Credit Freeze vs. Fraud Alert: What to Do After a Data Breach

A data-breach notice can leave you with a practical question: should you freeze your credit, place a fraud alert, or do something else? Start by identifying what happened. Protecting access to a credit report is a different task from dealing with an unauthorized charge on a card you already use.

The short answer: a credit freeze restricts prospective creditors’ access to your credit file. A fraud alert asks businesses to verify your identity before granting new credit. Both are free. A freeze requires a separate request to each of the three major credit bureaus; an initial fraud alert can start with one.

This U.S. guide explains the choice and gives you a practical follow-through checklist. Reviewed October 21, 2026. It does not promise complete protection against every kind of identity theft.

Credit freeze and fraud alert at a glance

These distinctions follow the FTC’s explanation of freezes and alerts. You can use an alert alongside a freeze. Neither choice is a credit-score improvement program. For payment history and borrowing habits, see our separate credit score guide.

Start with the problem you need to solve

Write a one-sentence description before taking action. “I received a notice that my identifying information was exposed” is different from “I found a card purchase I did not make.” If both happened, keep both on your task list. Do not assume that completing one protective step resolves every other issue.

For a breach notice, read which information the company says was involved and retain the notice. For a suspicious transaction, contact the account provider promptly using a trusted channel, such as its official app or the number on your card. A credit freeze is aimed at new-credit misuse; it is not a switch that reverses transactions on an existing account.

Keep your first notes brief: the date, the account or company involved, what you observed, and the next action. Avoid copying full account numbers into an ordinary note. The purpose is to keep track of the response, not to create another collection of sensitive data.

How to organize a credit freeze

The CFPB explains that you must contact the nationwide credit reporting companies separately. A security freeze does not change your credit score, and you can still review your own file. Some existing creditors and other permitted entities retain access, so “frozen” does not mean the report becomes invisible to everyone.

Step 1: Use official starting points

Open the bureau links from the official FTC or CFPB resources linked in this guide. Look specifically for a security freeze. If you are offered a paid bundle, pause and check which service the page is describing. You are trying to complete a particular free request, not make a rushed purchase because the screen sounds urgent.

Use a private device and connection you trust. Have the information needed for the bureau’s own identity verification ready, but enter it only through its official process. Do not send it to someone who contacts you unexpectedly and offers to complete the request.

Step 2: Track all three requests

Create a small completion table like the one below. Mark a request complete only after you receive the bureau’s confirmation. If a request is still awaiting verification, record that status honestly and keep the remaining step visible.

A three-row table prevents an easy organizational mistake: remembering the first successful request as though the entire job is done. Store confirmations securely and keep a record of the official account-recovery method. Do not put passwords or recovery secrets in this checklist.

Step 3: Prepare for the next legitimate application

Before applying for credit, ask which bureau the lender expects to use and when access will be needed. Plan a temporary lift around that application. If the lender needs another bureau later, respond to that specific requirement instead of assuming one lift covers every possible check.

For example, imagine you plan to apply for an auto loan on Thursday. On an earlier day, confirm the lender’s process and check that you can access the relevant bureau account. Record the intended lift period and a reminder to confirm the freeze afterward. This example is a planning workflow, not a promise that an application will be approved or processed on a fixed timeline.

The CFPB says telephone or secure electronic lift requests must be handled within one hour; mail requests have a three-business-day deadline after receipt. Identity verification and application requirements still deserve planning time. Avoid leaving the entire process until a dealer or lender is waiting in front of you.

When a fraud alert fits

An initial fraud alert may fit when you suspect identity theft and want additional identity verification during credit applications. Unlike a freeze, it does not block access to the report. The FTC says an initial alert lasts one year and can be renewed. Contacting one bureau starts the notification process for the other two.

Put the renewal date in your calendar as soon as the alert is confirmed. Keep the contact details used for verification current through the bureau’s official process. An alert that generates a verification request is easier to manage when you know how a legitimate business can reach you.

For documented identity theft, the FTC describes an extended alert lasting seven years, with eligibility tied to an FTC identity theft report or police report. Read the official eligibility instructions before deciding that this is the appropriate request. If you need a recovery plan for actual identity theft, start at IdentityTheft.gov.

Credit freeze, credit lock, and monitoring are different tasks

The CFPB distinguishes a statutory security freeze from credit-lock products that may be bundled with paid services. Do not assume a lock, a monitoring subscription, and a freeze are interchangeable simply because the marketing uses similar language.

Use a two-column comparison when evaluating an offer: “What action does this service take?” and “What does it cost after any introductory period?” Add a third line for the cancellation terms. You can take time to assess an optional service after completing the protective actions you intended to request.

For example, an offer may emphasize notifications. Ask whether it actually restricts access to the credit file, merely reports changes, or provides some other assistance. Read the service description rather than treating the product name as the answer. Keep any paid decision separate from the free bureau request.

Build a follow-through file, not a pile of screenshots

Use one secure folder for the original notice, bureau confirmations, and correspondence about disputed activity. Give files clear names with a date and company. Keep a short action log so you can explain what happened without rereading every document during the next phone call.

A useful log entry is specific: “October 21: submitted request; confirmation received; next review October 28.” An unhelpful entry is “handled credit problem.” The first tells you what is finished and what remains. If someone gives you a case number, record it securely alongside the date and the organization you contacted.

Schedule a short review after the first actions are complete. Check the pending items, confirm that any promised correspondence arrived, and decide which official follow-up step comes next. Leave unresolved items open until you have evidence that they are resolved. A quieter inbox by itself does not prove the underlying issue has disappeared.

Common mistakes that create extra work

Stopping after one bureau. Use the completion table for a freeze, because each request is separate. Mixing prevention with recovery. Track suspicious existing-account activity separately from requests involving new-credit access. Forgetting future access. Keep legitimate applications on your calendar so you can plan any necessary lift.

Buying under pressure. A paid offer deserves an ordinary comparison, even when the triggering notice feels alarming. Confusing protection with score repair. A freeze does not erase accurate payment history, repay debt, or establish a record of on-time payments. Choose a next step that matches the actual problem you have.

Frequently asked questions

Do I need to wait for a breach notice?

No. The FTC says anyone can request a freeze, including people whose identity has not been stolen.

Does a freeze cost money?

Placing and lifting a security freeze is free. Check that you selected that service rather than an optional paid product.

Can I use my existing credit card?

A report freeze is aimed at access for new credit. It does not itself close an existing card or cancel its payment obligations.

What should I save after making a request?

Keep the confirmation and a secure record of how to manage access later. Record incomplete verification steps instead of marking them finished.

What if an application cannot access my file?

Ask which bureau and access period are needed, then follow that bureau’s official lift process. Confirm the request before asking the lender to retry.

Where do I go if identity theft has already happened?

Use IdentityTheft.gov for a recovery plan and contact affected account providers through trusted channels. Keep the recovery tasks separate from your freeze checklist.

General educational information for U.S. readers. Use official agency and bureau instructions for your situation; this guide does not replace an identity theft recovery plan.

Next step: Once immediate credit protection is in place, review your checking account fees and recent activity as part of a broader account check. A freeze does not prevent misuse of an existing bank account.