“I’m a victim of identity theft,” writes Richard Glass, 65, of Fresno, who retired last December from his job selling elementary school textbooks.

A crook took out an American Express card in his name. By the time he found out, Amex had sued the phony “Richard Glass” at a phony New York City address, and won a court judgment.

Amex then tracked down the real Richard Glass’ Merrill Lynch retirement account and froze $14,157 of his funds.

Glass knew that his name had been fraudulently used, back in 1996, and thought he had protected himself. You need to know what went wrong, because you and I could be in this pickle, too.

Ironically, Amex itself spotted the original fraud. It notified Glass that someone had applied for a card in his name, from a suspect New York address.

After the thief tried twice more, Amex suggested that Glass choose a password for use with his card. But he found that impractical, and let his card expire.

Amex also suggested that he attach a fraud alert to his credit report. That tells creditors and card issuers to check with you personally, if they get a credit application in your name.

Glass called one of the three major credit bureaus, Experian (formerly TRW), believing that, if you notify one, you notify them all. After that, “I didn’t think anything more about it,” he told my associate, Dori Perrucci.

Big mistake. In 1998, thieves struck at his Amex account again, and got three cards (the debt on the other two is in collection).

This case raises several questions:

First question: How come Amex gave the phony Glass new cards when it knew the account had already been attacked?

“After a first try, criminals often come back a year or two later,” says Steve Reger, manager of the fraud victim assistance department for the credit bureau Trans Union.

Amex spokeswoman Judy Tenzer can’t or won’t explain it, except to say that the thief provided the personal information needed for receiving a card.

A card issuer usually checks all the prior information on the account when a credit card is reissued, says Elias Levy of SecurityFocus.com, a computer security firm in San Mateo. For whatever reason, Amex didn’t.

In most cases, canceled cards can be reactivated, as Glass’ was. It’s possible to cancel in such a way that your data vanishes from the creditor’s files, so your account can’t be reopened. But you have to be firm, and get it in writing.

What’s more, canceling one credit card account doesn’t stop a thief from opening a new account through another issuer. To stop that, put a fraud alert on your credit file. Credit bureaus maintain fraud alerts for 90 days to seven years (be sure you check the rules).

Which leads me to the second question: Why didn’t Glass’ call to Experian, to set up a fraud alert, prevent the subsequent theft? Two reasons: He called only Experian. You have to notify all three major credit bureaus (call Experian at 800-301-7195, Equifax at 800-525-6285 and Trans Union at 800-680-7289).

Then Experian fouled up. When Glass finally asked for a copy of his credit history, he found the fraud alert on his wife’s file, not his.

The third question: How come Glass handled the initial problem by phone, with no follow-up? “I took it for granted that everything was under control,” he says, regretfully.

If you suspect fraud, you should ask the credit bureaus, in writing, to put on a fraud alert. Then get copies of your credit report to see if the bureaus followed through. Also, call your creditor and file a police report.

Even if you don’t suspect fraud, check your credit report annually, to be sure that a crook isn’t already in your pocket.

Some other tips, from Beth Grossman of the Federal Trade Commission (you’ll find even more at consumer.gov/idtheft):

Passwords should be obscure (crooks can get your mother’s maiden name, a common identifier). Shred financial information before throwing it away, including pre-approved credit offers.

Glass says that no one at Amex would explain how his anguished complaint would be handled. Two weeks after I called Amex, he learned that he had been cleared. His Merrill Lynch account is still frozen, however. Amex won’t say how much longer he might have to wait.

Syndicated columnist Jane Bryant Quinn can be reached in care of the Washington Post Writers Group, 1150 15th St., Washington D.C. 20071-9200.