It Never Actually Ends

 

My Five-Year Identity Theft Story

In June 2021, malware quietly stole my saved passwords, browser cookies, and autofill data from my devices. I didn't know it yet, but that single infection would take over the next five years of my life — and it still isn't over.

How It Started

The first sign was small: an overseas transaction I didn't recognize. Then another. Within weeks, the scope became clear. Whoever had my data had gotten into my unemployment benefits account and redirected my direct deposit — not once, but eight separate times, across three different banks. Every time I fixed it, they redirected it again.

By the time I filed my police report that August, the damage included:

• 13 bank accounts compromised or closed
• 3 credit cards opened or hijacked fraudulently
• A credit score drop of over 200 points
• My daughter's own account targeted by someone overseas, intercepting her security codes in real time
• Two utility shut-offs, because legitimate payments bounced when my accounts were frozen for fraud

I did everything the guides tell you to do. I filed the police report. I filed the FTC affidavit. I froze my credit with all three bureaus. I filed an insurance claim.

The Part Nobody Warns You About

In February 2022, I got a notarized letter: my identity theft insurance claim had been approved. A specific dollar figure, north of $70,000, to be paid out in monthly installments starting the following month.

Six weeks later, I got a second letter. The claim was reversed. The reason given: a technicality about my coverage dates — despite the fact that I'd already submitted documentation proving otherwise. I never saw a cent of that money.

Around the same time, I applied to a separate class-action data breach settlement I clearly qualified for. I was told I wasn't in the settlement class. I spent months submitting my driver's license, my Social Security card, proof of address — just to establish that I was, in fact, me.

That's the part that doesn't make it into most identity theft checklists: sometimes you do everything right, and the system still tells you no.

Losing My Own Email

Because the thieves had my credentials, I was locked out of my primary email account for close to three years. I had to run my entire recovery — every phone call, every dispute letter, every account verification — through a backup account instead. That backup account got targeted too. My real phone number was stripped from it and replaced with a number that wasn't mine, cutting off my own verification codes at the exact moment I needed them most.

Five Years Later, It's Still Not Over

This is the piece that surprises people: identity theft doesn't resolve on a timeline. It resolves — if it resolves — in fragments, over years, and new fallout keeps surfacing.

• My daughter recently hit a wall trying to authenticate her own taxes, because government systems still had a name mismatch tracing back to my 2021 case.
• I opened a brand-new local bank account this year. Within two months, it was restricted — simply because I linked it to PayPal, which flagged my identity against old fraud data still sitting in the system.
• I still regularly have to prove who I am over video verification calls, sometimes multiple times in a row, sometimes hanging up mid-process only to have to start over from zero.

Five years of paper trails, notarized letters, police report numbers, and dispute letters — and my identity is still treated as "unverified" by systems that have no mechanism for saying a case is actually closed.

Why I'm Sharing This

Most identity theft resources focus on the first 30 days: freeze your credit, file your reports, call your bank. That advice is correct, and it matters. But it also implies an endpoint that, for a lot of us, doesn't exist. I want people going through this to know:

• An "award" letter is not a guarantee. Get every reason for denial in writing, and don't assume approval means payment.
• Settlement systems can reject real victims. Being denied class membership doesn't mean you weren't affected — appeal it.
• The flagging can outlast the case by years, and it can follow your family members into systems that have nothing to do with your original theft.
• You may need to escalate past the first person you reach, especially with recurring video verification loops — ask specifically for a fraud specialist rather than restarting the queue.

If you're in the middle of this right now, I see you. It is not just you doing something wrong. Some of this is simply how broken the system is — and the fight, unfortunately, can outlast the fraud itself.