What to do if…
you receive alerts that accounts are being accessed after a death and you suspect identity misuse

What to do now

1. Save the alerts and start a simple log.
   Screenshot each alert, including the service name, date, time, device, location, IP address, or transaction details if shown. Write down who you contacted, when, what they said, and any case or reference number.

2. Protect the accounts that can reset everything else.
   If you are authorised to manage the deceased person’s email account, phone account, or password manager, use the official site or app to change the password, add stronger sign-in protection, and remove unfamiliar recovery emails, phone numbers, devices, or forwarding rules. If you are not authorised, use the provider’s bereavement, deceased-user, or compromised-account route and say you are seeing possible unauthorised access after the account-holder’s death.

3. If the phone number may be involved, contact the mobile carrier.
   Tell the carrier that the account-holder has died and you are seeing possible one-time codes, SIM-swap signs, port-out activity, or service changes. Ask the carrier to lock the account, block unauthorised number transfers, and tell you what proof of death or authority they need.

4. Contact each provider named in the alerts.
   For banks, cards, payment apps, investment accounts, utilities with stored payment methods, email accounts, cloud storage, and major marketplaces, contact the fraud or bereavement team directly. Say the account-holder has died, you are seeing suspected unauthorised access, and you want online access, transactions, new devices, and account changes paused or reviewed.

5. Ask providers to preserve records.
   If money moved, credit was opened, passwords changed, or devices were added, ask the provider what documentation they need and ask them to preserve relevant login, transaction, device, and contact-change records.

6. Notify a nationwide credit bureau that the person has died.
   Contact Equifax, Experian, or TransUnion and ask for the deceased person’s credit file to be marked as deceased. Ask whether that bureau will notify the other two. They may ask for a death certificate, the deceased person’s identifying information, and proof that you are the spouse, executor, personal representative, or otherwise authorised to act.

7. Use IdentityTheft.gov if the facts fit the report prompts.
   Make a report for the suspected identity misuse and save or print the recovery plan. This can help when providers or credit bureaus ask for an identity theft report while you dispute fraudulent accounts or entries.

8. Check that Social Security has the death recorded if benefits were involved.
   Funeral homes generally report deaths to the Social Security Administration if they have the Social Security number. If that may not have happened, report it by phone or in person; SSA does not accept death reports online or by email.

9. Follow IRS instructions if tax signs appear.
   If you receive an IRS notice, tax transcript issue, suspicious tax form, or message about a return you did not expect, keep the notice and follow the IRS identity theft instructions. Do not ignore IRS letters, but do not call numbers from suspicious emails or texts.

10. Keep proof and authority documents together.
    Put certified death certificates, estate or court authority papers if you have them, provider messages, alert screenshots, fraud reports, and reference numbers in one folder so you do not have to reconstruct everything later.