A data breach letter can make every next step feel equally urgent. The first decision is usually simpler than it looks: a credit freeze is the stronger default when sensitive information may be exposed, while a fraud alert adds an extra identity-check step for lenders.
The Federal Trade Commission says a credit freeze can be placed for free, lasts until you lift it, and can be used even if your identity has not been stolen. A fraud alert is also free, but it works differently: lenders can still see your credit report, but they must take steps to verify your identity before granting new credit.
The right answer depends on what was exposed, whether you plan to apply for credit soon, and whether there is already evidence that someone misused your information. Use the breach notice as a checklist, not as a reason to panic.
The Short Answer
Freeze your credit at Equifax, Experian, and TransUnion if your Social Security number, date of birth, address, driver information, financial account details, or other identity data may have been exposed. Add an initial fraud alert if you are affected by identity theft or suspect you might be, especially while you are still sorting out the breach notice.
A freeze is more restrictive. It prevents creditors from accessing your credit file for most new-account decisions, which usually stops both fraudulent and legitimate new credit from being approved until you lift the freeze. A fraud alert is lighter. It tells creditors to verify that the applicant is really you before opening a new account, increasing a credit limit, or issuing an additional card.
Do This First
Read the notice closely. Look for the exact data types involved, the date range, whether Social Security numbers were included, and whether the company is offering identity monitoring. Save the notice because it can help if you need to dispute an account or document identity-theft recovery steps later.
Freeze all three major credit reports. A freeze at one bureau does not automatically freeze the other two. USAGov and the CFPB both direct consumers to contact Equifax, Experian, and TransUnion separately. Online or phone freeze requests are generally faster than mail requests.
Decide whether to add a fraud alert. For an initial fraud alert, the FTC says you only need to contact one of the three bureaus; that bureau must tell the other two. Initial fraud alerts last one year and can be renewed. Extended fraud alerts are for people who have an identity theft report or police report and last seven years.
Check your credit reports. AnnualCreditReport.com is the official site for free credit reports from the three nationwide credit reporting companies. Look for unfamiliar accounts, addresses, hard inquiries, or collection items. Checking your own report does not hurt your credit score.
Check These Details
A freeze does not lock every possible use of your information. Existing creditors, certain government entities, and companies you have hired to monitor your credit may still be able to access your file. A freeze also does not stop account takeover, tax identity theft, medical identity theft, or misuse of a driver license number outside the credit system.
The CFPB notes that credit locks are different from security freezes. Locks are often sold or bundled with paid services, while a security freeze is free and protected by law. If you are choosing between the two, the free security freeze is the baseline protection to understand first.
If you will soon apply for a mortgage, car loan, apartment, new credit card, insurance policy, or some jobs, plan how you will lift the freeze. You may be able to lift it temporarily for a set period or for the bureau a lender uses. Put the freeze back after the check is done.
Common Mistakes
Do not assume credit monitoring is the same as a freeze. Monitoring can alert you after activity appears; a freeze can block many new-account checks before they happen. Free monitoring offered after a breach can still be useful, but it should not replace a freeze when highly sensitive data was exposed.
Do not click links in an unexpected email or text claiming to be your breach notice. Go directly to the company site, the credit bureau sites, AnnualCreditReport.com, or IdentityTheft.gov. Breach news often attracts copycat phishing messages that try to collect the same personal information you are trying to protect.
Do not forget children or dependent adults. The FTC says parents or guardians can request a free freeze for a child under 16, and the CFPB describes protections for certain protected consumers, including incapacitated people or people with a guardian.
When To Get Help
If someone has already opened an account, filed a tax return, used your identity with police, or made purchases in your name, move from prevention to recovery. Report identity theft at IdentityTheft.gov, which creates a recovery plan and an FTC identity theft report that can support disputes and extended fraud-alert requests.
If nothing has been misused yet, a freeze, a fraud alert when appropriate, regular report checks, and stronger account security are usually enough to reduce the biggest new-credit risk. Keep records of the dates you placed freezes or alerts, where you saved recovery keys or PINs, and when you plan to review your reports again.
