October is in full swing, and you can tell just by looking around. Halloween decorations fill every storefront, and Dia de Los Muertos depictions are already on display. Pumpkins, ghosts and skeletons already sit on porches, propped in place for some scary fun.

While hordes of the undead (trick or treaters) will be stalking the streets soon, here’s an all-too-real, all-too-common, supremely scary “undead” scenario: an identity thief steals your deceased loved one’s identity to open new accounts, apply for government benefits, buy houses or cars and more.

According to some reports, as many as 2.5 million deceased individuals become the victim of identity theft each year. Some estimates say that around 800,000 of these people are targeted specifically because they have passed away (the remaining identities may simply be chance victims of identity theft or random use of Social Security numbers). As with some other types of identity theft, like child identity theft, the culprits have typically been close friends or relatives of the departed. The easy access to their sensitive documents and the uncertainty surrounding things like account status or benefits means it can be easy for someone to slip in and commit this kind of fraud.

However, that’s certainly not the only mechanism by which a thief can steal a deceased person’s identity. Thanks to things like data breaches and synthetic identity theft, even strangers can commit fraud with someone else’s data. Add to this the wealth of social media accounts, personal information online, and internet obituaries, it becomes even easier to seek out a victim who won’t be likely to speak up about the crime.

Unfortunately, this specific form of identity theft—also called “ghosting”—can take months for financial institutions to discover. It’s unthinkable that you may find out months later, just as you’re beginning to rediscover some new sense of normal without your loved one, that their name and identity has been used to commit fraud.

There are some steps you can take to protect your family if you experience this kind of terrible loss:

1. Be reserved about the obituary – Watch what details you share, such as precise birth dates, anniversaries, or relatives’ names if identifiers could be picked out. Mentioning that your grandmother’s sister never married, for example, would give identity thieves your grandmother’s maiden name. This could also spell trouble for different relatives, as they would now know your mom or dad’s mother’s maiden name.

2. Alert the Social Security Administration – Let them know that the recipient has passed away and to lock their number. This would prevent someone from filing a change of address form and changing the account number where benefits would be received.

3. Reach out to the three major credit reporting agencies – By contacting the credit reporting agencies, you can ask for a freeze to be placed on your loved one’s credit report. This should effectively prevent anyone from opening a new line of credit or making a large purchase.

4. Keep documentation secure – It’s horrible to think that someone close to you would try to take advantage of this awful situation, but it does happen. Money troubles can make people do desperate things. Be very careful if someone asks too many questions, wants to view documents, insists on accompanying you to the bank or Social Security Administration, etc.

5. Continue to monitor your loved one’s identity – There are websites where you can check to see if an SSN has been used or identifying information has been stolen. Also remember that junk mail and unshredded documents are prime sources of identity theft. If any strange bills or statements arrive in the mail, don’t disregard them without investigating them further.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.