Fraud and identity protection
Freezes, fraud alerts, identity theft blocks, and scams to avoid. Each guide opens with a short answer, then shows the mechanism and the sources.
- Credit freeze vs. fraud alert vs. credit lock: what each one stopsA credit freeze stops the bureau from releasing your report to new lenders and is free under federal law. A fraud alert leaves your report visible but requires lenders to verify your identity before opening credit. A credit lock blocks access like a freeze, but it is a bureau product governed by its own terms rather than the freeze statute.
- Freezing all the bureaus, including the ones nobody mentionsFreeze Equifax, Experian and TransUnion first, since federal law makes those freezes free and fast. Then add Innovis, NCTUE (phone, pay TV and utility accounts), ChexSystems (bank accounts) and LexisNexis Risk Solutions. Each freeze is separate, none is shared with the others, and each company gives you its own PIN or login to lift it later.
- Identity theft recovery, step by step, in the order that worksCall the fraud departments of the companies involved, place a free fraud alert with one bureau, pull your reports, and file an Identity Theft Report at IdentityTheft.gov. That report is the document bureaus, lenders and collectors respond to. Then use it to close fraudulent accounts, block the bad entries from your reports, and freeze your credit.
- The 605B identity theft block: four business days, four documentsSection 605B of the Fair Credit Reporting Act (15 U.S.C. 1681c-2) requires a credit bureau to block information that resulted from identity theft within 4 business days of receiving proof of your identity, an identity theft report, a list of the fraudulent items, and your statement that they aren't your transactions. The bureau must then notify the furnisher.
- Fraudulent accounts and inquiries on your report: sort, then actFirst confirm it's fraud: unfamiliar names are often store cards issued by a bank, collection agencies, or loans sold to a new servicer. If it isn't yours, call the company's fraud department, file an Identity Theft Report at IdentityTheft.gov, and ask each bureau to block the account and any related inquiries under FCRA section 605B.
- CPNs: why "credit privacy numbers" are a trap, not a fresh startA credit privacy number (CPN) is a nine-digit number sold as a substitute for your Social Security number on credit applications. No government agency issues them. The FTC says these schemes often use stolen SSNs or improperly obtained EINs, and putting one on a credit application can violate federal laws against misrepresenting an SSN and lying to lenders.
- Spotting credit repair scams: the FTC's red flags and your CROA rightsA credit repair company that asks for payment before finishing the work, tells you not to contact the bureaus, or suggests disputing accurate items or using a new identity is breaking the law or setting you up to. The Credit Repair Organizations Act requires a written contract, bans advance fees, and gives you three business days to cancel.
- What to do after a data breach, sorted by what was exposedMatch your response to what the notice says was taken. A leaked Social Security number calls for credit freezes at Equifax, Experian and TransUnion plus an IRS Identity Protection PIN. A leaked password means changing it on every site where you reused it. A leaked card or bank account number means asking the bank for a new one.