The bank sent me a credit card I did not request. Isn’t this against the law and what should I do?

Regardless of the purpose for which a credit card is to be used, including business, commercial, or agricultural use, no credit card shall be issued to any person except –

(1) In response to an oral or written request or application for the card; or 
(2) As a renewal of, or substitute for, an accepted credit card.

Regulation Z, which implements the Truth in Lending Act, prohibits a bank from issuing unsolicited credit cards.  However, banks may purchase existing accounts and issue replacement cards.  A bank may also send out an inactive card, as long as the recipient must take positive action to initiate the account.  In addition, a bank may convert another type of card, such as a calling card, to a credit card.  The credit terms on the new accounts do not have to be identical with the old.

Occasionally, a bank may issue a credit card in error.  In such a case, the bank should close the account and remove any record of the account from your credit history.

Receiving an unsolicited card could mean that a third party has applied for the card after stealing your identity. To see if this is the case, start by contacting the bank to inquire about the new card and why you received it.

If you suspect identity theft, you should order a copy of your credit report. You can order one free credit report every 12 months through or by calling 1-877-322-8228. 

If you believe you are a victim of identity theft:

  • Place a fraud alert on your credit reports by calling one of the credit reporting agencies (you need only call one; the alert will be shared amongst all three).
    • TransUnion: 1-800-888-4213
    • Equifax: 1-866-349-5191
    • Experian: 1-877-284-7942
  • Close the accounts that you know, or believe, have been tampered with or opened fraudulently.
  • File a complaint with the Federal Trade Commission at 1-877-ID-THEFT (438-4338) or online at FTC Complaint Assistant.
  • File a report with your local police or the police in the community where the identity theft took place.

September 2017