01 — Insurance organization: a policy you can't locate is a policy that can't help during a claim
Most households carry several policies at once, homeowner's or renter's, auto, health, life, and sometimes flood, each from a different carrier with its own claims phone number and policy structure. The time pressure of an actual claim is the worst possible moment to be searching for which company covers what.
FEMA and Operation HOPE's Emergency Financial First Aid Kit treats insurance documentation as one of its four core categories precisely because a claim has a clock running: most policies set deadlines for reporting damage, and a delay caused by not knowing who to call can affect the outcome.
- For every policy, record: the carrier, the policy number, coverage type, the deductible amount, the agent's name and number, and the claims phone number specifically, which is often a different line than the sales or billing number.
- Flood insurance deserves its own line item. Standard homeowner's policies typically exclude flood damage, so a household in a flood-prone area needs to confirm whether a separate policy exists and where its documentation lives.
- Keep this list current, not just complete. A policy that lapsed eight months ago but is still on the list creates false confidence at the exact moment confidence matters least.
- Store it with the grab-and-go folder, since insurance information is exactly the kind of document needed within the first hours after a loss, not days later.
02 — Account number security: the FDIC's own guidance treats full account numbers as something to actively protect, not casually carry
A bank or credit union account number, combined with a name and address, is enough information for certain types of fraud on its own. The FDIC's consumer guidance is direct about this: be particularly careful about who receives financial account information, and never share it in response to an unsolicited request, regardless of how legitimate the request appears.
The risk isn't abstract. Identity thieves specifically watch for diverted account documentation, which is why the FDIC recommends reviewing statements promptly and contacting the bank if an expected statement doesn't arrive. A stolen account number sitting in a wallet or an unsecured note creates exactly the exposure this guidance warns against.
- Use an encrypted digital file or a sealed envelope in the fire safe, not an open list. The goal is access for the household when genuinely needed, not casual visibility.
- Record the institution name, account type, and customer service number, which is usually enough to act on an account without the full number sitting exposed.
- Never carry full account numbers in a wallet or purse. A lost or stolen wallet should not double as a financial exposure event.
- Treat any unsolicited request for account numbers as suspicious by default, whether it arrives by phone, mail, or online, since this is the FDIC's standing guidance for avoiding impostor scams that specifically target financial account information.
03 — Tax document retention: the IRS standard is three years, not the seven that often gets repeated
The Internal Revenue Service's own published guidance sets the baseline period of limitations at three years from the date a return is filed, the window during which the IRS can generally assess additional tax or a taxpayer can claim a credit or refund. Seven years applies only to one narrow situation: a claim for a loss from worthless securities or a bad debt deduction. Treating seven years as the general rule for everything is a common but inaccurate simplification.
The three-year baseline has real exceptions worth knowing, since they're the actual reason some advisors recommend holding records longer than the minimum. Most households are well served by following the specific IRS thresholds rather than defaulting to the longest number they've heard.
- Three years covers the standard case: keep returns and supporting documents (W-2s, receipts, statements supporting deductions or credits) for three years after filing.
- Six years applies if income was underreported by more than 25 percent of the gross income shown on the return, since the IRS's assessment window extends to six years in that specific situation.
- Seven years applies specifically to claims for worthless securities losses or bad debt deductions, not to tax records generally.
- Indefinitely applies if no return was filed for a given year, or if a return is found to be fraudulent. The IRS places no time limit on assessment in either case.
- Keep the filed return itself permanently, separate from supporting documents, since it's useful for preparing future returns and proves a return was actually filed if that's ever in question.
Property is different
Records connected to property, a home, a vehicle, an investment, should be kept until the period of limitations expires for the year the property is disposed of, since they establish the basis used to calculate gain or loss at sale. This can mean holding records well past three years if the property is still owned.
04 — The emergency bill list, and the myth that a bank's own records are enough
A list of monthly bills, the amount, the due date, and how each is normally paid, solves a specific problem: during a disruption, a household needs to know what's owed and how to pay it, especially if normal payment methods or income are interrupted. The related and more dangerous assumption is that bank records alone will cover this if the list doesn't exist.
The FDIC's own post-hurricane guidance to affected bank customers makes the actual risk concrete. Deposits remain federally insured even if a local branch is destroyed, but a bank's verification systems can go down regionally, meaning an ATM card stops working not because the money is gone but because the system that confirms the balance is offline. The FDIC's direct advice in that situation: keep financial records to help reconstruct accounts, because access and insurance are not the same thing.
- Build the bill list with amount, due date, and normal payment method for every recurring obligation: mortgage or rent, utilities, insurance premiums, loan payments, and subscriptions worth tracking.
- A regional disaster can knock out bank verification systems for days, not because deposits are at risk, but because the technology confirming balances and processing cards depends on infrastructure that storms and floods can disable.
- Keep recent statements and account numbers on hand specifically to help reconstruct records if a bank's own systems are temporarily inaccessible, exactly the FDIC's guidance to affected customers after a major hurricane.
- The bill list and the account security records from earlier on this page work together: one says what's owed, the other says how to access the funds to pay it.
Quick reference
- Record carrier, policy number, deductible, agent, and the specific claims phone number for every insurance policy. Confirm whether flood insurance exists separately, since standard policies usually exclude it.
- Store account numbers encrypted or sealed, never loose in a wallet. Treat any unsolicited request for account information as suspicious by default.
- Keep tax returns and supporting documents three years as the standard rule, six years if income was underreported by more than 25 percent, seven years specifically for worthless securities or bad debt claims, and indefinitely if a return was never filed or was fraudulent.
- Build an emergency bill list with amount, due date, and payment method for every recurring obligation.
- Don't rely on bank records alone. A regional disaster can take verification systems offline for days even though deposits remain insured, so keep recent statements and account numbers on hand to help reconstruct records if needed.
Primary sources
- FEMA and Operation HOPE: Emergency Financial First Aid Kit (EFFAK): the four-category checklist structure including financial and legal documentation, and the guidance to keep accessible backup copies.
- FDIC: Cybersecurity Consumer Guidance: guidance on protecting financial account information, monitoring statements for diverted documentation, and avoiding unsolicited information requests.
- IRS: How Long Should I Keep Records?: the official period-of-limitations schedule, including the three-year baseline, the six-year underreporting exception, and the seven-year worthless-securities exception.
- FDIC: Frequently Asked Questions for Bank Customers in Areas Affected by Recent Hurricanes: confirmation that bank verification systems can fail regionally during a disaster even though FDIC-insured deposits remain protected, and the guidance to keep records to help reconstruct accounts.