Data Breach

Here’s When You Should File a Police Report After a Data Breach

With so much uncertainty surrounding the recent Equifax data breach, many Americans are wondering how to respond—especially if it leads to actual criminal identity theft.

If that's the case, should you file a police report?

The Equifax breach exposed financial records of 143 million people, or about 75% of all Americans with a credit report. But experts say filing a police report now may be jumping the gun, although there could be a case for doing so later. (See: 5 Things to Do After a Breach)

"It is somewhat premature to file a police report following a data breach," says Steven Weisman, a date security expert and author of the book "IdentityTheft Alert." "However, whenever you actually become a victim of identity theft, either with someone actually accessing your accounts or otherwise using your identity, you should file a police report as soon as possible," Weisman says.

While there is little likelihood that the criminal will be caught, filing a police report leads directly to clearing your credit report of erroneous charges and having individual accounts cleared of wrongful charges," Weisman adds.

Other I.D. fraud experts agree that you should file a report only when you know your identity has been stolen and that it's "likely" to be used for criminal purposes.

"In most cases, victims know after the fact," says Andrew Costello, a retired deputy inspector of police for the New York City Police Department. "Fraud victims will see charges on their credit card, receive a call from a collection agency, or find out from a credit report that they have loans or accounts they did not know existed."

Normally, police reports are filed in I.D. fraud cases where the victim is reasonably certain who stole their identity. "In some circumstances, victims will know before their identity is used in a criminal transaction," Costello says. "For example, family members with a history of substance abuse will sometimes use another family member's identification. The report should be filed when there is knowledge of the identity theft."

Would the Equifax breach qualify for a police report? That's a tough call, says Costello.

"This is difficult," he says. "A complaint usually requires a victim, an action, and a suspect." While the suspect does not have to be known, the only way you have knowledge of an unknown suspect is to see an overt action such as an unauthorized purchase, he points out. "The Equifax breach, by itself, would not warrant a police report, as potential victims may not have been victimized yet," Costello says.

"Yet" is the operative word here because hackers often wait months or even years to try and profit from personal information stolen in a breach. That's why it's important to remain vigilant long after the headlines about the Equifax breach die down. (See: What Can Identity Thieves Do with Your Personal Information)

Data Breach 2017: Criminal Intent

In most cases with identity theft, you must have a direct loss such as withdrawn money, purchases made using credit cards in your name, or a loan application in your name, before filing a police report. "If you have the specific knowledge of an identity thief that will use your identity to obtain a benefit, you may file a report for the attempt," Costello says. "But that scenario is infrequent and usually involves check counterfeiting or intimate family members."

The law enforcement view on the matter mirrors the legal perspective.

"Although Equifax had a crime committed against it, no crime has been likely been committed against any of Equifax's customers that could be directly related to the data theft," states Eric Klein, owner of Klein Law Group, P.A., in Boca Raton, Fla. "Therefore, although a crime was committed against Equifax, a customer of Equifax has not experienced a crime they are aware of to report to the police."

Klein, who often handles I.D. theft cases, advises financial consumers to wait until a theft has actually occurred before filing a police report. "You would have to wait until someone steals money out of your bank account or obtained a credit card or tax refund using your personal data because again, it is only when a crime has been committed that it is a reportable offense to the police," he explains. "Without the commission of a crime, no crime has been committed and there is no crime to be investigated by the police."