Recommended Free Tools
Start with the organization named in the breach notice: confirm the notice through a website or phone number you already know is genuine, then check which information it says was affected and follow its response instructions. An email lookup or credit check can add useful clues, but no single check can establish that every kind of your personal data is—or is not—exposed.
Start with the organization’s breach notice
If you received a notice, use it to identify the organization and the incident, and read its explanation of which data may have been involved. Do not click an unexpected link or call a number in a message you are unsure about. Instead, contact the organization through a known official website or phone number and verify the notice there. The Federal Trade Commission (FTC) recommends using IdentityTheft.gov/databreach for advice tailored to the information exposed.
As an Amazon Associate I earn from qualifying purchases.
Check whether the notice offers specific protective steps or free monitoring, and note any instructions or deadlines. A notice is evidence about that organization’s incident; it is not a complete check of all your accounts or all possible exposures.
Choose a check that answers the question you have
| Check | What it can show | What it cannot establish |
|---|---|---|
| Organization’s notice and verified official channel | Which organization reports an incident and the categories of information it says may have been affected. | Whether your information was exposed in unrelated incidents. Verify the notice through a known channel and follow its response guidance. |
| Have I Been Pwned email lookup | Whether an email address appears in breach records loaded into the service, and details about listed matches. Have I Been Pwned describes its results in terms of the breaches in its dataset. | A clean result does not prove that no breach occurred. The lookup is email-focused; it is not a comprehensive search of every breach or every type of personal information. |
| Credit reports and bank or card statements | Unfamiliar credit accounts or transactions that may signal misuse. The FTC recommends checking credit reports and monitoring account statements. | These checks can reveal signs of misuse, but do not identify every incident in which information was exposed. |
Use the check that matches your concern: the organization’s notice for incident-specific information, an email lookup for listed email-related breach records, and account or credit records for possible misuse. None alone proves that all of your data is exposed or safe.
#1 Best Overall
Using an email lookup safely
Enter only the email address needed for the lookup; do not submit a Social Security number or password to an unverified breach-checking site. If Have I Been Pwned finds a match, review the listed breach details and act on any affected credentials. If it finds no match, treat that only as no match in the records loaded into that service—not as confirmation that you were never affected.
Respond according to the information involved
Email address, username, or password
- Change the password for the affected account, and change it anywhere else you reused it.
- Use a different, unique password for each account. The FTC suggests considering a password manager to generate and store unique passwords.
- Turn on multifactor authentication (MFA). Where the account supports them, an authenticator app or security key is stronger than common text-message or email codes, according to FTC guidance. Compatibility depends on the account and device.
Use the service provider’s official account-recovery instructions if you see signs of account takeover or cannot sign in. Secure the account, review its recent activity and recovery details, and change any reused credentials.
Payment-card or bank information
Contact the bank or card issuer using a known official channel. Ask how to secure or replace the affected payment method, and review statements for unauthorized transactions. A credit freeze does not stop fraudulent charges on an existing card or bank account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Social Security number or information that could be used to open credit
Consider placing a free credit freeze with Equifax, Experian, and TransUnion. The FTC says a freeze restricts prospective creditors’ access to your credit report, generally helping prevent new credit from being opened while the freeze is active. It does not affect your credit score and remains in place until you lift it.
If you suspect someone has used your identity, report it at IdentityTheft.gov and follow the personalized recovery guidance. Review credit reports for accounts you do not recognize.
Any evidence of identity theft
Report suspected identity theft at IdentityTheft.gov. The FTC directs people to use the resulting recovery guidance, which is tailored to their situation. Continue checking relevant account activity while you work through the recommended steps.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Credit freeze or fraud alert: which should you choose?
Both options are free, but they work differently. Choose based on how much restriction you want on access to your credit report and how you plan to apply for credit.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Option | How it works | Duration and setup |
|---|---|---|
| Credit freeze | Restricts prospective creditors’ access to your credit report and generally prevents new credit from being opened while active. It does not block misuse of existing bank or card accounts. | Lasts until you lift it. Contact all three nationwide credit bureaus: Equifax, Experian, and TransUnion. |
| Initial fraud alert | Asks businesses to verify your identity before granting new credit; it does not block access to your credit report. | Lasts one year. You can place it through one bureau, which notifies the other two. |
The FTC’s credit-freeze guidance, updated in August 2025, says freezes last until lifted and initial fraud alerts last one year. If you choose a freeze, remember to lift it when you need creditors to access your report.
Keep watching for misuse—and check offers carefully
- Review bank and card statements for transactions you do not recognize.
- Check credit reports for unfamiliar accounts if credit-related information may have been exposed.
- Use any free monitoring offered by the breached organization if it is relevant to the exposed information. The FTC advises asking questions before signing up for paid monitoring.
- Do not assume monitoring can remove exposed information from the internet or prevent every kind of fraud.
This guidance reflects U.S. federal consumer advice. If you live elsewhere, use the relevant organization’s verified notice and your country’s official identity-theft or consumer-protection channels.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
