is certified under a program requiring "a legitimate fraud prevention interest, or a legitimate business purpose" plus audited safeguards. That restriction exists for good privacy reasons. One side effect is that a smaller lender or creditor without certified access may not learn about a death from the federal file for some time, which puts more weight on the notices you send yourself.
This guide is about closing that window deliberately. None of it is difficult. Most of it takes an afternoon and a stack of death certificates. The hard part is that it happens during the worst week of the year for the person responsible for doing it, which is exactly why it ends up undone.
What Actually Closes the Window
Four things, in roughly this order:
- Report the death to Social Security, so the federal record is accurate and benefit payments stop.
- Get certified copies of the death certificate, because almost every notification below requires one.
- Notify all three credit bureaus in writing and ask for a formal death notice on the file.
- Control the information flow -- the obituary, the mail, and the accounts still running on autopay.
Everything else in this guide is detail underneath those four.
Step 1: Report the death to Social Security
In most cases the funeral director does this. Do not assume it happened.
Social Security's reporting rules are narrow and worth knowing: reports are accepted by phone or in person only. As the federal guidance states, "SSA only accepts reports of death by phone or in person. They do not accept reports by email or online" (USA.gov, Report the death of a Social Security or Medicare beneficiary). The number is 1-800-772-1213 (TTY 1-800-325-0778). Have the deceased person's full name, Social Security number, date of birth, and date of death in front of you.
There is a money consequence attached to this step, and it catches families off guard. Social Security cannot pay benefits for the month of death. The federal guidance gives the example directly: "if the person died in July, the check or direct deposit received in August (which is payment for July) must be returned." Ask Social Security how to return it. Do not leave it sitting in an account you are about to stop watching. Our guide to notifying Social Security of a death covers the mechanics in more detail, including survivor and lump-sum death benefits.
Step 2: Order more death certificates than you think you need
Every notification below wants a copy, and several want a certified one. Ordering a second batch later costs another fee and another two to four weeks, during which the credit files are still unflagged.
Our guide on how many certified copies of the death certificate to order walks through the arithmetic. For the identity-protection portion alone, budget copies for: each of the three credit bureaus, each bank and credit union, each credit card issuer, each brokerage, the pension or annuity administrator, and the Post Office. That is usually a double-digit number before you have touched the probate court's own requirements.
Step 3: Notify the credit bureaus, in writing, with proof
This is the single highest-value step, and it is a letter.
The California Attorney General's guidance sets out what the bureaus need: "the surviving spouse or executor needs to notify the three national credit bureaus in writing. The surviving spouse or executor must include the following specific information along with the alert request: 1) a copy of death certificate, and 2) proof of executorship or marriage."
Your letter should identify the person with enough precision that the bureau can match the file on the first pass. The CA AG's sample letter asks for exactly four identifiers, and they are the right four:
- Deceased's full name, with middle initial if used
- Most recent address
- Social Security number
- Date of birth
Enclose the death certificate copy and a copy of the document that establishes your authority -- letters testamentary or letters of administration if you have been appointed, or a marriage certificate if you are the surviving spouse acting in that capacity. Ask specifically for a formal death notice or deceased alert on the credit file.
A few practical notes that save a round trip:
- Get the current address from each bureau's own site. Submission addresses and upload portals change, and published lists go stale. Experian's current consumer guidance, for example, points to its Consumer Assistance Center at P.O. Box 4500, Allen, TX 75013, or an online upload of the certified copy (Experian, How to Report a Relative's Death). Verify Equifax's and TransUnion's current intake on their own sites before you mail.
- Send all three anyway. Experian's guidance says that "[o]nce you notify one credit bureau of a loved one's death, it'll notify the other two, so there's no need to reach out to all three." That may well be true, and it costs you three stamps to not depend on it. You cannot audit the cascade; you can audit your own mailing receipts.
- Send it in a trackable way and keep the receipt. Certified mail with return receipt is the cheap version of a paper trail. If a disputed account surfaces eight months later, the date you notified the bureaus becomes a relevant fact.
- Expect the file to persist for a while. Experian's guidance notes that the bureaus "delete credit accounts seven years after being notified of a death." The flag is immediate; the file does not vanish.
Step 4: Control what is publicly available
The IRS's guidance on deceased-person identity theft is three bullets long. One of them is about the obituary: "Avoid putting too much information in an obituary that identity thieves could use" (IRS, Identity theft guide for individuals).
An obituary is a public document that is indexed, syndicated, and archived. The traditional format happens to assemble, in one place, several of the exact data points used to verify identity over the phone:
| Common obituary detail | Why it is a risk | Safer alternative |
|---|---|---|
| Full date of birth | Pairs with a name and SSN for verification | Birth year only, or "born in 1948" |
| Mother's maiden name | A classic security question answer | "Survived by her mother's family of Dayton" or omit |
| The deceased person's street address | Targets mail and locates the empty house | Town and state only |
| "Resided alone at…" | Signals an unoccupied property | Omit entirely |
| Full names of all minor grandchildren | More identities to correlate | First names, or "and six grandchildren" |
This is not an argument for a thin obituary. Write about the person. Write a lot about the person. Just write about their life rather than their identity-verification answers.
The Mail Is an Attack Surface
Mail addressed to a deceased person at an address nobody is checking is a standing invitation -- preapproved credit offers, account statements with partial numbers, replacement cards.
USPS handles this in person, not online. Its guidance for mail addressed to a deceased person is explicit that you "must go to a Post Office location to submit a change of address request" if your address differs from the deceased person's, and that you must "[p]rovide documented proof that you are the appointed executor or administrator authorized to manage the deceased's mail. (Simply having their death certificate is not enough.)" (USPS, Mail for the Deceased). If you shared an address with the person who died, USPS says you may open and manage the mail as needed, or forward it.
Bring your letters of appointment, not just the death certificate. This is one of the reasons executors are told to get extra certified copies of the appointment order along with the death certificates.
Separately, reduce the marketing mail. USPS's own guidance points to the Deceased Do Not Contact registration at DMAchoice.org and notes that "advertising mail should decrease" within three months of registering. It is not complete coverage -- it reaches participating mailers, not every local business and regional charity -- but it meaningfully thins the stack, and a thinner stack is one somebody will actually look through.
Tax Season Is the Second Window
The credit bureaus are the first exposure. The second is the filing season after the death, because a Social Security number that has not yet had a final return filed against it is a target for a fraudulent refund claim.
The IRS's deceased-person guidance leads with the preventive step: "File the deceased person's final tax return(s) when due." Filing on time, rather than late, is the protective act -- a return already on file is a return a fraudulent one collides with.
If something is already wrong -- a return rejected as already filed, an IRS notice about income the person did not have, a refund claimed by someone else -- the IRS directs you to "[c]heck if you should file Form 14039, Identity Theft Affidavit." Our guide to filing taxes for a deceased person covers the final return itself, including who signs it and how a refund is claimed.
Accounts Still Running on Autopay
Every open account is both a probate asset to be inventoried and an identity exposure to be closed. Working through them serves both purposes at once.
- Bank and credit union accounts. Notifying the bank is what stops the account from being used, and what starts the process of moving funds into an estate account. See closing bank accounts after death, and note that jointly held accounts follow different rules.
- Credit cards. Each issuer needs separate notice; closing one card does not touch the others, and an open card with no one reading the statement is the classic ghosting vector. Closing a credit card after death covers the issuer-by-issuer process and the authorized-user complication.
- Direct deposits and autopayments. A pension, annuity, or payroll deposit that keeps arriving creates a balance nobody is reconciling. An autopay that keeps leaving does the same in reverse.
- Online accounts. Email in particular, because email is the password-reset channel for everything else. Securing the email account is often the single most protective digital step.
Running this as a list rather than from memory is the difference between a clean inventory and a surprise. The estate inventory checklist is built for exactly this pass.
Monitoring: What to Watch, and for How Long
The notices are not the end of the task. For several months afterward, watch for the signals the California Attorney General's guidance identifies: "calls from a creditor or collection agency on an account opened or used in the deceased's name after death."
Other signs worth treating as a flag:
- A credit card or loan statement arriving for an account you have no record of
- A collection notice for a debt predating nothing you can find
- An IRS notice about wages or self-employment income from after the date of death
- A rejected final tax return
- Mail addressed to the deceased person at an address they never lived at
Ask each bureau, in the same letter in which you send the death notice, whether it can release the deceased person's credit file to you as personal representative and what documentation it requires. Where it is available, it is the cheapest way to find accounts you did not know existed, which is useful for the estate inventory even if no fraud ever occurs. Our guide to finding a deceased person's bank accounts covers the parallel search on the banking side.
If It Has Already Happened
Shift from prevention to documentation, and move in this order.
- Write to the creditor or collection agency. State that the account was opened or used fraudulently, give the date of death, ask that the account be closed and a formal death notice placed on it, and state that you are not accepting personal liability for the balance. The California Attorney General publishes a sample letter for precisely this, and it is worth copying.
- Report it at IdentityTheft.gov. The FTC's site generates an official Identity Theft Report, which several institutions will ask for by name.
- File a police report with the department where the deceased person lived, and request a copy.
- Send the death certificate and the police report to every affected creditor, and ask in writing for an investigation.
- Notify the bureaus again, referencing the specific fraudulent account and your earlier death notice.
- Keep everything. Dates, copies, mailing receipts, names of representatives.
One point worth being clear about, because families worry about it: an account the deceased person never opened is not a legitimate debt of the estate, and a collector calling a relative about it is not the same thing as that relative owing it. The response is to dispute it in writing as fraudulent -- not to pay it to make the calls stop, and not to ignore it either. How legitimate debts get paid out of estate assets, and what a family member's own exposure does and does not depend on, is a separate question with state-specific answers; our guide on which debts are forgiven at death covers that ground, and it is a reasonable thing to take to an attorney if a collector is pressing someone personally.
The Fiduciary Angle
If you have been appointed personal representative, this is not just protective housekeeping -- it is inside your duties. A personal representative is generally obligated to safeguard estate assets and to account for what happened to them, and an account opened fraudulently against the estate's credit is a problem in both columns. See executor responsibilities for the broader duty, and final accounting in probate for where this documentation eventually lands.
The practical implication is to keep a file. Not because anyone is likely to accuse you of anything, but because "I sent the notices on October 14 and here are the certified mail receipts" is a complete answer, and "I'm fairly sure we handled that" is not.
A Two-Week Working Sequence
| When | Action |
|---|---|
| Days 1–3 | Confirm the funeral home reported the death to SSA, or call 1-800-772-1213 yourself |
| Days 1–3 | Order certified death certificates -- more than you think you need |
| Days 1–3 | Review the obituary draft and strip date of birth, street address, and mother's maiden name |
| Days 1–5 | Secure the deceased person's email account and phone, which are the reset channel for everything |
| Week 1 | Mail the death notice package to all three credit bureaus, certified, and file the receipts |
| Week 1 | Visit the Post Office with letters of appointment to forward or manage the mail |
| Week 1 | Register the Deceased Do Not Contact listing to cut marketing mail |
| Week 2 | Notify each bank, card issuer, brokerage, and benefit administrator separately |
| Week 2 | Ask Social Security how to return any payment for or after the month of death |
| Week 2 | Request the credit file from each bureau to find accounts you did not know about |
| Ongoing | Watch the mail and any statements for new-account or collection activity |
| By the deadline | File the final income tax return on time |
Where Professional Help Earns Its Cost
Most of this is organizational. A few parts are not, and it is worth being direct about which.
An attorney is worth consulting if fraudulent accounts have gone to collection and a collector is pressing a family member personally, if a fraudulent transaction moved real property or titled assets, or if the fraud happened inside the family -- which it sometimes does, and which is a genuinely different problem. A tax professional is worth it if the identity theft touched a filed return, because the IRS correspondence track for that has its own procedure. Deciding whether to bring someone in is a judgment call about the specific situation in front of you, and having the dates, the notices, and the receipts already assembled is what makes that decision an informed one instead of a guess.
How SwiftProbate Helps
SwiftProbate is probate task management software. It helps you understand what needs to happen in an estate, organize documents and deadlines in one place, and track what is done and what is still open.
Identity protection after a death is a good illustration of why that matters, because it is not one task. It is a phone call to Social Security, a death certificate order sized to a notification list, three nearly identical letters with enclosures, a Post Office visit that requires the right paperwork, an account-by-account notification pass, a tax deadline, and several months of watching the mail. Each piece is small. Together they are exactly the kind of thing that gets half-finished during a hard month, and the half that gets skipped is usually the half with no immediate consequence -- which is the half this guide is about.
SwiftProbate keeps that list as tasks rather than as something you are trying to hold in your head, and keeps the death certificates, the appointment letters, and the notification receipts attached to the estate instead of scattered across an inbox and a kitchen drawer.
If you are earlier in the process, the step-by-step probate checklist lays out the overall sequence, and the estate inventory checklist shows where the account-by-account notification pass fits alongside the rest of the estate's work.
SwiftProbate provides software to help navigate the probate process. SwiftProbate is not a law firm, does not provide legal advice, and is not a substitute for the advice of a licensed attorney. No attorney-client relationship is created by using this service. Probate laws vary by state and county.