Insurance identity theft: policies and claims in your name

Identity theft in auto insurance means someone uses your name, birth date, driver's license number or address to buy a policy, to file a claim, or to take over a policy you already have. The damage usually surfaces indirectly: a DMV letter about a car you do not own, a claim on your CLUE report that is not yours, a premium that rises for no reason, or a collections notice. The fix has two parts: report it in the right order, and then get the false entries removed from the records insurers rely on.

This article covers the insurance side. For phishing messages and fake sellers aimed at you, see how to protect yourself from insurance scams; for what to do when an insurer you do business with is breached, see after an insurer data breach: what drivers should do.

How an impostor uses your identity with an auto insurer

Insurance gives an impostor three kinds of value, and each leaves a different trace.

The first two are full-scale identity fraud; the third is closer to ordinary insurance fraud that happens to use a real person's record. An impostor needs very little: name, date of birth, address and a license number are often enough to start an application. Insurers' own quote tools have been one source of that data: in a November 2024 announcement, New York's Department of Financial Services and Attorney General described hackers who obtained driver's license numbers and dates of birth from online auto insurance quoting applications, and said some of the stolen license data was used to file fraudulent unemployment claims (see the DFS press release).

How victims typically find out

Victims often learn indirectly, not from the insurer. Typical signs follow.

• Unexpected mail. A welcome packet, an invoice, a cancellation notice or a premium refund check from an insurer you never contacted.
• A DMV or insurance-verification letter. Many states match registration records against insurer reports. A letter asking you to prove insurance on a vehicle that is not yours suggests a registration was created with your identity. New York's DMV, for example, says an insurance letter must be answered quickly and that recipients can prove they have insurance, sold the vehicle, or did not need coverage.
• A CLUE entry you do not recognize. A claim, vehicle or policy number that is unfamiliar. The LexisNexis claims report, called CLUE, generally holds up to seven years of auto and property claims history, according to the Washington Office of the Insurance Commissioner.
• A premium change that does not match your history. If your renewal rose and the insurer cites a report, find which report (see Your CLUE report and motor vehicle record explained).
• Collections or a credit report entry. An unpaid premium or finance balance from a policy you did not buy.
• Calls or letters from adjusters or other drivers' insurers. They treat you as a policyholder or a driver in a crash you were not part of.
• Tax or benefits notices. Not insurance-specific, but a sign your identifiers are in circulation.

The first steps: a short order of operations

The Federal Trade Commission (FTC) publishes a recovery sequence in its "What To Do Right Away" handout. Applied to insurance, it looks like this.

1. Call the fraud department of each company where you know fraud occurred. For insurance, that means the insurer, the finance company if any, and any lender or agency involved. Explain that someone stole your identity and ask them to close or freeze the accounts or policy and to stop sending you collection notices pending review. Ask for a case or reference number and the name of the fraud or special investigations contact.
2. Place a fraud alert and get your credit reports. Contact one of the three credit bureaus; that bureau must tell the other two. The FTC calls the alert free and says it makes it harder for someone to open new accounts in your name.
3. Report identity theft to the FTC at IdentityTheft.gov or by phone at 1-877-438-4338, and print and save your FTC Identity Theft Affidavit. The handout warns that once you leave the page you will not be able to get the affidavit back.
4. File a report with your local police department, bringing the affidavit, photo ID and proof of your address. The FTC says to ask for a copy of the police report and that combining the affidavit with the police report creates your Identity Theft Report, which proves to businesses that someone stole your identity and guarantees you certain rights.
5. Report to your state state department of insurance if the fraud involved an insurer, an agent or a policy (our guide on how to report insurance fraud covers the options). The National Association of Insurance Commissioners keeps a directory of state insurance departments with complaint links for each state.
6. Tell your own insurer about the theft even if the fraud involved a different company, and ask it to note your file so a new impostor claim or policy change triggers extra checks.

Do these in roughly this order but do not wait to finish one before starting the next; the insurer call and the fraud alert can happen the same day.

What to say to the insurer

Calls to an insurer's fraud department go better with a script. Say it in writing as well and keep a copy.

• "I am a victim of identity theft. I did not apply for or authorize policy number [X]. I am enclosing my FTC Identity Theft Report and a police report."
• "Please identify the date the application was made, how it was submitted, the address and email used, the payment method, and the vehicles and drivers listed."
• "Please suspend billing and collection on this policy and do not report it to any consumer reporting agency as my account."
• "Please tell me whether any claims were opened or paid, and give me the claim numbers."
• "Please correct or delete any entries you reported to LexisNexis or any other reporting agency, and confirm in writing."
• "Please give me a point of contact and a date by which I will receive your written response."

Federal law helps with the document request. Under 15 U.S.C. 1681g(e), a business that sold products or services to someone who made unauthorized use of your identity must, within 30 days of receiving your request, provide copies of the application and business transaction records to you or to a law enforcement agency you designate, after you verify your identity and your claim of identity theft. That gives you the application, the signature or e-signature record, the payment trail and the address the impostor used, which are the facts you need for a police report and a dispute.

Credit freeze or fraud alert, and what each does for insurance problems

The FTC explains that a credit freeze blocks new credit accounts from being opened, including by you, and requires contacting all three bureaus, while a fraud alert requires businesses to verify your identity before granting new credit but does not block access to your report and requires contacting only one bureau. A freeze is free to place and lift and stays until you lift it. An initial fraud alert lasts one year; an extended alert lasts seven years and is available to people who have filed an FTC identity theft report or a police report.

Two caveats for insurance. First, neither tool touches your CLUE report or your driving record; those are separate files. Second, a freeze does not stop an insurer from checking your credit for underwriting. The Washington insurance commissioner says a federal law passed in 2018 bars credit reporting agencies from charging for a security freeze and lets insurance companies review your credit report for underwriting without lifting the freeze. Washington also says some consumers report premium effects after a freeze and invites complaints when an adverse action notice cites one. See that agency's page on credit freezes and insurance. Rules on this differ by state, so ask your regulator before assuming a freeze changes your quotes.

Credit bureau tools protect new credit. For insurance records you need to contact the specific record keepers, covered next.

Cleaning the records

The CLUE report

Request your report from LexisNexis (see Pulling your own records: CLUE, MVR and claim file for the steps) and mark every entry that is not yours. Then use the strongest tool available.

• A blocking request. Under 15 U.S.C. 1681c-2, a consumer reporting agency must block reporting of information you identify as resulting from alleged identity theft not later than four business days after receiving appropriate proof of your identity, a copy of an identity theft report, your identification of the information, and your statement that it does not relate to a transaction you made. The agency must also tell the source of the information that it may result from identity theft. It may decline or rescind a block in limited cases, such as an error or a material misrepresentation of fact.
• A standard dispute. Under 15 U.S.C. 1681i, the agency must reinvestigate and record the status of the item or delete it before the end of 30 days from receiving your dispute, extended by up to 15 days if you send relevant information in the first 30. It must notify the source within five business days.
• A statement. If a dispute is not resolved, you can file a short statement that must accompany the item in later reports.

Also tell the insurer that reported the entry to correct its own data and to stop reporting it, so the same item is not sent again.

The motor vehicle record

A mismatch between your car and a policy can also be a cloned or mistaken VIN rather than your personal identity; see Cloned VINs and vehicle identity fraud. Your motor vehicle report is a separate file kept by the state.

State motor vehicle agencies differ widely, and some give identity-theft victims special options. Two examples:

• Oregon. The state's DMV says that you may be eligible for a new driver license or ID card number if your name and number have been used fraudulently. You submit at least one document such as a police report, a letter from a credit card company, credit bureau or financial institution, a document from the Oregon Department of Revenue or the IRS, a court document or a letter from a district attorney, plus a signed statement and contact details. The DMV reviews the request and sends a decision letter (see Oregon DMV's identity theft page).
• Vermont. The DMV will mark a license record "compromised" if it receives a signed letter from you stating that the number was acquired fraudulently and a copy of a notification letter from the organization that reported the compromise. It warns that you may be required to show additional identification for future license transactions or if stopped by an enforcement officer (see Vermont DMV's compromised license number page).

If an impostor's violations appear on your record, most agencies have a correction or hearing process. The NY DMV says that if you claim that someone else committed a violation on your record, you can request a hearing, but you cannot use a hearing to argue you were not guilty of a violation you did commit. Bring your police report, the FTC affidavit and any court paperwork. Because your license number links to your insurance rating, a corrected MVR matters as much as a corrected CLUE entry.

The insurer's own file

Ask each insurer involved to delete the fraudulent policy or claim from its system, to withdraw anything it reported to a reporting agency, and to confirm in writing. If it refuses or goes silent, file a complaint with your state insurance department and send copies of your reports; see how to file a complaint against a car insurance company.

What you do and do not owe

In general you should not owe money on a policy you did not buy, because you never agreed to it, and a claim paid to an impostor is a loss for the insurer, not a debt you assume. But "should not" is not "automatically cleared," and the mechanics matter.

• Respond to every bill and notice in writing. Silence can let an account go to collections. Enclose your Identity Theft Report and ask the sender to close the account and stop collection.
• Dispute collection or credit-report entries with the credit bureaus. The same blocking and reinvestigation rules apply to credit reports.
• Do not sign anything the impostor's insurer sends to "confirm" a policy or accept a claim payment. If a check arrives in your name, do not deposit it; call the insurer's fraud unit and ask what to do with it.
• If you are named in a third-party claim, such as an injured person or another driver's insurer claiming against "your" policy, answer promptly in writing that you were not involved and that you are an identity theft victim. A licensed attorney or the state insurance department can tell you how your state handles claims against a victim whose identity was used.
• If your actual policy was taken over, change passwords and the email and phone on file, ask the insurer to place a verbal password on the account and review any recent changes to drivers, vehicles and payment methods.

None of this is legal advice; state laws on identity theft and on liability vary, and a licensed attorney is the right source for a specific dispute.

A worked example

Say you receive a letter from the DMV asking you to prove insurance on a 2016 sedan registered in your name. You have never owned it. These details are hypothetical.

1. Day 1. You call the DMV, confirm the registration, and ask for a copy of the application and the address on file.
2. Day 1. You place a fraud alert with one credit bureau and order your credit reports.
3. Day 2. You file the FTC report and take the affidavit to the police to make a report.
4. Day 3. The registration lists an insurance policy from a company you do not use. You call its fraud department with the script above and request the application records.
5. Day 6. You request your CLUE report. It shows a theft claim on the sedan paid 11 months ago.
6. Day 8. You send LexisNexis a blocking request with the identity theft report, and the insurer a written demand to correct its reporting.
7. Day 10 onward. You track the 30-day clocks, send the DMV your report and request its identity theft process, and file a complaint with your state insurance department if the insurer does not respond.

Common questions

Can I be held responsible for a crash an impostor caused under a policy in my name?

You should not be, because you were not the driver and did not contract for coverage. But the injured person's lawyer or insurer may contact you first. Respond in writing with your Identity Theft Report and consult a licensed attorney if a claim or suit is filed.

Should I cancel my real policy and start over?

Usually not. Ask your insurer to add fraud protections instead. Cancelling can create a gap in coverage and a new application will be subject to the same databases.

Will the fraud raise my rates?

It can until the entries are removed. Once the CLUE, MVR and insurer records are corrected, ask the insurer to re-rate your policy and confirm the result in writing. If it will not, file a complaint with your state insurance department.

Do I need an FTC report if nothing has been misused yet?

The FTC's materials say you can freeze your credit at any time, without waiting for your information to be exposed in a data breach or misused. The FTC report and police report are for situations where someone has actually used your information.

Key takeaways

• Identity theft in auto insurance appears as policies you did not buy, claims you did not file, or records that do not match your history, and victims usually find out through DMV letters, CLUE entries, bills or premium changes.
• Follow the FTC order: call the companies, place a fraud alert, report to the FTC at IdentityTheft.gov, file a police report, then report to your state insurance department.
• Federal law lets you demand the impostor's application and transaction records, usually within 30 days, and requires a consumer reporting agency to block identity theft information within four business days of a complete request.
• Credit freezes and fraud alerts protect new credit, not your CLUE report or driving record, and they do not stop insurers from checking credit for underwriting.
• Respond to every bill, claim letter and DMV notice in writing with your Identity Theft Report, and consult a licensed attorney or your state insurance department about your state's liability rules.