A data-breach notice from a U.S. retailer, hospital, or credit bureau does not empty your checking account by itself, and it does not prove a thief already opened a card. It is a warning, nothing more.
So what should you actually do this week?
If a Social Security number, date of birth, or full credit file may have been copied, freeze new borrowing before you tinker with the company's monitoring login. An email-and-password leak is a different mess.
The bureau steps below are U.S. credit-file tools.
What the notice is really telling you
Most company notices list the data types, a time window, and a free year of monitoring that only alerts you after a new account already hits a report. It does not block the application.
Thing is, the freeze and fraud-alert tools the FTC describes sit with you, not with the company that lost the file. They cannot place that freeze for you.
Read the letter for the data types. Names and emails are ugly, but a Social Security number is the one that makes a freeze worth the extra logins. Freeze if they named your SSN.
Do these steps in order
Skip the monitoring portal until the file is harder to use.
- Place a fraud alert or a security freeze. One alert at any nationwide bureau must be shared with the other two. A freeze is separate at each bureau, and it stays until you lift it.
- Order your reports at AnnualCreditReport.com. People affected by the 2017 Equifax incident can also use extra Equifax reports through 2026, as described on the FTC settlement page.
- If you already see theft, complete a report at IdentityTheft.gov. The site builds an Identity Theft Report and a recovery plan.
- Reset the email account that receives bank password resets. Then reset banking and card passwords.
- Call a bank or card issuer only when a charge or account is wrong. Write down dates and reference numbers.
Online freeze requests are usually the fastest path. Mail or phone can take several days after the bureau gets your paperwork.
Fraud alert or freeze
| Tool | What it does | How you set it | How long it lasts |
|---|---|---|---|
| Fraud alert | Lenders should take extra steps to verify it is you | Contact one of Equifax, Experian, or TransUnion; that bureau notifies the others | Initial or extended; extended needs an identity theft report or police report to place or renew |
| Credit freeze | Blocks most new creditors from seeing your report until you thaw it | You must freeze Equifax, Experian, and TransUnion yourself | Until you ask each bureau to remove or temporarily lift it |
| Credit lock | A product some bureaus sell that can feel similar | Company app or paid bundle | Follow that company's terms; it is not the same as a freeze |
Both the alert and the freeze are free. Experian's comparison of the two tools matches the FTC on the big split: one alert fans out, and one freeze does not. You still have to freeze all three bureaus.
Active-duty service members can add an active-duty alert, and if a deployment runs longer than 12 months the CFPB notes you may place another. Ask the bureau for the active-duty option.
Parents can freeze a child's credit using the child-freeze instructions on the FTC page. You'll manage PINs or freeze logins at each bureau. That extra hassle is the freeze tradeoff.
When the damage already started
You opened a credit report and there is a car loan, a card, or a collection account you know you never signed. That is identity theft, not a glitch.
Go to IdentityTheft.gov before you spend a weekend on hold with every merchant. You answer questions about what happened, you get the Identity Theft Report, and the recovery plan tells you which letters to send. Work the plan in that order.
To be honest, the report does not magically unwind every fraudulent account the same day, and some creditors still want a police report or their own affidavit, which is annoying and slow and you may repeat your story more than once. Keep copies of everything you send. Freeze anyway so the next application is harder.
Dispute the errors on each report and use the dates from your Identity Theft Report when you write. The CFPB page covers the same sequence.
Leftover Equifax help
The 2017 Equifax breach affected about 147 million people, and the claim window on the FTC settlement closed on January 22, 2024. Extra Equifax reports for that incident still run through 2026.
A freeze will not watch the accounts you already have
A freeze is built to block most new credit, not to babysit the checking account, card, and utility login you already use every week. You still have to watch them.
A stolen card number from a store does not need a new credit pull. Change the card if charges appear. File a police report only if your recovery plan or a creditor asks for one.
Tax or benefits issues sit with other agencies, so use the IdentityTheft.gov plan if it flags those steps instead of assuming a freeze covers the IRS. Read that part of the plan.
People freeze and then forget to thaw before a car loan, and then they blame the dealer. Turns out the dealer just cannot see the frozen file.
Put the bureau logins in a password manager so you can lift a freeze for a day when you actually apply. Lift it only for that day.
Make the logins harder to reuse
Reuse of one email password is still how a lot of consumer bank and shop accounts get taken after a company password leak. Go reset that inbox password tonight.
Passkeys or a hardware security key beat a text-message code if the site offers them, because SMS codes can be phished. Pick a unique password per site.
Do not pay for a credit lock thinking it replaces a freeze. Check the free freeze before you buy a lock.
Place one control today
Open the FTC freeze page, pick Equifax, Experian, or TransUnion, and set the freeze or the alert before you go to bed. Then order your reports tomorrow morning.
If the report already shows theft, start the IdentityTheft.gov plan the same day rather than waiting on the company's monitoring app. Do not wait on their app.