Identity Theft Rights in New York
About this article
Reviewed by the Commoner Law Editorial Team. Sourced from primary statutes (U.S. Code, CFR, state compiled statutes) and official government agency guidance. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
How New York differs from federal law
New York provides strong state-level protections for identity theft victims:
- NY Identity Theft Prevention and Mitigation Services Act: Requires companies that experience data breaches to provide affected consumers with identity theft prevention and mitigation services (such as credit monitoring) for a minimum period.
- SHIELD Act (NY Gen. Bus. Law § 899-aa): Significantly expanded data breach notification requirements and mandates that businesses implement reasonable data security safeguards. Broadened the definition of "private information" to include biometric data and account credentials.
- Identity theft as a crime: NY Penal Law § 190.77–190.84 establishes identity theft as a specific crime with penalties based on severity. Victims can cooperate with the DA's office to prosecute offenders.
- Security freeze rights: NY was an early adopter of free credit freeze rights (NY Gen. Bus. Law § 380-t). Victims of identity theft can request extended fraud alerts and expedited freezes.
Additional Steps in New York
Report identity theft to the New York Attorney General at ag.ny.gov or call (800) 771-7755. File a police report with the NYPD or your local police department. Contact the NYS Division of Consumer Protection at (800) 697-1220.
Relevant Law: NY General Business Law § 899-aa (SHIELD Act), NY Penal Law § 190.77–190.84 (identity theft crimes), NY Gen. Bus. Law § 380-t (security freeze)
Federal baseline: Identity Theft Rights nationwide
What is this right?
Identity theft became a federal crime in its own right in 1998 with the Identity Theft and Assumption Deterrence Act. Before that, the law treated it as a problem for the bank — you, the person whose name was on every fraudulent account, often had no standing to do much about it. The 1998 law and the 2003 FACTA amendments to the FCRA finally gave victims teeth: free fraud alerts and credit freezes, the right to block fraudulent debts from your credit report, and an FTC-run recovery system at IdentityTheft.gov that generates an Identity Theft Report — a document that unlocks specific rights against creditors and bureaus.
You're not legally responsible for debts a thief opened in your name. But the burden of proving that — and undoing the damage — falls on you, and the speed of your response decides how bad the damage gets.
When does it apply?
You're a victim of identity theft when:
- Accounts, loans, or credit cards turn up in your name that you didn't open.
- You're getting bills or collection notices for debts that aren't yours.
- Unfamiliar charges show up on bank or credit card statements.
- You get denied credit, a job, or insurance based on a report containing accounts that aren't yours.
Three things to clear up:
- "Identity theft is an online thing." A lot of it isn't. Stolen mail, lost wallets, data breaches at companies you barely remember, and — depressingly often — relatives or roommates with access to your documents.
- "I'm on the hook for what they opened." No. Federal law puts the loss on the lender, not on you. But you have to formally dispute, with documentation, to make that real.
- "Fraud alert and credit freeze are the same." They're not. A fraud alert tells lenders to verify your ID before opening new accounts — useful but soft. A credit freeze fully locks your file, blocking new credit checks until you lift it. Both are free under federal law as of 2018. Use the freeze.
What to Do If Someone Stole Your Identity
Step 1: Start at IdentityTheft.gov. The FTC site walks you through a personalized recovery plan and — critically — generates the Identity Theft Report. That document is what unlocks your strongest rights against creditors and credit bureaus. Without it, every dispute is harder.
Step 2: Fraud alert, then freeze. Call any one of the three bureaus (Equifax 800-525-6285, Experian 888-397-3742, TransUnion 800-680-7289) — they have to notify the other two. The alert lasts one year. Then go a step further and place a credit freeze with all three. The freeze is free, blocks anyone from opening new accounts, and you can lift it temporarily online when you need to apply for something.
Step 3: File the police report. Bring your FTC Identity Theft Report, ID, and any evidence of the fraud. A police report number is what some creditors will demand before they'll act.
Step 4: Hit every creditor with a dispute. Each company where a fraudulent account was opened gets the Identity Theft Report plus a written dispute letter. Once they receive it, they have to stop collection and investigate.
Step 5: Block the fraudulent items at the bureaus. Send the Identity Theft Report to Equifax, Experian, and TransUnion. Under FCRA § 605B (added by FACTA), the bureaus have 4 business days to block fraudulent information from your file once they receive a valid Identity Theft Report.
Step 6: Watch your reports for a year. Thieves often resurface. Pull free weekly reports at AnnualCreditReport.com and keep the freeze on between active credit applications.
What should you NOT do?
Don't wait it out. Damage compounds by the day. Every hour without a freeze is another hour the thief can open something new in your name.
Don't pay anything they opened. Even partial payment can be read as acknowledging the debt and complicates the dispute. Dispute first, pay never.
Don't trust inbound calls claiming to be from the fraud department. Scammers love to call victims pretending to be helpers. Hang up, call the bank or bureau yourself using the number on the back of your card or on their official site.
Don't drop the freeze once the dust settles. A frozen file is a non-target. Most people can leave the freeze on permanently and only thaw it when applying for new credit — that takes about a minute online.
You shouldn't have to hire a lawyer to assert your rights.
Answer a few questions. We generate a personalized letter citing your state's exact statutes, deadlines, and penalties — ready to print and send in minutes.
Lawyers charge $350+. Your letter: $19.
See all 20 letter types →Identity Theft Rights in other states
Same topic, different jurisdiction. Pick the one that applies to you.
Legal Resources
We may earn a commission if you use these services — at no extra cost to you. This supports our mission to make legal information free for everyone.