Protecting your money and identity: freezes, alerts and government accounts
Freeze your credit at all three bureaus, turn on bank and card alerts, read one free credit report, and choose which government protections to add.
Start here Essentials
At minimum, freeze your credit at the three bureaus, turn on alerts for your main bank account, and read one free credit report. The tax, Social Security, Medicare and mail protections are marked Go deeper and can wait.
- Freeze your credit at Equifax, Experian and TransUnion, online or by phone (how to place a freeze).
- Write on the money sheet where each bureau account's sign-in is kept: the place, such as your password manager or your password book, not the password (money sheet, freezes).
- Turn on transaction alerts in your bank's and card company's app or website (turning on alerts).
- Get one free credit report at AnnualCreditReport.com and read the list of accounts on it (reading a report).
- Mark each one done on the money sheet, with the date (money sheet, alerts).
Minimum time: about 60 minutes, most of it creating the three bureau accounts. Done when: the money sheet shows three freezes with dates and alerts on for the main bank account.
1. What a thief can do with your name Understand
The chapters on passwords and two-step sign-in protect the accounts you sign in to. This chapter protects something you do not sign in to: your name, your Social Security number and your credit history. A thief who has those details can try to open new accounts as you, file a tax return as you, change where your benefits are paid, or spend from an account you already have. Each of those has its own protection, run by a different organization. No single setting covers them all.
A credit report is the record a credit bureau keeps of your loans, cards and payment history. A credit bureau (the CFPB calls them nationwide credit reporting companies) is a company that collects that record and sells access to it to lenders. There are three nationwide bureaus: Equifax, Experian and TransUnion. A lender checks one or more of them before it opens a new account in your name (CFPB, What is a credit freeze or security freeze, last reviewed September 5, 2025).
The table matches each protection to what it stops. The essentials are the first three rows. The rest depend on what you have: a tax return, Social Security benefits, Medicare, a mailbox.
| Protection | What it stops or shows | What it does not do | Who runs it |
|---|---|---|---|
| Credit freeze | Blocks most new credit opened in your name | Does nothing about an account you already have | Each of the three bureaus, separately |
| Bank and card alerts | Tells you quickly when money moves on an account you already have | Does not stop the payment; it tells you about it | Your bank, credit union or card company |
| Free credit report | Shows the accounts and recent checks on your file, so you can spot one you did not open | Does not block anything | The three bureaus, through AnnualCreditReport.com |
| IRS Identity Protection PIN | Stops someone else filing a tax return with your Social Security number | Does not protect your bank or credit | The IRS |
| my Social Security account, or an account block | Keeps a thief from opening your online account first, or blocks online changes | Does not affect your credit | Social Security |
| Reading Medicare statements | Shows care billed in your name that you did not get | Does not block a claim | Medicare, with your state's Medicare fraud help line |
| ChexSystems freeze | Blocks most new checking and savings accounts in your name | Does not touch the three credit bureaus | ChexSystems |
| Informed Delivery | Shows pictures of the letter mail coming to your address | Does not stop mail theft | The U.S. Postal Service |
| Trusted contact | Gives a brokerage or bank someone to call if it cannot reach you or suspects exploitation | Gives that person no power over your account | Your brokerage, bank or credit union |
The order on this page is this manual's: the freeze first, because it covers new credit at every lender at once; then alerts, because they cover the accounts you already have; then the report, because it shows whether anything got through before the freeze. The rest are options, and you can choose or skip each one. Our convention
None of these protections asks you to give a code, PIN or Social Security number to someone who calls you. Every one of them is something you set up yourself, from a site you typed in or a number you looked up. If a caller offers to freeze your credit for you, or says your Social Security number is "suspended," hang up. Recognizing scams covers those calls.
2. Credit freezes
A credit freeze (the bureaus and the law also call it a security freeze) stops a bureau from releasing your credit report to a new lender. Because most lenders will not open an account without seeing a report, a freeze blocks most new credit in your name, including credit a thief tries to open. The CFPB says a freeze "prevents you or others from opening accounts in your name" while it is in place. Your current creditors, certain government agencies and companies you hired to monitor your file can still see it, and you can still get your own reports (CFPB, What is a credit freeze).
What a freeze costs and what it changes
Four facts, each from two or more sources:
- It is free. The FTC says there is "no cost to place or lift a credit freeze" (FTC, Credit Freezes and Fraud Alerts, August 2025). The CFPB says free freezes are a right under federal law, and each bureau's freeze page says the same about its own freeze.
- It does not change your credit score. The FTC and the CFPB both say so, and TransUnion's freeze page says the same.
- It lasts until you lift it. There is no renewal date (FTC).
- It is placed one bureau at a time. A freeze at Equifax does nothing at Experian or TransUnion. The FTC says to contact all three, and the CFPB says you contact each one separately.
The law also sets how fast the bureaus act. The CFPB says a bureau must place a freeze within one business day of a request made online or by phone, and within three business days of a request by mail. A lift requested online or by phone takes effect within one hour; by mail, within three business days. You can also lift a freeze for a set period, and that lift is free too. The bureau sends written confirmation within five business days of placing the freeze. These are the maximums the law allows; Experian says its online freeze works "in real time," and TransUnion says an online or phone freeze typically takes effect almost immediately. Product-specific
The CFPB also notes what the free-freeze law does not cover: a report pulled for employment, tenant screening or insurance. A freeze is about credit.
Lifting a freeze when you apply for credit
When you apply for a loan, a card, a phone plan on credit or an apartment, the company may need to see your report. The FTC's advice: ask the company which bureau it uses, lift the freeze at that bureau only, and freeze it again after. A lift for a set number of days does the refreezing for you. TransUnion lets you schedule a temporary lift up to 15 days ahead, and Experian lets you schedule an unfreeze. Product-specific
Keep the bureau account's sign-in where you keep your other passwords. You will need it to lift the freeze, possibly years from now. That is why the money sheet has a column for where the sign-in is kept. Write the place ("Apple Passwords", "password book in the desk"), not the password or PIN. Our convention
A freeze, a lock and a paid plan are different things
Each bureau's freeze page also offers other products. A credit lock is a bureau's own product that limits access to your report, much as a freeze does, under the bureau's terms rather than the law's. The CFPB says credit locks are often sold for a fee, bundled with other services, and are "no more effective than security freezes." Experian's page says its CreditLock is included in a paid membership. Equifax's freeze page also offers plans, some paid, that include a credit report lock. TransUnion's page says a credit lock can come as a feature of credit monitoring services. Product-specific
This manual teaches the freeze, because it is free and set by federal law. You do not need a plan, a lock or monitoring to place one. If a page asks for a card number while you are placing a freeze, you have left the freeze steps; go back to the bureau's freeze page. Our convention
How to place a freeze
The steps are the same on every device. You use a web browser (Safari on an iPhone, iPad or Mac; Chrome on an Android phone or a Chromebook; Edge or another browser on Windows) or a phone call. Type each bureau's address yourself or use the links on this page. Do not use a search ad to find a bureau: Checking what you read explains why fake ads for real brands appear at the top of search results.
- In your browser, open the first bureau's freeze page from the table below.
- Choose the option to place a freeze. Equifax labels it Place a security freeze; the other two use similar words.
- Create the free account the bureau asks for. Equifax calls it a myEquifax account; Experian, an Experian account; TransUnion, a Service Center account.
- Answer the questions the bureau asks to confirm who you are. Equifax may send a one-time code by text or ask questions about your credit history.
- Save the account's sign-in in your password manager or your password book (Passwords).
- Confirm the freeze. The site shows that your file is frozen.
- On the money sheet, set that bureau's row to Frozen, write today's date, and write where the sign-in is kept.
- Repeat with the second bureau, then the third.
In short: each bureau's freeze page > create the free account > confirm your identity > place the freeze > write the date on the money sheet. Three times.
| Bureau | Online | By phone | What else the page says |
|---|---|---|---|
| Equifax | Equifax Security Freeze, with a myEquifax account | (888) 298-0045 | "Placing, temporarily lifting, or removing a security freeze is free." The page also offers plans. |
| Experian | Experian credit freeze, with a free Experian account | 1-888-EXPERIAN (1-888-397-3742) | Freezes and unfreezes online in real time; a mailed request can take up to 3 days after it arrives. CreditLock is part of a paid membership. |
| TransUnion | TransUnion credit freeze, with a free Service Center account | Use the number on TransUnion's freeze page | Free to freeze, unfreeze and temporarily lift; no effect on your score; a temporary lift can be scheduled up to 15 days ahead. |
We give a phone number only where we read it on the bureau's own page today. TransUnion's page did not open for our checking tools, so its number is not printed here; open its page and use the number it shows. Ask the bureau
A freeze by phone works too. Have a pen ready, because a bureau may give you a confirmation or a PIN by phone or by mail. Write on the money sheet where you put it, not the PIN itself.
Fraud alerts, briefly
A fraud alert is a note on your credit file that tells lenders to check it is really you before opening credit. It does not block the report the way a freeze does. The FTC describes two kinds. An initial fraud alert lasts one year, can be renewed, is free, and needs only one call: you contact one bureau and it must tell the other two. An extended fraud alert lasts seven years and is for people whose identity has been stolen; it needs an FTC identity theft report from IdentityTheft.gov (the FTC's identity theft reporting site) or a police report. Product-specific
For setting things up, this manual's default is a freeze at each of the three bureaus. A fraud alert is a quick first step on the day you learn your information was stolen, because it takes one contact; the freeze can follow. Our convention
Fraud alert or freeze, after a theft
| Initial fraud alert | Extended fraud alert | Credit freeze | |
|---|---|---|---|
| What it does | Asks lenders to verify your identity | The same, for longer | Stops the bureau releasing your report to new lenders |
| How long | One year, renewable | Seven years | Until you lift it |
| How many contacts | One bureau; it tells the other two | One bureau, with a report | Each of the three |
| What you need | Nothing beyond your identity | An FTC identity theft report or a police report | A free account or a call to each bureau |
| Cost | Free | Free | Free |
The FTC also says an extended alert takes you off marketing lists for unsolicited credit and insurance offers for five years. The FTC and the bureaus present the alert and the freeze as choices. This manual's default (freeze all three) is the stronger block; the alert is the faster one to place. If your identity was stolen, When something goes wrong covers IdentityTheft.gov's recovery plan, which includes both.
A parent or guardian can freeze the file of a child under 16, and of a person for whom a guardian has been appointed (CFPB; FTC). That is outside this manual's setup and is listed here so you know it exists.
A freeze stops new credit in your name. It does nothing about misuse of an account you already have: a stolen card number, a bank transfer, a payment app. Alerts and your statements cover those. A freeze also does not stop someone using your Social Security number for a tax return, benefits or medical care; section 5 covers those. This manual gives no financial or legal advice. What a freeze means for a loan or an apartment you are applying for is a question for that lender or landlord.
3. Bank and card alerts
A transaction alert is a text, email or app notification your bank or card company sends when something happens on your account: a payment, a withdrawal, a change of address or a sign-in. Alerts do not stop a payment. They tell you about it while there is still time to call.
No current federal consumer page we found tells readers to turn on alerts, so this step is this manual's own, built on what the agencies say about time limits below. The settings belong to each bank, and each bank names and arranges them differently. Our convention
Why the first days matter
Federal rules on electronic transfers give you more protection the sooner you tell your bank. The CFPB summarizes them this way. If your debit card, PIN or security code is lost or stolen, telling your bank or credit union within two business days of discovering it limits what you can owe to $50 or the amount taken, whichever is less. If an unauthorized transfer (one someone else made without your permission) shows up on your statement, tell the bank within 60 days after the statement is sent, or you could owe the full amount of later transfers (CFPB, How do I get my money back after an unauthorized transaction, last reviewed August 28, 2026). An alert is how you find out on the first day instead of when the statement comes. Ask your bank
The rules depend on who moved the money. When someone else moved it with details stolen from you, it is unauthorized. When you sent it yourself, even because you were lied to, the protections are much weaker. When something goes wrong covers that difference and what to do in each case. The CFPB page and your account agreement set the details.
Which alerts to turn on
Turn on, where your bank offers them:
- Every payment or withdrawal, or every one over an amount you choose. A low amount means more alerts and catches small test charges. Preference
- Sign-in from a new device and password or contact change. These tell you someone else may be in the account before money moves.
- Payments sent from a money app linked to the account, if you have one.
- Low balance, if you want it. It is a budgeting alert more than a security one.
Send alerts to the phone you carry. If the bank offers both text and app notifications, either works; the point is that you see it the same day. Our convention
Turning on alerts
Do this in your bank's own app, installed from the App Store or Google Play, or on the bank's website, typed in yourself. Do not use a link from a text or email, even one that looks like the bank's. The menu names below are examples; your bank's may differ. Product-specific
- Open your bank's app, or go to its website and sign in.
- Find the settings menu. In many apps it is under a profile picture, a person icon or a menu named More.
- Look for a menu named Alerts, Notifications, or Security and alerts.
- Turn on the payment or withdrawal alert, and set an amount if it asks.
- Turn on the sign-in and account change alerts.
- Choose where alerts go: text, email or app notification.
- Save, if there is a Save button.
- Repeat for your card company, if your card is not from the same bank.
- On the money sheet, tick Bank alerts on and Card alerts on.
In short: your bank's app or site > settings or profile > Alerts or Notifications > turn on payments, sign-ins and changes. Each bank names these differently.
If you cannot find the menu, call the number on the back of your card or on your statement and ask: "How do I turn on alerts for payments and sign-ins?" That number is on the numbers sheet from Recognizing scams. Ask your bank
To test it, make a small purchase with the card and see whether the alert arrives. If it does not, check that notifications for the bank's app are allowed in your phone's settings. Test it
Money apps
A payment app (Zelle inside a bank's app, or a separate app) moves money in seconds. A 2018 CFPB post, now in its archive, says these services "generally don't have a recall or retrieval feature," so the money is hard to get back once sent, and that sending money to people you know and trust is the safest way to use them (CFPB, Helpful tips for using mobile payment services, 2018, archived). The same post says to turn on a passcode, PIN or fingerprint for payments. Two-step sign-in and passkeys covers two-step sign-in for the app itself. Tick Money app sign-in protected on the money sheet when that is done. We name no app to use or avoid.
What the CFPB said about alerts, in archived posts
Two CFPB blog posts mention alerts, and both now carry the CFPB's archived-content banner. A 2020 post on online and mobile banking said most banks and credit unions let customers set up automatic notifications, for example when a direct deposit arrives, a large payment is charged, the balance falls below an amount, or the account is overdrawn, by text, email or both (CFPB, Online and mobile banking tips, 2020, archived). A 2014 post about hacked card data said to consider email or text alerts if your provider offers them. We cite them as history: they show the advice is not new, and they are not current guidance. That is why the alerts step on this page is labelled our convention.
Naming a trusted contact
A trusted contact is a person you name to a brokerage, bank or credit union, whom it may call in limited situations: it cannot reach you, or it suspects someone is exploiting your account. FINRA, the SEC's investor education office and NASAA describe it like an emergency contact. Naming someone does not let them trade, act on your behalf or make decisions on the account. The person must be 18 or older, can be family, a friend, an attorney or an accountant, and you can name more than one and change them at any time. Brokerage firms ask for one when you open or update an account; giving one is optional. To add one, contact the firm or your investment professional (FINRA, Why You Should Consider Adding a Trusted Contact, August 25, 2025). Ask your firm
At banks and credit unions it varies. The CFPB calls trusted contacts an emerging practice, so some offer it and some do not. It suggests asking the bank to explain its policy: when it would call the person and what it would tell them. It also suggests choosing someone who does not already control or co-own your accounts (CFPB, Choosing a trusted contact person, PDF, November 2021). There is no step-by-step path to give, because each bank sets its own. Write the person on the recovery sheet's trusted people list with the role "trusted contact at the bank," and tick the item on the money sheet. Ask your bank or credit union
4. Your free credit reports
A freeze stops new credit from now on. A report shows what is already on your file, including anything opened before the freeze. The three bureaus give free reports every week at AnnualCreditReport.com, the official site run for the bureaus under federal law. The FTC says the bureaus "have permanently extended" free weekly reports there, and that federal law also gives you one free report from each bureau every 12 months. You can also order by phone at 1-877-322-8228 and get the report by mail within 15 days (FTC, Free Credit Reports, June 2026). Product-specific
A freeze does not stop you getting your own reports (CFPB). Do it in either order.
Look-alike sites
The FTC warns of imposter sites whose addresses misspell AnnualCreditReport.com, set up for people who mistype it, and says the official site and the bureaus will not email you asking for your Social Security number. Type the address carefully, or use the link on this page. The official site does not ask for a card number to give a free report. Our convention
Reading a report
The FTC says to check that the information is accurate, complete and up to date, and that mistakes can be a sign of identity theft. This manual's way of reading one, in the order that matters most for this chapter: Our convention
- Go to AnnualCreditReport.com and request a report from one bureau.
- Confirm your identity with the questions the site asks.
- Read the list of accounts. Look for any card, loan or account you did not open.
- Read the list of recent inquiries, the companies that looked at your file. Look for a company you did not apply to.
- Read your names and addresses. Look for an address you have not lived at.
- On the money sheet's reports list, write the date, the bureau, anything you did not recognize, and what you did about it. "Nothing unrecognized" is a valid entry.
- On the alerts checklist, tick One free credit report read.
In short: AnnualCreditReport.com > one bureau > read accounts, inquiries and addresses > write what you found on the money sheet.
Reading one bureau's report is the minimum. The three reports can differ, because not every lender reports to every bureau, so this manual suggests reading a different bureau's report each time you check. Our convention
If you find an account you did not open, that is the point where this chapter hands over to When something goes wrong: IdentityTheft.gov builds a recovery plan, and the bureau whose report shows the account is the one to contact about it. Write what you found on the reports list first, so you have the details when you call.
5. Tax, Social Security, Medicare and mail
These protections are optional. Each applies only if you have the thing it protects. The default for each is one sentence here; the steps and the trade-offs are under Go deeper. Our convention
- If you file taxes: the IRS Identity Protection PIN is open to anyone who can verify their identity.
- If you get Social Security benefits or will: opening your own my Social Security account is the default Social Security presents; blocking online access is the other option.
- If you are on Medicare: read each statement against your own calendar.
- If you want to block new bank accounts too: a ChexSystems freeze.
- If you want to see your mail before it arrives: Informed Delivery, with multifactor sign-in on.
The money sheet has a line for each. Tick the ones you do; leave the others blank. A blank line means "not chosen," which is a valid answer.
This manual gives no tax, benefits or legal advice. It says what each protection does and who runs it. Whether an IP PIN suits your tax filing is a question for the IRS or your tax preparer. Whether to block online Social Security access is a trade-off Social Security itself presents both ways, and Social Security answers questions about your record. Medicare answers questions about a claim.
The IRS Identity Protection PIN
An IP PIN (Identity Protection PIN) is a six-digit number the IRS issues to you that stops someone else filing a tax return with your Social Security number or taxpayer number. The IRS says anyone who has a Social Security number or ITIN and can verify their identity is eligible, and parents and guardians can request one for dependents. It is valid for one calendar year; a new one is made each year (IRS, Get an identity protection PIN, updated August 4, 2026). Product-specific
The IRS's fastest way:
- Go to irs.gov, typed in yourself, and sign in to your IRS online account. If you do not have one, the IRS asks you to register and verify your identity.
- Open your Profile page.
- Find the IP PIN section and follow the steps.
- Write on the money sheet where you will look up the PIN each year, not the PIN.
In short: IRS online account > Profile > IP PIN.
If you sign up online, the IRS does not mail the new PIN each year; you look it up in the online account, which shows it from mid-January to mid-November. If you cannot open an online account, the IRS offers Form 15227 when your adjusted gross income on your last return is below $84,000 (individuals) or $168,000 (married filing jointly), with the PIN mailed in four to six weeks, or an in-person appointment at a Taxpayer Assistance Center, with the PIN mailed in about three weeks. You give the PIN only to your tax software or your tax preparer when you file. The IRS says calls, emails or texts asking for your IP PIN are scams.
my Social Security, or a block
Social Security's fraud and scam pages describe two choices that point in opposite directions. Product-specific
- Open your own my Social Security account. Social Security's scam page says having one sends you an alert if anyone tries to change your address or direct deposit, and keeps a thief from opening the account in your name (Social Security, Protect Yourself from Social Security Scams). Its fraud page suggests creating one to watch your record. This is this manual's default for anyone who will use it.
- Block online access. The eServices block "prevents anyone, including you," from seeing or changing your personal information online, and removing it needs your local office. A separate Direct Deposit Fraud Prevention block stops anyone, including you, from enrolling in or changing direct deposit or your address online or through a bank (Social Security, Fraud Prevention and Reporting). These suit someone who does not plan to use the online services, or someone whose identity was stolen.
To open the account, go to ssa.gov, typed in yourself, and choose my Social Security. To ask for a block, contact Social Security; the fraud page explains both blocks. We did not find Social Security's phone line for block requests on a page we could check, so we do not print one. Social Security's inspector general takes fraud reports at 1-800-269-0271, 10 a.m. to 2 p.m. Eastern, Monday to Friday, or online at oig.ssa.gov. Ask Social Security
Medicare statements
If you are on Medicare, someone with your Medicare Number can bill for care you did not get. Medicare's own advice: compare the dates and services on your calendar with the Medicare statements you get, check receipts and statements from providers, and create a Medicare.gov account to see claims sooner. Give your Medicare Number only to your doctor and others who should have it. Medicare says it does not call to sell you anything or visit you at home. To report suspected fraud, call 1-800-MEDICARE (1-800-633-4227) (Medicare, Reporting Medicare fraud and abuse). Your state's Medicare fraud help line (the Senior Medicare Patrol, or SMP) helps you read statements and report problems; its national center lists each state's office and a toll-free line, 877-808-2468 (SMP National Resource Center). Ask Medicare
A ChexSystems freeze
ChexSystems is a consumer reporting company that banks check before opening checking and savings accounts. Its security freeze is designed to prevent checking, savings, credit accounts or loans being approved in your name without your consent, and it applies only to your ChexSystems report; the three bureau freezes are separate. You get a PIN for lifting or removing it. The Security Freeze Department is at 800.887.7652, with representatives from 7:00 a.m. to 11:00 p.m. Central, Monday to Friday (ChexSystems, Security Freeze Information). It is most useful after identity theft, or if you want new bank accounts blocked as well as new credit. Add a ChexSystems row on the money sheet's freezes list if you place one, and write where the PIN is kept. Product-specific
Informed Delivery
Informed Delivery is a free U.S. Postal Service account that shows grayscale pictures of the address side of the letter mail coming to your address, by email, on a dashboard or in an app, with package tracking. You verify your identity and address to sign up, online or at a Post Office that offers it. USPS now offers multifactor sign-in for the account and says it is "required for some users and recommended for all" (USPS, Informed Delivery). Product-specific
Our reasoning, which no source we fetched states directly: the account shows when cards and checks are on their way, so someone else's sign-in to it would show them the same. If you sign up, turn on multifactor sign-in (Two-step sign-in and passkeys) and use a password used nowhere else (Passwords). That is a reason to protect the account, not a reason to avoid it. Our convention
6. See it See it
Frank Tran freezes his credit. Frank Tran is a retired machinist in Sacramento, California, with an iPhone, a MacBook, Verizon for his phone, and an account at Golden Valley Bank with Zelle in its app. The bank, the calls and every result below are fictional; the bureaus and their steps are real.
A caller showing Golden Valley Bank's real number told Frank his account was hacked and walked him through sending $2,400 by Zelle to "a secure holding account." He realized what had happened the next morning, when the "fraud department" called back for more. The bank says he sent the payment himself, so it is reviewing it as a scam claim rather than an unauthorized transfer. When something goes wrong follows that part.
That afternoon, at the MacBook, Frank types equifax.com into Safari and opens its Security Freeze page. He creates a myEquifax account, answers the questions, and places the freeze. He saves the sign-in in Apple Passwords, which he set up in Passwords. On the money sheet he writes: Equifax, Frozen, today's date, "Apple Passwords." He does the same at Experian and TransUnion. It takes him about 40 minutes. On each site he passes over the offers for plans and locks.
He then requests his Experian report at AnnualCreditReport.com and reads the accounts list. He finds his Golden Valley accounts, one credit card and a paid-off car loan, nothing he did not open. He writes on the reports list: the date, Experian, "nothing unrecognized," "none."
Known: all three freezes are placed and dated; the sign-ins are in Apple Passwords; one report shows no account he did not open.
Assumed: Frank assumes the caller may have more of his details than the account number, because the caller knew his name and his bank. That is his assumption; whether the caller had his details from a breach is unknown, and it does not change these steps.
Open: whether the bank returns the $2,400, which only the bank settles, and the freeze has no bearing on it; whether anyone applied for credit in his name before today, which the other two bureaus' reports would show, and which Frank settles by reading them over the next weeks.
Under these assumptions, the freeze closes one way a thief with his details could use them: new credit at a lender that checks a bureau. It does not touch the payment already sent, the Golden Valley account itself, or his Social Security number used elsewhere. Frank's other steps from the same week, Verizon's number lock and his reports to ReportFraud.ftc.gov and ic3.gov, are in Two-step sign-in and passkeys and When something goes wrong.
Free pages that explain the protections in the publishers' own words:
- FTC, Credit Freezes and Fraud Alerts: the freeze and both kinds of fraud alert, with links to each bureau.
- CFPB, What is a credit freeze or security freeze: the legal time limits and what a freeze does not cover.
- FTC, Free Credit Reports: weekly reports, ordering by phone, and look-alike sites.
7. Practice Practice
Minimum: three freezes placed and dated on the money sheet, alerts on for your main bank account, and one report read. Time: about 60 minutes; the freezes take about 10 to 15 minutes each, the alerts about 10 minutes, the report about 15. Materials: your phone or computer, your password manager or password book, the card or statement for your main bank account, and the money sheet. The freezes and alerts lists are essential on a first pass.
- Open the money sheet. Check that the three bureau rows are there with status Not yet.
- Freeze at Equifax. Follow how to place a freeze. Save the sign-in, then write Frozen, the date and where the sign-in is kept.
- Freeze at Experian. The same, on Experian's page.
- Freeze at TransUnion. The same, on TransUnion's page.
- Turn on bank alerts. Follow turning on alerts in your bank's app or site. Tick Bank alerts on.
- Turn on card alerts, if your card is from a different company. Tick Card alerts on.
- Test one alert with a small purchase, and note whether it arrived.
- Read one report. Follow reading a report, write what you found on the reports list, and tick One free credit report read.
Choose or set aside each optional protection in section 5, and tick the ones you do. Add a calendar reminder to read a different bureau's report in a few months. Once a year, when you do the check-up in Your security file, look at the freezes list and confirm each bureau still shows your file as frozen.
8. Your setup Your setup
The box below reads the money accounts and devices you saved in setup. It shows which optional protections match them, and the freeze steps for your devices.
9. Check your work Check your work
Criteria
- Does the money sheet show Equifax, Experian and TransUnion as Frozen, each with a date?
- For each bureau, does it say where the sign-in is kept, and is that a place, not a password or PIN?
- Are alerts on for your main bank account, and do you know where they arrive?
- Have you read one credit report, and does the reports list say what you found, even if it was nothing?
- Did you place every freeze without buying a plan, a lock or monitoring?
- For each optional protection, have you chosen it, set it aside, or left it for later?
Worked example
Ruth Alvarez freezes from her phone. Ruth Alvarez is a retired school librarian in Tucson, Arizona, with an iPhone, a Gmail address, an account at Saguaro Federal Credit Union and one credit card. The credit union and its app are fictional.
Ruth places all three freezes in Safari on her iPhone, one bureau each evening over three evenings. Each bureau's sign-in goes into Apple Passwords, which she turned on in Passwords, and she writes "Apple Passwords" in the sign-in column of each row. She then opens Saguaro Federal Credit Union's app, finds its alerts menu under her profile, and turns on alerts for every card purchase and for sign-ins from a new device. She buys a coffee to test it and the alert arrives. She reads her Equifax report at AnnualCreditReport.com and writes "nothing unrecognized."
Known: three freezes dated; sign-ins kept in Apple Passwords; credit union alerts on and tested; one report read.
Assumed: that her credit card company sends its own alerts separately. That is her assumption, because the card is not from the credit union.
Open: which alerts the card company offers, which the card company settles when Ruth calls the number on the back of the card; whether the other two reports match, which she settles by reading them later.
Checked against the criteria: the freezes, the sign-in places, the main account's alerts and the report meet them, so Ruth has met Done when. Card alerts are still open, and the money sheet shows that, because Card alerts on is not ticked. Under these assumptions, her setup covers new credit and her credit union account; it does not cover the card until its alerts are on.
Common mistakes
- Freezing at one bureau. A lender may check either of the other two. Check the money sheet for three Frozen rows.
- Buying a lock or a plan to get the freeze. The freeze is free. If a page asks for a card number, you have left the freeze steps.
- Losing the bureau sign-in. You need it to lift the freeze. Save it where your other passwords are, and write the place on the sheet.
- Writing a PIN on the sheet. Write where it is kept. The sheet is stored in this browser and printed.
- Using a search ad or a link in a text to reach a bureau, AnnualCreditReport.com or your bank. Type the address or use a bookmark.
- Treating the freeze as cover for an existing account. It is not. Alerts and statements are.
- Turning on alerts and not looking at them. An alert for a payment you did not make is the moment to call the number on your card.
What is still unresolved
This chapter does not settle whether someone already has your details, or what they will try. A report shows what is on one bureau's file today. A freeze does not undo a payment already made; When something goes wrong covers that, and the bank decides it. Which alerts your bank offers is the bank's to say. Whether an IP PIN, a Social Security block or a ChexSystems freeze suits you depends on your filing, your benefits and your banking, and the IRS, Social Security and ChexSystems answer those questions. Financial, tax and legal questions go to a professional you choose.