How to Protect Your Identity and Credit: Freezes, Alerts, and Disputes

To protect your identity and credit, use the free federal tools already available to you: freeze your credit files at Equifax, Experian, and TransUnion; pull your credit reports weekly at AnnualCreditReport.com; turn on multi-factor authentication for every financial account; and get an IRS Identity Protection PIN before tax season. These steps block most new-account fraud before it starts, and the Fair Credit Reporting Act gives you the right to dispute errors, sue bureaus that ignore you, and recover if a thief gets through.

Freeze Your Credit at All Three Bureaus

A credit freeze is the single most effective step against new-account fraud. It stops the bureaus from releasing your report to new lenders, so a thief can’t open a credit card, car loan, or line of credit in your name even if they have your Social Security number. Federal law makes placing and lifting a freeze completely free.¹

You contact each bureau separately. Each will ask for your name, Social Security number, date of birth, and address history, then issue a PIN or set up a password-protected account you’ll use to lift the freeze later. If you request the freeze online or by phone, the bureau must activate it within one business day.¹

When you apply for a mortgage, a car loan, or a new card, you temporarily lift the freeze at the relevant bureau. Online and phone lifts must be processed within one hour.¹ You can lift it for a specific lender or for a set period, after which it snaps back into place. Keep your PINs somewhere safe so the process stays quick.

Don’t Forget Utility and Telecom Records

A freeze at the three main bureaus doesn’t cover utility and telephone accounts. Those providers often check a separate database called the National Consumer Telecom and Utilities Exchange. You can freeze your NCTUE report online, by calling 866-349-5355, or by mail. That blocks thieves from opening phone plans, electric accounts, and similar services in your name, and you’ll get a PIN to lift the freeze when you need a new account yourself.

Check Your Credit Reports and Statements Regularly

The Fair Credit Reporting Act requires Equifax, Experian, and TransUnion to give you a free credit report every twelve months through AnnualCreditReport.com.² All three bureaus have also made free weekly reports permanently available through the same site, so you no longer need to wait a year between checks.³ Each report lists the credit accounts tied to your name, recent lender inquiries, and public records like bankruptcies. Reading them is the fastest way to catch accounts you never opened or address changes you never made.

Many people stagger requests across the three bureaus rather than pulling all three on the same day. Each bureau pulls data from different sources, so an unauthorized account might appear on one report but not another.² Rotating bureaus every few months gives you a more continuous view at no extra cost.

Bank and card statements catch fraud that hasn’t reached the bureaus yet. Thieves commonly test stolen card numbers with tiny charges to see whether anyone notices before running larger purchases.⁴ Any charge you don’t recognize, however small, is worth a call to your bank.

Lock Down Your Accounts and Documents

Most identity theft starts with a compromised password or a stolen document. Multi-factor authentication adds a second verification step beyond your password, like a code texted to your phone or generated by an authenticator app. Turning it on for every financial account means a stolen password alone won’t get a thief in. Use a unique, complex password for each account. A password manager handles the logistics so you don’t resort to reusing one login everywhere.

Public Wi-Fi at airports, hotels, and coffee shops lacks the encryption needed to protect data in transit. Logging into your bank or entering your Social Security number on an open network exposes that information to anyone monitoring the connection. A virtual private network or your phone’s mobile hotspot keeps the connection encrypted when you need to handle sensitive transactions away from home.

Be equally skeptical of emails that appear to come from your bank or a government agency. Phishing messages mimic official formatting but send you to fake login pages. Verify the sender’s actual email address and go directly to the institution’s website rather than clicking links in the message.

Physical security matters just as much. Shred anything that shows account numbers, tax details, or your Social Security number before discarding it. Watch your mail, since pre-approved credit offers and bank statements are prime targets for mailbox theft. A locked mailbox or a secure drop box at the post office shrinks that window. Store Social Security cards and birth certificates in a fireproof safe at home instead of carrying them in your wallet.

Fraud Alerts as a Lighter Alternative

A fraud alert takes a different approach than a freeze. Instead of blocking access to your credit report, it flags the file so lenders must take extra steps to verify your identity before approving new credit. There are three kinds:

Initial fraud alert (one year): Available to anyone who suspects their information has been compromised. You contact only one of the three bureaus, and that bureau must notify the other two.¹
Extended fraud alert (seven years): Available to confirmed identity theft victims who submit an identity theft report, typically generated through IdentityTheft.gov or a police report.¹
Active duty alert (one year, renewable): Available to military service members on deployment. It also removes you from prescreened credit and insurance offer lists for two years.

Alerts are easier to set up than a freeze and let legitimate applications go through, but they depend on the lender actually running the extra verification. A freeze creates a hard block; an alert creates a warning.

Protect Your Children’s Credit Too

Children are easy targets because nobody checks a seven-year-old’s credit. A thief can use a child’s Social Security number for years before the fraud surfaces, often not until the child applies for a first student loan or credit card. Federal law lets parents or legal guardians request a security freeze for any child under 16.¹ If a bureau doesn’t already have a file on the child, it must create one solely to freeze it, and that record can’t be used for credit decisions.⁵

You’ll need to show proof of your authority, such as a birth certificate, along with identification for both yourself and the child. The freeze is free. Guardians and conservators of incapacitated adults have the same right.¹

Head Off Tax Identity Theft Before Filing Season

Tax identity theft happens when someone files a fraudulent return using your Social Security number early in the season and claims your refund before you file. The IRS offers a free Identity Protection PIN, a six-digit number that must appear on your return for the IRS to accept it. Anyone with a Social Security number or individual taxpayer identification number can request one.⁶

The fastest route is through your IRS online account. If you can’t verify your identity online and your adjusted gross income on your last return was below $84,000 (or $168,000 for married filing jointly), submit Form 15227 and the IRS will call to verify your identity, then mail the PIN within four to six weeks.⁷ Taxpayer Assistance Centers offer an in-person option. Once enrolled, you get a new IP PIN every year.

If a fraudulent return has already been filed in your name, submit IRS Form 14039 (Identity Theft Affidavit), preferably online.⁸ Be prepared for a long wait. Recent Taxpayer Advocate data shows IRS identity theft cases taking roughly 22 months to resolve on average.⁹ Filing early and using an IP PIN are the two things that keep you out of that queue.

If You Spot Fraud: Report and Recover

When you discover identity theft, a structured reporting process creates the documentation you’ll need at every later step. Start at IdentityTheft.gov, the FTC’s reporting platform. The site generates a formal Identity Theft Report, which is the key document creditors and bureaus require when you dispute fraudulent accounts. It also builds a personalized recovery plan with pre-filled dispute letters.¹⁰

File a police report with local law enforcement. It strengthens your position with creditors and qualifies you for the seven-year extended fraud alert. Bring your FTC Identity Theft Report and any evidence of the fraud.

Call the fraud department at every financial institution where unauthorized accounts were opened or existing accounts were compromised, and give them your FTC report. Creditors are required to investigate and clear you of liability for unauthorized transactions. If someone used your Social Security number for employment or government benefits fraud, report it separately to the Social Security Administration’s Office of Inspector General at secure.ssa.gov/oig/fraud.¹¹

Keep a detailed log of every call, letter, and email: the name of the person you spoke with, the date, and what was discussed. Identity theft recovery pulls in multiple agencies and creditors moving at different speeds, and the log is what keeps nothing from falling through the cracks.

Medical Identity Theft Takes Extra Steps

Medical identity theft is especially dangerous because it can corrupt your health records. If a thief uses your identity to receive care, their diagnoses, blood type, allergies, and prescriptions can end up in your file and lead to wrong treatment decisions later. The financial side is bad too, with collection notices for procedures you never had.

Contact every doctor, clinic, hospital, pharmacy, and insurer where the thief may have used your information. Under HIPAA, you can request an accounting of disclosures showing who received your protected health information over the past six years, at no charge for the first request in a twelve-month period.¹² The provider must respond within 60 days. Review the records for visits and services that weren’t yours. Report errors to the provider in writing by certified mail with a copy of the record showing the problem. The provider must respond within 30 days and must notify other providers who may be holding the same wrong information.¹³

Disputing Errors on Your Credit Report

Finding an error on your credit report can cost you a higher interest rate or a denied application. Federal law gives you the right to dispute inaccurate information directly with the bureau, which must reinvestigate at no charge.¹ Submit your dispute in writing (online portals count), include copies of supporting documents, and identify exactly what information you believe is wrong.

The bureau generally has 30 days to investigate and must notify you of the results within five business days of finishing. If the investigation doesn’t resolve things to your satisfaction, you can add a brief statement to your file explaining why you believe the information is inaccurate, and that statement goes out with future reports. For errors that stem from identity theft, file an identity theft report at IdentityTheft.gov first. That gives you stronger leverage because creditors must block the fraudulent information rather than simply investigate it.

Your Legal Rights if a Bureau or Creditor Won’t Comply

The Fair Credit Reporting Act doesn’t just give you the right to dispute and freeze. It gives you the right to sue. If a credit bureau or creditor willfully fails to comply, you can recover actual damages or statutory damages between $100 and $1,000, plus punitive damages and reasonable attorney’s fees.¹⁴ If a bureau ignores your dispute or keeps reporting information you’ve proven is fraudulent, a consumer rights attorney can often take the case on contingency because the statute awards attorney fees to successful plaintiffs.

Be careful with credit repair companies. Under the Credit Repair Organizations Act, they cannot charge you any fee before actually performing the promised services, and you have the right to cancel any contract within three business days of signing for any reason.¹⁵ Everything a credit repair company does, you can do yourself for free. No company can legally have accurate, verified negative information removed from your report, whatever they promise.

1
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
2
Consumer Advice – FTC. Free Credit Reports
3
Consumer Advice – FTC. You Now Have Permanent Access to Free Weekly Credit Reports
4
U.S. Department of Justice. Justice Department Announces Crackdown on Networks That Steal Money from Consumer Accounts and Use Fraudulent Microtransactions to Hide the Activity from Banks
5
Consumer Advice – FTC. New Protections Available for Minors Under 16
6
Internal Revenue Service. Get an Identity Protection PIN
7
Internal Revenue Service. Form 15227
8
IRS. Form 14039 Identity Theft Affidavit
9
Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds
10
Federal Trade Commission. IdentityTheft.gov
11
Social Security Administration. Report Fraud – Office of Inspector General
12
eCFR. Accounting of Disclosures of Protected Health Information
13
Consumer Advice – FTC. What To Know About Medical Identity Theft
14
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
15
Office of the Law Revision Counsel. 15 USC 1679c – Disclosures