After a data breach, a consumer can secure exposed accounts, place a free credit freeze with each of the three nationwide credit bureaus or a free fraud alert, check credit reports for accounts they did not open, report any identity theft to the FTC, watch for signs of misuse, and keep a dated record of every step.
A breach notice tends to arrive on an ordinary day. It might be a letter or an email saying a company you dealt with lost control of your name, your account numbers or your Social Security number. A consumer in that position may wonder what matters first, what is just noise, and whether anything has already gone wrong. This guide sets out the steps in order, what each one involves, and what federal law requires of the credit bureaus along the way.
There are seven steps. The federal tools described here, the credit freeze and the fraud alert, cost nothing to use.
Before You Start
According to the FTC's guidance on credit freezes and fraud alerts, a consumer does not have to wait for information to be exposed in a data breach, or misused by an identity thief, to get a credit freeze: anyone can place one, any time.
The Federal Trade Commission runs IdentityTheft.gov. Federal law names that site in 15 U.S.C. § 1681c-1(i)(6)(B) as the place where the FTC links to each credit bureau's freeze and fraud alert pages.
Step 1: Secure Your Accounts and Change Compromised Passwords
A consumer whose login details may have been exposed can change the password on that account. The same goes for any other account that uses the same password.
A password manager is one way to keep track of many unique passwords.
Multi-factor authentication is a second check beyond the password, such as a code sent to a phone.
Reviewing recent activity on bank, card and email accounts can reveal transactions or logins the account holder did not make.
When payment card numbers were exposed, a consumer can report the possible compromise to the card issuer and ask about a replacement card.
Step 2: Place a Credit Freeze or Fraud Alert with the Three Nationwide Credit Bureaus
A consumer reporting agency is a company that gathers information about consumers and sells reports about them. The freeze and fraud alert rules below are those for the nationwide agencies, which the CFPB and the FTC call the three nationwide credit bureaus.
Credit freeze. A security freeze, also called a credit freeze, is a restriction that prohibits a nationwide bureau from disclosing the contents of a frozen report to anyone who requests it, subject to the exceptions in 15 U.S.C. § 1681c-1(i). On a direct request from the consumer, with proper identification, the bureau must place the freeze free of charge not later than 1 business day after a request by toll-free telephone or secure electronic means, or 3 business days after a request by mail. Within 5 business days after placing the freeze, the bureau must send a confirmation and explain how to remove it. On a direct request and proper identification, the bureau must lift the freeze free of charge not later than 1 hour after a request by toll-free telephone or secure electronic means, or 3 business days after a request by mail. A temporary lift for a period the consumer chooses follows the same timing.
According to the CFPB, a consumer must contact each bureau separately to freeze credit. The CFPB also says freezes do not affect credit scores. A freeze does not block creditors on accounts the consumer already holds. It also does not apply to requests for employment, tenant-screening or insurance purposes.
Fraud alert. A fraud alert tells businesses checking a consumer's report to verify the person's identity before opening new credit in that name.
- An initial fraud alert is available to a consumer who asserts in good faith a suspicion of fraud or identity theft. It lasts not less than 1 year.
- An extended fraud alert requires an identity theft report. It lasts 7 years. It also takes the consumer off the bureau's lists for unsolicited credit and insurance offers for 5 years, unless the consumer asks to be put back.
Unlike a freeze, a fraud alert placed at one bureau is referred to the other two, under 15 U.S.C. § 1681c-1(a)-(b). The FTC's guidance on freezes and alerts describes both as free.
Step 3: Review Your Credit Reports for Unfamiliar Accounts
A credit report can show accounts that a consumer does not recognize. Placing a fraud alert opens up free reports. After an initial alert, the bureau must tell the consumer that a free copy of the file may be requested. After an extended alert, the consumer may request 2 free copies during the 12 months after the alert is placed. The disclosures must be provided within 3 business days of the request. The FTC page also explains how to get free credit reports generally. The CFPB notes that a consumer can still see their own file while a freeze is in place.
The FTC says that accounts in a consumer's name that the consumer does not recognize could be a sign of identity theft.
An unfamiliar account may be a sign of identity theft. A consumer who finds one may report it to the FTC, as Step 4 describes. A separate page covers identity theft accounts on credit reports. Another covers what happens when a report shows an account that isn't yours.
Step 4: Report Identity Theft to the FTC and, If Needed, File a Police Report
Identity theft means someone used another person's information without permission, for example to open credit.
The FTC's identity theft report is completed at IdentityTheft.gov. According to the FTC, an extended fraud alert is available to people who have experienced identity theft and have completed an FTC identity theft report or filed a police report. The FTC says renewing an extended alert means resubmitting that report.
A police report is the other document the FTC page names.
The rules for disputing inaccurate information are covered in a separate guide to wrong information on credit reports.
Step 5: Monitor for Signs of Ongoing Misuse
According to the FTC, it is a good idea to regularly check what is in a credit report. Also according to the FTC, active duty servicemembers and National Guard members can get free electronic credit monitoring from each of the three bureaus.
A collector contacting a consumer about a debt tied to identity theft is a separate topic, covered by a different federal law.
The FTC's IdentityTheft.gov is built around a recovery plan that a consumer can work through step by step.
Step 6: Know That State Law May Add Protections
State law may add protections, and it differs from state to state.
Separately, the credit bureaus carry the duties in 15 U.S.C. § 1681c-1, described in Step 2.
Whether a particular breach gives rise to a legal claim depends on its facts. A general overview of how consumer lawsuits work explains the stages if a matter goes that far.
Step 7: Keep Records of Everything
A dated record of each step can be useful if a dispute comes up later. Items worth keeping include:
- the breach notice itself, with the date it arrived
- correspondence with the breached company, creditors, credit bureaus and any agency
- the date and result of each step, such as when a freeze was placed, a report filed or a dispute sent
- statements, screenshots and written confirmations of disputes or resolutions, if fraudulent charges or accounts appear
Freeze confirmations belong in the file as well. A simple log listing each action, its date and the response received can matter if a dispute or legal question comes up later.
Typical timeline
The freeze placement and confirmation deadlines set out in Step 2 run in business days. An initial fraud alert lasts at least 1 year, and an extended alert lasts 7 years.
When the process gets complicated
A fraudulent account already appears
A report of identity theft, and a dispute of the account with the bureau, become the focus. The bureau's duties then come into play.
A freeze must be lifted for an application
A consumer may lift a freeze temporarily. The FTC suggests finding out which bureau a lender uses and lifting the freeze only there.
A child's information was exposed
For a "protected consumer" under 16, a parent or guardian with sufficient proof of authority can request a freeze. If no file exists, the bureau creates a record in order to freeze it.
Collection calls about unknown debts
Debt collection tied to identity theft involves a different federal law and its own dispute rights.
Requesting a Case Review About a Data Breach
This page does not cover state breach-notification rules. A request for a consumer rights case review may be made through Federal Consumer Rights.
