A recovery plan for after a scammer got your policy details

If a scammer has your policy number, your Social Security number or your login, the first goal is to make that information less useful, not to find out who the scammer was. Contact the real insurer through a number you found yourself, protect your accounts, check what has changed on the policy, freeze your credit if identity numbers were exposed, report what happened and tell the people who might be targeted next. Most of these steps cost nothing and take minutes. Doing them in order matters, because the most damaging things a scammer can do with policy details are fast: change a mailing address, request a loan or ask for a surrender.

This is a playbook, not legal advice. Where a step touches tax, law or your particular policy, a professional or the insurance department is the right person. The steps assume the worst case, that the scammer got real information. If you only recognized a scam and hung up, a shorter version applies, and the note at the end says which steps to skip.

Before you start: sort out what the scammer has

Take two minutes to write down what you shared. The answer decides which steps matter most.

If you are unsure, assume more was shared rather than less.

Step 1: Contact the real insurer (today)

Find the insurer's number on a statement or on its website, typed directly, and call. Do not use any number the scammer gave you. Tell the representative you believe someone has your policy details. Ask:

1. Has anything changed on the policy recently? Address, phone, email, payment method, banking details, beneficiary or owner.
2. Have there been any requests for a loan, withdrawal, surrender or ownership change? A policy loan or a surrender of a policy with cash surrender value can send money out of the policy, usually to the owner of record.
3. What extra verification can you add? Ask whether the insurer can put a note on the account, require extra identification for changes or require a written signature. Features vary by company, so ask rather than assume.
4. Can you send me written confirmation of the current owner, beneficiary and status? You want a paper or portal record dated today.

Write down the date, the representative's name and what you were told. If the insurer finds a suspicious change, ask it to reverse or hold the request and to document that you did not make it. The insurer can also tell you how to report suspected fraud on its side; many have special investigation units. Policy owners are entitled to information about their own policy, and privacy and your life insurance data: who sees it and your rights explains what insurers hold.

Step 2: Lock down accounts (today)

The scammer may try your other accounts using the same information.

• Change passwords on the insurer's portal and on your email account, starting with email, since it can reset everything else. Use a unique password for each, ideally with a password manager.
• Turn on multi-factor authentication wherever it is offered, preferring an authenticator app to text messages if you have the choice.
• Call your bank and card issuers if you shared any financial details or sent money. Ask about freezing the account, replacing cards and watching for charges. The sooner you report, the more options you may have.
• Check your phone and email forwarding rules. A scammer with access may have set up forwarding to catch verification messages.
• Run a security scan on any device you used if you clicked a link or opened an attachment.

Step 3: Watch for loans, surrenders and address changes (this week)

Ask the insurer for a current statement or an in-force summary, and compare it with your last known figures. Look for:

• A policy loan or withdrawal you did not request.
• A change of mailing address, which can redirect statements so you do not see the damage.
• A change of bank account for premium drafts or payouts.
• A change of owner or an assignment of the policy.
• A change of beneficiary.

Check again in 30 days and again at 90 days. Some fraud is slow: a scammer may wait to see if you notice. Also check annually afterward, as you would any policy. If the policy has cash value, a statement showing the loan balance and cash value each year is a quick check; see life insurance policy loans: how they work and what they risk for how loans appear.

Step 4: Change beneficiaries safely, only if needed (this week)

A scammer who knows your beneficiary is not the same as a scammer who can change it. The change usually requires the owner's signature or verified request. Do not change a beneficiary in a panic, and do not use a form or link sent by anyone who contacted you.

If you do want to change a beneficiary, for example because the scammer learned the name of a family member, or because the information in an old designation is out of date:

1. Request the insurer's own change form through its website or a number you found.
2. Complete it and return it as the insurer instructs, keeping a copy.
3. Ask for written confirmation that the change was recorded.
4. Tell the person who is now named, without sending the paperwork to anyone unverified.

How the form works, and what to watch for with a revocable beneficiary versus an irrevocable one, is in how to change your life insurance beneficiary. If you are the owner and the scammer posed as you to change a beneficiary, the insurer's investigation and records will matter, which is why Step 1 asks for written confirmation of the current designation.

Step 5: Freeze your credit if identity numbers were exposed (this week)

If you gave a Social Security number, date of birth with address, or other identity details, consider a credit freeze. A freeze restricts access to your credit file so new accounts are harder to open in your name. You place one with each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. It is free under federal law, and you can lift it temporarily when you apply for credit. Place it with all three, since each keeps its own file.

Consider a fraud alert in addition, and review your credit reports for accounts you do not recognize through AnnualCreditReport.com. The FTC's site IdentityTheft.gov lets you report identity theft and build a personal recovery plan. Keep a record of every step, because identity problems can reappear months later.

Step 6: Report (within days)

Reports create a record and help others. File where they apply to you.

• The FTC, at ReportFraud.ftc.gov, for any scam involving impersonation or lost money.
• Your state insurance department, which handles complaints against agents and insurers, can alert the real insurer and may track patterns. The process is in how to file a complaint against a life insurer.
• The FBI's Internet Crime Complaint Center (IC3) at ic3.gov if the contact or payment happened online.
• Local police, particularly if money was taken, accounts were opened in your name or you need a report to give a bank.
• Your bank or payment provider, as part of Step 2, which records the fraud on their side.

Keep copies of the emails, texts, numbers called, amounts sent and receipts. If you paid by a method that is hard to reverse, report that quickly, and ask the payment provider whether anything can be recovered. Recovery cannot be promised. The sooner a report is made, the more options usually remain.

Step 7: Tell the family, and set up a second pair of eyes (this month)

Scammers who succeed once often return. They also use what they learned: family names, the beneficiary, the bank.

1. Tell your beneficiaries and close relatives that your details were exposed and to treat unexpected calls about your policy or your estate with suspicion.
2. Agree on a plan: no one pays or shares information over the phone about you without calling the person directly on a number they already have.
3. Ask the insurer about naming a third party to receive lapse notices; the steps are in setting up a third-party lapse notice designee, step by step.
4. Keep a policy list and a safe place for documents so a family member can find them; see where to keep your policy and who to tell about it.
5. Review the situation again after 30 and 90 days.

If the person affected is an older relative who may be targeted repeatedly, elder financial abuse involving life insurance describes additional protections and where to report to adult protective services.

What not to do in the aftermath

A few well-meant reactions make things worse.

• Do not call the scammer back to demand money or to confront them. It confirms your number is active and invites another attempt.
• Do not pay a "recovery" service. People who lost money are often contacted by a second set of scammers who promise to retrieve it for a fee. Report to the FTC and your bank instead, and ignore anyone who contacts you first.
• Do not cancel the policy in a rush. Surrendering or letting a policy lapse can end coverage and create tax and charges you did not need; fix the account security first.
• Do not move money between your own accounts on the scammer's instructions, even "to protect it." That is a common second phase of the same scam.
• Do not delete the evidence. Messages, numbers, receipts and screenshots help the insurer, the bank and investigators.

Keeping a recovery file

Open one folder, paper or digital, and put everything in it: the notes from your first call to the insurer, the written confirmation of owner and beneficiary, copies of the reports you filed with their reference numbers, the credit freeze confirmations and a dated list of what you checked and when. If a problem appears later, such as a loan you did not request, the file shows when you acted and what the insurer knew. It is also what an attorney or the insurance department will ask for first. If the loss was large, or the insurer disputes whether a transaction was authorized, an attorney who handles consumer or insurance matters can explain your options under your state's law. Nothing here promises that a loss will be reimbursed; outcomes depend on what happened and on the law and policies that apply.

A hypothetical timeline

Say Priya, 52, read out the last four digits of her Social Security number and her date of birth to a caller claiming to be her insurer, then became suspicious and hung up. The following is invented to show the sequence.

• Hour 0: She calls the insurer on the number printed on her last statement. The representative sees no changes and adds a note asking for extra verification on any request.
• Hour 1: She changes her insurer-portal and email passwords and turns on app-based authentication.
• Day 1: She places a freeze with Equifax, Experian and TransUnion, which takes under an hour online, and files a report at ReportFraud.ftc.gov.
• Day 2: She files a short complaint with her state insurance department and tells her adult son.
• Day 30: She requests an in-force summary: no loans, no address change, same beneficiary.
• Day 90: She checks her credit reports; nothing unfamiliar appears.

Total cost: no money, about three hours across the first week. The point is not that every case ends this way; it is that the early steps are quick, and doing them costs far less than finding a problem later.

If you only recognized the scam

If you hung up before sharing anything, you can skip the freeze and the beneficiary change. Still do three things: report the call, tell the insurer that someone is using its name, and review how you would respond next time. The routine in how to verify a call, email or text from your insurer in ten minutes takes about ten minutes, and mistakes people make when a caller claims to be their life insurer lists the mistakes that give scammers their opening.

Key takeaways

• Start with the real insurer, reached through a number you found yourself, and ask what changed and what extra verification it can add.
• Protect email and portal accounts first, because an email takeover can reset everything else.
• Watch for loans, surrenders, address and banking changes for at least 90 days, and request written confirmation of the owner and beneficiary.
• Freeze your credit with all three bureaus if identity numbers were exposed, and report to the FTC and your state insurance department.
• Tell your family what happened; shared awareness is the best protection against a second attempt.