Data breaches happen constantly. Retailers, hospitals, insurance companies, and government agencies have all had them. Your email, password, Social Security number, or financial data may have been exposed in a breach you never even heard about.
The good news is that most breaches don’t lead to identity theft. The data gets sold to bad actors who have more information than time to use it. Moving quickly puts you ahead of anyone trying to exploit your details. Here’s what to do.
How To Find Out If Your Data Was Exposed
HaveIBeenPwned.com Type in your email address. This free service, run by a respected security researcher, checks your email against a database of known public breaches and tells you which ones included your address and what data was exposed. It’s the fastest first check.
Breach notification letters Under most state laws and several federal regulations, companies must notify you when your data is breached. These letters arrive by mail or email. Don’t throw them away, they tell you exactly what was exposed.
Check your accounts directly If you heard about a specific company’s breach, log into that account (if you still can) and look for security notifications. Check your bank, credit card, and investment account statements for unfamiliar transactions.
Credit report check A free credit report at annualcreditreport.com, now available weekly from each of the three bureaus, shows new accounts opened in your name, inquiries, and other activity. Accounts or inquiries you don’t recognize are red flags. See What Is A Credit Report? for how to read one.
The First 48 Hours: What To Do Immediately
1. Change the compromised password, and everywhere else you used it If you reused that password on other accounts, change all of them. Start with email (password reset links go there), then banking and financial accounts, then everything else. Use a unique password for each account going forward.
If you don’t already use a password manager, now is the time to start. Password managers create and store unique strong passwords for every account. You remember one master password; the manager handles the rest.
2. Turn on two-factor authentication (2FA) On any account that offers it, especially email, banking, and accounts with payment information, turn on two-factor authentication. A second verification step means a stolen password alone isn’t enough to get in.
3. Freeze your credit (see below) If financial information or your Social Security number was exposed, this is the most important step you can take.
4. Place a fraud alert (if you want something lighter than a freeze) A fraud alert asks lenders to take extra steps to verify your identity before opening new credit. It’s free and less restrictive than a freeze. One bureau automatically shares the alert with the others. A freeze provides stronger protection.
How To Freeze Your Credit at All Three Bureaus
A credit freeze, also called a security freeze, prevents new credit from being opened in your name. When a lender pulls your credit to approve an application, a frozen report shows nothing, which blocks the new account from being opened.
It’s free. You can lift it temporarily when you need to apply for credit. It doesn’t affect your credit score.
You must freeze at each of the three bureaus separately:
Equifax equifax.com/personal/credit-report-services/credit-freeze/ or call 1-800-349-9960
Experian experian.com/freeze/center.html or call 1-888-397-3742
TransUnion transunion.com/credit-freeze or call 1-888-909-8872
Create an account or provide identifying information, request the freeze, and save the PIN or confirmation number each bureau gives you. You’ll need it to lift the freeze later. Freezes stay in place indefinitely until you remove them.
What a credit freeze does not block:
- Your existing accounts and their activity
- Employers checking your credit (usually a soft inquiry unaffected by a freeze)
- Pre-screened credit offers
- Your own credit checks
Credit Freeze vs Fraud Alert
| Credit Freeze | Fraud Alert | |
|---|---|---|
| What it does | Blocks new credit applications from going through | Asks lenders to call you before approving new credit |
| How long it lasts | Indefinitely (until you lift it) | 1 year (standard); 7 years if you have documented identity theft |
| Where to place it | At each of the three bureaus separately | At one bureau (they notify the others) |
| Cost | Free | Free |
| Effect on existing accounts | None | None |
| Applying for new credit | Requires temporarily lifting the freeze | Possible but lender must take extra steps |
For most people not actively applying for credit, a freeze is the stronger protection. If you’re in the middle of applications and don’t want to deal with lifting the freeze repeatedly, a fraud alert is less disruptive.
If Identity Theft Has Already Occurred
If someone has already opened accounts in your name, taken out loans, or filed a tax return using your SSN, you have more work to do, but you also have legal rights.
File an identity theft report at IdentityTheft.gov This is the FTC’s official identity theft resource. It walks you through a personalized recovery plan, generates a report you can use with creditors and police, and tracks your recovery steps. Use it as your central hub.
Dispute fraudulent accounts Contact each credit bureau where a fraudulent account appears. You have the right to dispute inaccurate information and have fraudulent accounts blocked from your credit report. The FTC identity theft report strengthens your dispute.
Also contact the fraud department at any financial institution where a fraudulent account was opened, and provide a copy of your identity theft report.
Place an extended fraud alert If you have documented identity theft, you can place a seven-year extended fraud alert instead of the standard one-year alert, this also gives you the right to two free credit reports from each bureau in the next 12 months.
File a police report For serious identity theft, especially involving financial accounts or tax fraud, a police report gives you documentation that helps with creditor disputes and may be required by some creditors.
Tax identity theft If someone filed a tax return using your SSN before you did, call the IRS at 1-800-908-4490 and submit IRS Form 14039 (Identity Theft Affidavit). The IRS will investigate and assign you an IP PIN, a unique number you use to verify your identity on future filings.
Longer-Term: Account Security and Ongoing Vigilance
Check your credit report periodically All three bureaus now allow free weekly reports at annualcreditreport.com. Look for new accounts, inquiries, or address changes you don’t recognize. You don’t need to check all three every week, rotating through them monthly covers the bases.
Monitor financial accounts Review bank and credit card statements at least monthly. Set up transaction alerts (available on most banking apps) so you’re notified of any charge above a threshold you set.
Use unique, strong passwords If one password is breached, it shouldn’t expose every other account. A password manager makes unique passwords practical to maintain.
Secure your email Email is the master key to most accounts, password reset links go there. A compromised email can open everything else. Use a strong, unique password and two-factor authentication.
Be skeptical of unsolicited contact After a breach, phishing attempts often increase. Scammers know your email was in the breach and may send messages pretending to be the breached company, asking you to “verify your account.” Don’t click links in unsolicited emails, go directly to the company’s website instead. For more on spotting these tactics, see How To Spot Financial Scams.
Frequently Asked Questions
Q: My credit card number was in a breach. What do I do?
Call the number on the back of your card and report that you believe the card number was compromised. Your issuer can cancel the card and issue a new one with a new number at no charge. You’re not liable for fraudulent charges if you report them promptly.
Q: I never signed up for the company that was breached. How was my data there?
Data brokers, marketing partners, and old accounts you may have forgotten about often hold your information. Companies share and buy customer data widely. Your information can end up in many places you never directly put it.
Q: Can I sue the company that was breached?
In some cases, yes, particularly in states with strong data privacy laws. Class action lawsuits after large breaches are common. If you get a notice about a class action settlement, it is worth reviewing. Settlements typically pay small amounts per person, but reviewing costs you nothing.
Q: Does freezing my credit affect my existing credit cards or loans?
No. A freeze only affects new credit applications. Your existing accounts, their limits, interest rates, and payment history are completely unaffected.
Q: How do I temporarily lift a freeze to apply for a new loan?
Log in or call each bureau where you placed a freeze and request a temporary lift. You can set a date range (for example, “lift for the next 7 days”) or lift and re-freeze manually. At most bureaus, the lift takes effect within an hour.
Learn More
- FTC: IdentityTheft.gov, official identity theft recovery resource
- USAGov: Identity theft
- FTC: Credit freezes and fraud alerts
- Equifax: Credit freeze
- Experian: Credit freeze center
- TransUnion: Credit freeze
- FTC: Free credit reports
- IRS: Identity theft and your tax return
- CFPB: Credit freezes and fraud alerts