How to freeze your credit after a data breach

A credit freeze, also called a security freeze, blocks lenders from pulling your credit file, so a new account cannot be opened in your name. It is the strongest of the four and it is what you want after identifiers leak.

A fraud alert tells lenders to take extra steps to verify your identity before extending credit. It is lighter than a freeze, it is temporary by default, and it is useful when you want a business to see the warning without blocking legitimate applications.

A credit lock is a product some bureaus sell. Functionally it resembles a freeze, but it is a contractual feature rather than a statutory right, so what it does, whether it is free and how fast it lifts are decided by the bureau rather than by law. Placing a freeze costs you nothing, which is why it is the default advice.

Credit monitoring is none of the above. It watches your file and tells you after something appears. It detects, it does not prevent, and it is worth keeping alongside a freeze rather than instead of one.

Since a federal law took effect in September 2018, a consumer reporting agency must let you place a security freeze on your file for free, and the same law set timing rules that apply wherever you are. A freeze requested online or by phone has to be in place within one business day, and lifting one requested online or by phone has to happen within one hour. Mailed requests get three business days.

The same law made one year fraud alerts free and made it free for parents to freeze the credit files of children under 16, along with freeze rights for guardians and those acting under a power of attorney. A fraud alert only has to be placed with one of the three nationwide bureaus, and that bureau passes it to the other two. A freeze does not work that way, which is the next point.

A freeze is per bureau, so freezing one leaves the other two wide open. Place it at Equifax, Experian and TransUnion. Each will give you a PIN or password at the time you place the freeze, and that credential is what lifts it later, so store it somewhere you will still have it in a year.

Then consider the two agencies most people leave out. Innovis is a fourth nationwide consumer reporting agency, smaller than the big three and used by some lenders, and it accepts freezes too. ChexSystems is not a credit bureau at all: it reports on bank account history, and it is what a bank checks when you open a current account. A freeze at the big three does nothing to stop a fraudulent bank account being opened in your name, and a freeze at ChexSystems is what does.

If someone could file a tax return in your name, add the IRS identity protection PIN to the list. It is issued by the IRS, it is free, and it stops a fraudulent return using your tax identifier, which a credit freeze will never catch because tax filings do not go through a credit bureau.

Do this from a browser rather than from a link in an email, and expect to prove you are you with questions drawn from your own credit file.

A freeze is not permanent, and applying for credit is not closed to you while one is in place. When you apply, you lift the freeze at the bureau the lender uses, either for a set period or until you put it back. That takes minutes and it is within the one hour window the law sets for online and phone requests.

If you are shopping for a mortgage or a car loan, tell the lender in advance that the file is frozen and lift it for a short window covering that shopping period. Keep the PIN to hand for that, because bureaus will not lift a freeze without it.

A freeze stops new accounts. If something has already appeared, switch from prevention to recovery.

Dispute the account with the bureau that reported it, in writing, and dispute it with the lender directly. File a report with the Federal Trade Commission and follow the recovery plan it produces, which is built around the specific kind of identity theft you are dealing with. In many cases you will want a police report too, because lenders and insurers often ask for one before writing off a fraudulent account.

Keep everything. The dispute letters, the confirmation numbers, the reports and your own notes are the record that decides who carries the loss, and reconstructing that later is far harder than keeping it as you go.

A freeze is a response to the possibility that your identifiers are in circulation. Finding out whether they actually are is what tells you how urgent the response is, and which identifiers are involved.

Running your email address, phone number or name through an exposure lookup shows you which third party records contain them and which source each record came from. That is the difference between freezing your credit because you received a letter, and freezing it because your identifiers are demonstrably sitting in records other people can hold.