A bank account opened in my name: what the bank does next

If a bank account was opened in your name without your knowledge, contact the bank's fraud department, report the identity theft to the FTC at IdentityTheft.gov and, if you can, to the police, and ask the bank in writing for the application and transaction records. Federal law requires the bank to send those records within 30 days, free, once you prove your identity and your claim. The bank should close or restrict the account and should not try to collect any balance from you. What it cannot do is tell you whether it has filed a suspicious activity report. Banks handle these cases under the identity theft prevention program the Red Flags Rule requires; Botminds' New Account Fraud Detection is one way a bank's fraud team finds and closes such accounts, and keeps what must stay confidential out of every letter.

This page explains your rights and the bank's process in general terms. It is not legal advice, and banks differ in the details.

What to do if someone opened a bank account in my name

Act on four fronts, in roughly this order. Call the bank that holds the account and ask for its fraud department; say the account is not yours and ask that it be closed or frozen. Report the identity theft to the FTC through IdentityTheft.gov, and consider a police report, which the records law lists among the proofs a bank may ask for. Write to the bank asking for the application and transaction records for the account, which you have a right to receive. And check your credit reports, and the reports of agencies that track checking accounts, for anything the fraudster left behind.

Most victims do some of this but not all. In the Bureau of Justice Statistics' 2021 survey, "About 7% of identity-theft victims in 2021 reported the incident to police, and 67% contacted a credit card company or bank" (BJS, Victims of Identity Theft, 2021). The police report matters more than that figure suggests, because it is one of the two documents a bank may ask for before releasing records.

What the bank does after you call

It treats your call as a red flag and responds under its identity theft prevention program. The interagency guidelines make notice from a victim a red flag category in its own right, and the closest example is a bank being "notified by a customer, a victim of identity theft, a law enforcement authority, or any other person that it has opened a fraudulent account for a person engaged in identity theft" (Appendix J to 12 CFR part 41). The agencies' 2009 FAQs say appropriate responses to a suspected identity thief "could include not opening the account, filing a suspicious activity report", "notifying law enforcement, and/or contacting the customer whose identity has been stolen" (2009 FAQs).

In practice that means the account is restricted while the bank checks your claim, then closed. Before closing it, a careful bank also looks sideways: an account opened in a stolen identity is rarely alone, and the same device, address or phone often appears on other new accounts. In the solution's sample data, accounts marked "stolen identity" sit in the same review queue as rings of mule and bust-out accounts, and the link agent checks each against the others before anyone decides.

Can a bank tell me who opened an account in my name?

Partly. The bank does not have to name a suspect, and often does not know one with certainty. But the Fair Credit Reporting Act requires a business that dealt with someone using your identity to give you "a copy of application and business transaction records in the control of the business entity, whether maintained by the business entity or by another person on behalf of the business entity, evidencing any transaction alleged to be a result of identity theft" (15 U.S.C. 1681g(e)). The application shows what the impostor gave: the address, phone, email and any documents. That is often enough to see how the theft happened.

Victims often know more than they expect. In the BJS survey, victims were more likely to know how their information was obtained when it was used to open a new account, 29%, than for other kinds of identity theft. Note the phrase "by another person on behalf of the business entity": if the account was opened through a fintech app on the bank's behalf, the records the app holds for the bank are covered too.

Can I get the application records for an account opened in my name?

Yes, within 30 days and free. The law sets the clock: "not later than 30 days after the date of receipt of a request from a victim", subject to verification of your identity and claim. The request must be in writing and, if the bank specifies one, mailed to its address. The records must be provided "without charge". The bank may ask for proof of identity, such as "a government-issued identification card", and proof of the claim, a police report together with a standardized identity theft affidavit or "an affidavit of fact that is acceptable to the business entity". It may decline in good faith in a few cases, for example if it "does not have a high degree of confidence in knowing the true identity of the individual requesting the information".

How do I prove a bank account was not mine?

With proof of who you are and proof of the theft, which the law lets the bank choose from a short list. For identity: a government-issued ID, personal information of the same type the impostor gave, or the information the bank asks new applicants for. For the claim: a police report and a properly completed identity theft affidavit, either the standardized one or another the bank accepts. Beyond paperwork, the account usually proves itself. Banks see the opening device, IP address and contact details; a phone number you never had, an IP address hundreds of miles from your home or a mailbox you never rented is evidence the bank already holds.

Every new account in review, including stolen-identity cases, with a clock on each

How do I close a fraudulent bank account in my name?

Ask the bank to close it, and confirm the request in writing with your identity theft report. You cannot close it as an owner, because legally you are not one; the bank closes it under its own program, which lists closing an existing account among the appropriate responses. Ask for written confirmation that the account is closed as fraudulent, that any balance will not be collected from you, and that any report the bank made about the account to a consumer reporting agency will be corrected. The guidelines also list as a response "Not attempting to collect on a covered account or not selling a covered account to a debt collector", and federal law restricts selling or placing for collection debts that result from identity theft.

Will a fraudulent bank account affect my credit?

It can, if the account was overdrawn and the bank reported it or sent it to collection, and it can also affect whether other banks will open an account for you, if it was reported to a company that tracks checking account histories. The law gives you a tool for both. A consumer reporting agency must block information that resulted from identity theft "not later than 4 business days" after receiving proof of your identity, a copy of an identity theft report, your identification of the information and your statement that it is not yours (15 U.S.C. 1681c-2). Companies that authorize checks and payments are treated slightly differently: after the same four business days they may not report the information to a nationwide credit bureau. If you were refused an account elsewhere because of it, why a bank can refuse to open an account explains the screening involved.

Does the bank report identity theft to the police?

It may, and it may tell the government in a way it cannot tell you. Notifying law enforcement is one of the responses the Red Flags guidelines list. Separately, a bank that suspects a crime may have to file a suspicious activity report with FinCEN, and the SAR rule forbids the bank from disclosing a SAR or anything that would reveal one (31 CFR 1020.320(e)). So the bank's letter to you will confirm what it did with the account, never whether a report was filed. If you want the police to have the records, name the agency in your written request; the law lets the bank send them there directly.

For the bank, keeping that line is a matter of drafting discipline. In the solution, referrals to the BSA team sit in a queue only that team can open, and the notice agent removes any sentence that would reveal a referral before an employee approves a letter. The same rule that keeps a referral away from the person who opened the account keeps it out of the letter to you.

Referrals sit where only the BSA team can see them

How long does it take to close a fraudulent account?

No federal rule sets a deadline for closing it; banks set their own. What the law does fix is the records: 30 days from a verified written request. In practice the account is usually restricted quickly once the bank has your report, because a restricted account cannot be used against you while the bank checks, and closed once the claim is verified. In the solution's sample bank every restriction and closure is checked by a second person within two business hours of the decision, but that is one bank's setting, not a standard.

If the account was used to move money, the case may stay open after the account closes, because the bank must still decide on reporting and may need to answer law enforcement. That work does not need you, and it does not delay your records. How banks spot these accounts before the victim does is set out in new account fraud red flags, and new account fraud statistics show how common the experience is. For banks, the detection and response work behind this page is New Account Fraud Detection.

Questions people ask

Do I have to pay an overdraft on an account I never opened?

No; the debt is the result of identity theft, not your transaction. Give the bank your identity theft report, ask in writing that it stop any collection, and if the account was reported to a consumer reporting agency, ask that agency to block it, which it must do within four business days of receiving the required proof.

What if the account was opened through a fintech app?

Accounts opened in a fintech app are often held at a partner bank named in the app's terms, and that bank is responsible for the account. Contact both. The records duty covers records "by another person on behalf of the business entity", so the app's records of the opening are within reach of your request.

Why would someone open a bank account in my name?

Usually to receive and move stolen money without their own name on it: deposits of stolen or fake checks, proceeds of scams or benefit fraud, or a quick bust-out against checks that later bounce. FinCEN's analysis of 2021 reports found stolen identifying information used to open accounts and apply for credit, often discovered only after other fraud came to light.

Can a bank refuse to give me records because I am not its customer?

Not for that reason alone. The duty runs to the victim of identity theft, not to the account holder, and applies to any business that entered a transaction with the person who used your identity. A bank may decline only on the grounds the statute lists, such as not being confident of your identity.

Will the bank contact me if it finds the fraud first?

It may. The agencies list contacting the person whose identity has been stolen among appropriate responses, but the Red Flags Rule does not require any one response, so practice varies. Many cases surface the other way round, when the victim notices mail, a collection call or a report entry and calls the bank.