I got an email from a U.K. based company (Matalan) thanking me for my order. They have my correct name, correct email address and an old home address and old home phone number. I haven't heard of this company and obviously didn't place the order. My credit cards nor bank account has any record of the charge. I have not gotten any notifications from MyFico either. Have any of you experienced anything like this before? My thought is that someone has stolen my identity and opened up a credit card but it seems like that would be showing on my credit. Maybe it takes a while? I will call the U.K. company tomorrow as it is the middle of the night there right now.
I had something similar happen just a week ago. I got an email from Overstock.com thanking me for an order, yet I've never ordered from them (although I did establish a login a few years ago when I was shopping around). I thought nothing of it (I get a lot of spam) and I deleted the message.
Then I get another message from them, again thanking me for my purchase and telling me the order was soon to ship, and this seemed weird. I haven't logged into the site in years (I think 2013?) so I did a password reset. Once I was logged in things got interesting... sure enough, there was an order there, with somebody else's name and address, but the email was mine (as well as the phone number, except for the last digit). Since I had never ordered from them I had never added a credit card, yet there was one there.
I started a 'chat' session and was asked to call in to loss prevention. I did so, and after a few moments I got a very nice lady who helped sort through the confusion... she thanked me for calling and advised she was able to cancel the pending order (it hadn't yet left the warehouse) and she deleted the online profile. I was concerned that this would put my email address on a 'blacklist' but she assured me this wasn't the case, and that I was welcome to register again with another email or even the same one if I wanted (I haven't).
TL;DR... give the company a call. Even if your own cards show no charges, there's a good chance something might be going on. At a minimum it might save you some hassle in the future.
If you have received an actual bill that you dispute, you can use the dispute provision of the Fair Credit Billing Act (FCBA) to disptue the billing error. That triggers detailed requirements set forth under FCBA 161.
If the information is reported to a CRA, you can then use either the identity theft process under FCRA 605B or the dispute process under FCRA 611 to deal with the reported information.
However, in the case where the credit card company has not billed and the information has not been reported to a CRA, then you must first investigate with the creditor to determine which, if either, may occur.
If you suspect that someone has used your identity, you can place an initial fraud alert with the CRA under the provisions of FCRA 605A to put into effect provisions requiring contact with you prior to any approval of grant of new credit. An initial fraud alert can be placed based only on suspicion of possible use of your identity, and does not require a showing of actual identity theft. If/when you have evidence of any actual identity theft, you can upgrade the initial fraud alert to an extended fraud alert by filing a police report and sending a copy to the CRA.
I would thus continue to investigate with the alleged creditor to gather the facts, and place an initial fraud alert with the CRA to invoke the requirments of FCRA 605A.
You can also place a freeze with each CRA, which is a separate process from placing a fraud alert under the FCRA.