Got a data breach notice? Freeze your credit first, then work through these steps

The letter arrived, and now what?

It might be a letter in the mail with a company logo you half recognize. It might be an email from a retailer you used once in 2019. The wording is usually careful: “unauthorized access,” “certain personal information,” “out of an abundance of caution.” Somewhere near the bottom is an offer of free credit monitoring and a toll-free number.

Most people do one of two things. They ignore it, because nothing bad has happened yet. Or they spend an evening in a panic and then do nothing, because the possible steps feel endless. Neither helps. The useful response is smaller than the fear and a lot more specific.

The Federal Trade Commission’s advice starts with one idea: find out what was exposed, then match your steps to that. A stolen password is a different problem from a stolen Social Security number, and the fixes do not overlap much. This article walks through both, starting with the move that gives you the most protection for the least effort.

Read the notice for one thing: what was taken

Skip the apology paragraph and look for the list. Companies usually name the categories of data involved: names, email addresses, passwords, payment card numbers, bank account details, driver’s license numbers, health information, Social Security numbers. Write down which of those apply to you.

That list decides your priorities.

• Name and email only: mostly a phishing risk. Expect more suspicious messages and keep your guard up.
• Password or login: change it, and change it anywhere else you used the same one.
• Payment card or bank account number: call the card issuer or bank, using the number on the back of your card, and ask about a replacement or alerts.
• Social Security number, date of birth, or ID number: this is the one that can be used to open credit in your name, and it does not expire. Freeze your credit.

If the notice is vague about what was taken, say so when you call the company’s listed number or check its website. The FTC also keeps a page at IdentityTheft.gov/databreach with steps organized by the type of information exposed, which is a handy cross-check.

One more detail worth noting: where the notice came from. If you do not recognize the company, you may have been affected through a vendor, an old employer, or a service that handled your data on someone else’s behalf. That happens often. It does not make the notice fake, but it is a reason to verify it, which we cover below.

A credit freeze, in plain terms

A credit freeze, also called a security freeze, blocks creditors from viewing your credit file. Because lenders almost always check your file before approving a new account, a freeze makes it very hard for anyone, including an identity thief, to open a new loan or credit card in your name. The FTC puts it bluntly: nobody can open a new credit account in your name while it is on, you included.

Three facts make it an easy call for most people. It costs nothing to place or lift. It does not affect your credit score. And it stays in place until you remove it, so there is no renewal date to forget.

The Consumer Financial Protection Bureau notes that credit “locks” sold by some companies, sometimes for a fee, are no more effective than a freeze. If a monitoring product pushes a paid lock as the premium option, you can say no and use the free freeze instead.

A freeze is not a force field. It does not stop someone from using a stolen card number on an account you already have, and it does not clean up fraud that already happened. It targets one specific harm: new accounts opened with your identity. That harm is the expensive, slow-to-fix one, which is why it comes first.

How to place it at all three bureaus

There is no single switch. Equifax, Experian, and TransUnion each keep their own file on you, so you freeze at each one. Set aside about half an hour, a laptop, and something to store sign-in details.

1. Go to each bureau’s own website by typing its name into your browser, or use the credit bureau contact list at IdentityTheft.gov. Avoid ads and links in emails or texts.
2. Create an account or sign in. You will be asked for identifying details such as your name, address, date of birth, and Social Security number. That is normal here, because you reached the site yourself.
3. Choose the freeze option and confirm. Save the confirmation and any PIN or account login in a password manager, not a sticky note on the monitor.
4. Repeat at the other two bureaus.

According to the CFPB, a bureau must place a freeze within one business day if you ask by phone or secure online channels, or within three business days if you mail the request. Written confirmation should follow within five business days with instructions for removing it. If you do not see confirmation, follow up.

Check that all three are done. Freezing two and forgetting the third leaves a gap, since lenders do not all use the same bureau.

Lifting a freeze, and the lighter fraud alert

The common worry is getting locked out of your own life. Freezes are less rigid than that. You can lift one temporarily, for a period you choose, or remove it entirely, at no charge.

The CFPB says a bureau must lift a freeze within one hour when you ask by phone or through a secure online request, or within three business days if you mail the request. In practice, that means you can apply for a car loan, a mortgage, or a new card in the same afternoon.

The FTC offers a neat shortcut. Ask the lender which bureau it will check, lift the freeze only at that one, and refreeze when the application is done. Not every lender will tell you in advance, so if they will not, lift all three for a short window.

A worked example. Say you plan to finance a car on Saturday. On Friday evening you sign in to the bureau the dealer says it uses and set a temporary lift through Sunday. The dealer pulls your file, the loan goes through, and on Sunday night you confirm the freeze is back. Total cost: about ten minutes and nothing in fees.

A couple of things to know about who can still see your file. Companies you already have accounts with can look. So can certain government agencies, such as child support enforcement, and companies you hired to monitor your credit. You can also always pull your own reports. The CFPB also notes that the free-freeze rules do not cover requests tied to employment, tenant screening, or insurance, so check how a given employer or landlord handles it if a freeze seems to be in the way.

A fraud alert is a flag on your file that tells businesses to verify your identity before opening new credit. Unlike a freeze, it does not block access to your report. It asks lenders to take an extra step.

The details, per the FTC:

• An initial fraud alert lasts one year and can be renewed. You place it with one bureau, and that bureau must tell the other two.
• An extended alert lasts seven years but requires you to be an identity theft victim with an FTC identity theft report or a police report.
• Active-duty servicemembers can place a special alert tied to deployment.

Both the FTC and the CFPB treat a freeze as the stronger protection. A fraud alert is a reasonable add-on, or a short-term stand-in if you are about to apply for credit and do not want to juggle lifting and refreezing. Many people who have been told their Social Security number leaked simply freeze, and add an alert if they have actual signs of misuse.

Check the damage that may already exist

A freeze guards the future. Your credit reports tell you about the past. You can get free reports from Equifax, Experian, and TransUnion through AnnualCreditReport.com, and the CFPB says you can view them online for free once a week.

Open them with a short list in hand: accounts you do not recognize, inquiries from lenders you never contacted, addresses you never lived at, and collections you cannot explain. Any of those can be an early sign of identity theft. If you want a method, our guide to reading your credit report one account at a time breaks it down.

If something looks wrong, go to IdentityTheft.gov. The FTC site builds a personal recovery plan, with pre-filled letters and forms to send to the credit bureaus, businesses, and debt collectors. You can also call 1-877-438-4338. A report from there is also the document that supports an extended fraud alert.

Be careful where you get the reports. The CFPB warns that some sites advertising “free” credit reports are really selling other products or subscriptions you will need to cancel. AnnualCreditReport.com is the one the agency points to.

Other signs of trouble have nothing to do with credit files: a bill that stops arriving, which can mean someone changed your billing address, bank withdrawals you did not make, or a surprise bill. Watch your statements for a few months after a breach, not just a few days.

If a password was exposed

Many breach notices involve only an email address and a password. They look minor, and they are not. The FTC points out that people reuse passwords, and an old password from a forgotten account can unlock a bank or email login that uses the same one.

The fix is a short sequence.

1. Change the password on the breached account right away.
2. Change the password on any other account that used the same or a similar one. Start with your main email, because password reset links for nearly everything else land there. The FTC calls email a common weak point for exactly that reason.
3. Move toward a unique password for each account. A password manager does the remembering for you.
4. Turn on multi-factor authentication wherever it is offered, so a stolen password alone is not enough.

If you are ready to go a step further, passkeys remove the password from the equation for supported accounts. We explain how in what changes when you sign in with a passkey. And if a breach means you could lose access to an account you need, have a fallback ready with the steps in our account recovery plan.

Beware the breach notice that is the scam

Breach news is perfect cover for fraud. The message looks urgent, mentions your data, and asks you to “verify” something. The FTC has warned about emails claiming your personal information is for sale on the dark web, and says such messages are likely phishing meant to extract even more information from you.

Signs to watch for, based on the FTC’s phishing guidance: unexpected emails or texts that claim a log-in attempt or account problem, a generic greeting, a request to confirm personal or financial details, and a link to update or pay. A legitimate company will not text or email a link to update your payment information.

Here is the safe routine:

• Do not click links or call numbers in the message.
• Go to the company’s website by typing the address yourself, or call the number on your card, statement, or the company’s official site.
• If a notice offers free credit monitoring, find the offer through the company’s own website and enroll there, not through a link in a message you did not expect.
• Never give your Social Security number to someone who contacted you first. The FTC notes that real agencies, banks, and employers do not ask for it by phone, email, or text.
• Report the message. Forward phishing emails to reportphishing@apwg.org and phishing texts to 7726 (SPAM), and file a report at ReportFraud.ftc.gov.

If you want a general method for any message that makes you feel rushed, our guide on verifying before you click works well here.

If you already clicked or typed something in, do not spiral. The FTC suggests updating your security software and running a scan if you clicked, and following the steps at IdentityTheft.gov for whatever information you shared.

Close the other door: the tax return

A stolen Social Security number can also be used to file a fake tax return in your name, collecting a refund before you file. The IRS offers a defense called an Identity Protection PIN, a six-digit number that must be entered when a return is filed. Anyone with a Social Security number or taxpayer identification number who can verify their identity can sign up.

The fastest route is through your IRS online account. The PIN changes every calendar year, and online enrollees must retrieve the new one from their account, because the IRS does not mail a notice. If you cannot use the online route, the IRS lists alternatives, including a form for people under certain income limits and an in-person visit, but those take longer: the form route, for example, usually means four to six weeks for the PIN to arrive by mail.

A missing or wrong PIN will cause an e-filed return to be rejected, so keep it where you can find it come filing season. And guard it. The IRS says it never asks for your PIN, so any call, email, or text demanding it is a scam.

Do this before the busy part of tax season. Setting it up in the fall is less stressful than discovering in February that someone filed first.

A one-evening checklist, and what to skip

If you want it all in one place, here is a plan you can finish in an evening, in priority order.

1. Read the notice and write down what was exposed.
2. If a Social Security number or similar ID was involved, freeze your credit at Equifax, Experian, and TransUnion. Save confirmations.
3. Pull your free credit reports at AnnualCreditReport.com and scan for anything unfamiliar.
4. Change the breached password, then your main email password, then any reused ones. Turn on multi-factor authentication.
5. Call your bank or card issuer if account or card numbers were involved, using the number on the card.
6. Consider an IRS Identity Protection PIN.
7. Set a reminder to review statements and credit reports again in a few weeks, then every few months.

What you can skip: paid “lock” products you do not need, any service that contacts you first to sell protection, and any message that asks you to verify details. If the company offers free credit monitoring, take it if you like. It can alert you to new activity, but it does not replace a freeze.

Children’s files matter too. The FTC says freezes for children under 16 are free, and a parent or guardian can request them, though the process differs from adult freezes, so look at each bureau’s instructions. If a breach notice names your child, treat it the same way.

One last point. A breach notice is not proof that someone has stolen your identity. It means your data was in the wrong place. A freeze and a few tidy habits turn that from a worry into a handled problem.