If your Social Security number or other identity information was exposed, freeze your credit with Equifax, Experian, and TransUnion, then review your reports for unfamiliar activity. A freeze is a free preventive barrier against many new-account applications. Monitoring and report review are detection tools; they do not prevent fraud or repair an account after it appears. Add a fraud alert when you want lenders to verify your identity, especially if you have evidence of identity theft.
Start by identifying what was exposed
The right first move depends on the data involved. Read the breach, loss, or theft notice closely and write down the information it names, the date of the incident, and any monitoring offer. The FTC’s breach checklist asks, What information was lost or exposed? Treat that answer as a decision point rather than assuming every incident requires the same response.
As an Amazon Associate I earn from qualifying purchases.
If a Social Security number was exposed
The FTC’s breach guidance recommends considering a credit freeze and checking your credit reports when an SSN is exposed. A freeze is the strongest free step for preventing many new-credit accounts from being opened in your name. Place it separately at all three nationwide bureaus; freezing one report does not freeze the other two.
If passwords or online credentials were exposed
Change the affected password immediately, then change every other account that reused it. Use a new password for each service and turn on multifactor authentication where available. A credit freeze will not secure an email, shopping, banking, or social-media login.
#1 Best Overall
If account numbers, medical information, or tax information were exposed
Contact the affected organization through a verified channel and ask what account-protection steps it offers. Watch the relevant account statements and records. Credit freezes and credit-report monitoring do not stop misuse of an existing bank account, medical identity, or tax identity.
Freeze, fraud alert, or monitoring: what each one does
These tools solve different problems. The CFPB describes the purpose of a freeze this way: A credit or security freeze prevents prospective creditors from accessing your credit file.
Monitoring helps you notice activity; a fraud alert asks creditors to take extra identity-verification steps.
| Option | What it does | Setup and duration | Important limits |
|---|---|---|---|
| Security freeze | Restricts prospective creditors from accessing a credit file, making many new-account applications harder for an impostor. | Free. Contact Equifax, Experian, and TransUnion separately. It remains until you temporarily lift or permanently remove it. | It does not change credit scores. It does not stop misuse of existing accounts, tax or medical identity theft, or every kind of report access. |
| Initial fraud alert | Signals creditors to verify your identity before certain credit is issued. | Free. Request it from one nationwide bureau; that bureau must notify the other two. It lasts up to one year. | It does not block access to your file like a freeze. |
| Extended fraud alert | Provides longer identity-verification protections after identity theft. | Lasts seven years. You must have an FTC Identity Theft Report and meet the documentation requirements. | Use it when identity theft has occurred, not simply because a company reported a possible breach. |
| Credit monitoring and report review | Helps you detect new accounts, inquiries, balances, or other unfamiliar information. | IdentityTheft.gov says free weekly report checks are available through AnnualCreditReport.com. A responsible organization may also offer free breach-related monitoring. | Detection does not prevent a new account and does not remove fraudulent information by itself. |
Paid credit locks are not more effective than the statutory free freezes, according to CFPB guidance. Do not pay for a lock merely because it uses different branding or is bundled with another service.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to place a free freeze at all three bureaus
Anyone can place a freeze, and the process is free. Use each bureau’s official website or its current telephone or mail contact route. The FTC’s official Credit Bureau Contact Information page is the safest place to verify the current routes because addresses and website flows can change.
- Gather your information. Have your name, current and previous addresses, date of birth, and identifying information available. Each bureau may ask verification questions and may issue a personal identification number, password, or account login for future changes.
- Submit the request to Equifax. Follow the bureau’s current security-freeze instructions and save the confirmation, reference number, and any credentials it gives you.
- Submit a separate request to Experian. A request at Equifax does not automatically freeze Experian’s file.
- Submit a separate request to TransUnion. Confirm that the request is for a free security freeze, not an optional paid lock.
- Check each confirmation. Keep the dates, confirmation numbers, PINs, and instructions for lifting the freeze in a secure record. If a bureau cannot verify you online, use the alternative telephone or mail process it provides.
The CFPB says a bureau must place a freeze within one business day after receiving a request by telephone or secure electronic means. A request sent by mail must be placed within three business days after the bureau receives it. After placing the freeze, the bureau must send written confirmation within five business days. Those deadlines come from CFPB consumer guidance last reviewed September 5, 2025.
What a freeze changes
Most lenders cannot complete a new-credit decision while the relevant file is blocked. A freeze does not affect your credit score, existing credit lines, or your ability to use accounts you already have. It also does not prevent every legitimate use of a report. CFPB guidance notes exceptions that can include employment, tenant-screening, and insurance purposes.
What a freeze cannot stop
- Someone using an existing credit-card or bank account that is already open.
- Tax-return fraud, medical identity theft, benefits fraud, or account-takeover attacks that do not require a new credit file inquiry.
- Every type of creditor or report access covered by legal exceptions.
- Errors or fraudulent accounts that are already present on a report. Those require a dispute or identity-theft blocking request.
How to lift a freeze when you need credit
A freeze can also block you from obtaining a new card, loan, apartment, or service when the provider needs to check your file. Plan the lift before submitting an application and ask the provider which bureau it will use and when it will pull the report.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Temporary lift
Ask the relevant bureau to lift the freeze for a period you specify or for the creditor’s access window. You can request a temporary lift rather than removing the freeze permanently. If you are applying to several lenders, ask whether they use different bureaus and lift only the reports required for the applications.
Under CFPB guidance last reviewed September 5, 2025, a bureau has up to one hour to remove a freeze after a toll-free telephone or secure electronic request. A mailed request can take up to three business days. Do not wait until the lender’s application page is open if the lender needs an immediate response.
Permanent removal
Permanent removal ends the freeze. Use it only when you no longer want the protection. If you remove a freeze, consider replacing it after the application is complete rather than leaving the file open indefinitely.
When a fraud alert is the better choice
A fraud alert leaves your file accessible but tells potential creditors to take reasonable steps to verify that the applicant is really you. It can be useful when you suspect an attempt to open credit but still need ordinary access to your reports.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInitial alert: up to one year
Request an initial alert from any one of Equifax, Experian, or TransUnion. That bureau must notify the other two, so you do not need to file three separate alert requests. The alert lasts up to one year. You can request another alert if the risk continues.
Extended alert: seven years
An extended alert lasts seven years and is intended for people who have experienced identity theft. You need an FTC Identity Theft Report and must provide the documentation requested by the bureau. Potential creditors must contact you before issuing credit under the extended-alert process. If you only received a general breach notice and have no evidence of identity theft, an extended alert may not be available; a freeze and report review remain appropriate protective steps.
How to monitor your credit effectively
Use the official weekly report access
IdentityTheft.gov says consumers can check their reports weekly for free through AnnualCreditReport.com. Use the official site rather than a look-alike service, and save a copy or note the date of each review. Weekly checks are especially useful during the first months after an exposure, when an impostor may try several applications.
Look for more than unfamiliar accounts
- New credit cards, loans, or collection accounts you did not open.
- Hard inquiries from businesses you did not contact.
- Changed addresses, phone numbers, employers, or other personal details.
- Unexpected balances, payment histories, or accounts shown as closed.
- Duplicate information or an account that belongs to another person with a similar name.
Compare all three reports because an account or inquiry may appear on one report before the others. Monitoring services can send alerts, but read the underlying report yourself before treating an alert as proof of fraud.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAccept free breach-related monitoring when it is offered
The FTC’s data-breach guidance advises taking up free monitoring offered by the organization responsible for the exposure. Use it as an additional detection channel, not as a substitute for a freeze, fraud alert, password changes, or disputes. Check the offer’s enrollment deadline, coverage period, and the types of reports it actually watches before relying on it.
A practical response sequence after an exposure
Use this order when you are unsure what to do first:
- Read the notice and classify the data. Record whether the exposure involved an SSN, passwords, financial account numbers, medical data, tax information, or other identifiers.
- Secure accounts whose credentials were exposed. Change affected and reused passwords, enable multifactor authentication, and contact the provider through a verified channel.
- Freeze all three credit files if new-credit risk is material. This is especially important after SSN exposure or suspected attempts to open accounts.
- Choose an alert if you need a verification warning. Use an initial alert for up to one year; use an extended alert only after identity theft and an FTC Identity Theft Report.
- Review reports and statements. Check weekly through AnnualCreditReport.com and inspect bank, card, medical, and other affected accounts separately.
- Keep a case file. Save the breach notice, bureau confirmations, report copies, dates, phone numbers, letters, and names or reference numbers for every contact.
- Escalate immediately if you find unknown activity. Follow the recovery process below rather than waiting for a monitoring alert to resolve it.
What to do when you find an account or transaction you do not recognize
1. Contact the business involved
Call the card issuer, lender, collection agency, bank, healthcare provider, or other business shown on the record. Use a phone number from its official statement or website, not a number supplied in a suspicious message. Tell the business that the account or transaction resulted from identity theft, ask it to close or secure the account, and request written confirmation of the investigation and any balance adjustment.
2. Report the identity theft to the FTC
File a report at IdentityTheft.gov. The report creates a recovery plan and an FTC Identity Theft Report that may be required for an extended fraud alert or for certain blocking requests. Include the affected businesses, dates, account numbers, and the evidence you have.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →3. Dispute inaccurate information with the bureaus and the business
Dispute each fraudulent item with every bureau that displays it and with the company that supplied the information. Explain that the item resulted from identity theft and include the documents requested by the bureau, such as identification, proof of address, the FTC report, and a description of the fraudulent account or transaction. Keep copies and send mail with tracking when the instructions call for a written dispute.
4. Request a block under the identity-theft process
Consumers can ask a credit bureau to block information that resulted from identity theft under Fair Credit Reporting Act section 605B. The FTC’s sample Identity Theft Letter to a Credit Bureau lists the typical documentation to include. Its sample letter states a four-business-day period for the requested block; follow the bureau’s current instructions and count the period from a complete request with the required documents.
5. Protect related accounts and watch for retaliation
Change credentials, replace compromised cards, close fraudulent accounts, and monitor statements after the first correction. An impostor may reuse the same information in a different channel, so continue checking reports and affected accounts even after one item is removed.
Timelines you should know
| Action | Time period | Source and qualification |
|---|---|---|
| Initial fraud alert | Up to one year | FTC and IdentityTheft.gov consumer guidance. |
| Extended fraud alert | Seven years | Available after identity theft with an FTC Identity Theft Report and required documentation. |
| Freeze placement after telephone or secure electronic request | Within one business day | CFPB guidance last reviewed September 5, 2025. |
| Freeze placement after mailed request | Within three business days of receipt | CFPB guidance last reviewed September 5, 2025. |
| Written confirmation after a freeze is placed | Within five business days | CFPB guidance last reviewed September 5, 2025. |
| Freeze removal after toll-free telephone or secure electronic request | Within one hour | CFPB guidance last reviewed September 5, 2025. |
| Freeze removal after a mailed request | Within three business days | CFPB guidance last reviewed September 5, 2025. |
| Identity-theft information block in the FTC sample letter | Four business days | FTC sample letter under FCRA section 605B; the page’s publication date is not stated. Submit a complete request and follow the bureau’s current instructions. |
Common mistakes to avoid
- Freezing only one bureau. A thief may apply to a creditor that checks either of the other two.
- Assuming monitoring is prevention. An alert can arrive after an account has already been opened; it cannot stop the application.
- Paying for a credit lock without comparing it with a freeze. CFPB guidance says paid locks are no more effective than free statutory freezes.
- Leaving a freeze in place without planning a lift. It can delay a legitimate application until the bureau processes your request.
- Ignoring existing accounts. A freeze does not stop unauthorized charges on an account that is already open.
- Using contact details from a suspicious message. Verify bureau and business contact routes through official pages.
- Discarding records after the first dispute. Keep confirmations and correspondence until every item is corrected and no further activity appears.
A simple decision guide
| Your situation | Best starting action | Add these steps |
|---|---|---|
| SSN exposed, no suspicious activity yet | Freeze all three nationwide credit files. | Check reports weekly and accept any legitimate free breach-monitoring offer. |
| Possible attempt to open credit, but you need files accessible | Place an initial fraud alert through one bureau. | Review all reports and consider a freeze if the risk increases. |
| Confirmed identity theft | Freeze all three files and file an FTC Identity Theft Report. | Request an extended alert if eligible, then dispute and block fraudulent information. |
| Password exposure without credit-file evidence | Change passwords and secure the affected accounts. | Review reports if an SSN or account identifier was also exposed. |
| Unknown account or inquiry on a report | Contact the business and begin the FTC recovery process. | Dispute with each reporting bureau and request an identity-theft block with documentation. |
Keep the protection matched to the risk
For a U.S. consumer whose SSN or similar identity information has been exposed, the practical combination is a free freeze at Equifax, Experian, and TransUnion plus regular report review. Add a fraud alert when you need creditors to verify you, and use an extended alert only with documented identity theft. Continue securing passwords, watching existing accounts, and disputing fraudulent entries because no credit-file tool covers every form of identity theft.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
