Thank you for the A2A. There are a multitude of ways that your SSN and PW could have been compromised - this happens frequently. SSN’s, DOBs, PW, PINS, etc, are sold for just a few dollars. The information is sometimes obtained from internal sources, and sometimes from other sources. Often people provide their SSN when they feel that it is required and then in a different place they provide their PIN because they think it is required, and the information is then combined and used for identity theft. Other times people unknowingly reveal the information, having no idea that it has been compromised. Those are just a couple of examples. Every one should be aware that the only way to protect their identity is to protect it themselves, and to look at their accounts on a daily basis. One easy way to do this is using a service such as Envestnet | Yodlee Financial Data I use the free service there and it has worked well for me for many years. You can use it to monitor all of your financial accounts, and notify you when certain things take place. You set up the criteria for the notifications. For example, I have mine set up notify me if more than one dollar is spent out of any account (bank/credit card/etc). There are services that you can pay for, but I have found the yodlee (free) one is far better than the ones that have to be paid for.But that is going forward - right now you need to deal with what just happened and recover from that. I assume that you have reported it already. Be sure to also report it at Identity Theft Recovery Steps immediately, and follow the instructions they provide you. You asked if there were red flags raised. Maybe yes, maybe no. The way I look at things, the prevalence of identity theft nowadays is in essence, a red flag for me, and for everyone, warning us to take appropriate measures to protect our own information. For more information, message me - but please do not send me any of your personal information.