What to do after a data breach, sorted by what was exposed

Breach letters tend to arrive weeks or months after the break-in, written in careful legal language, with an enrollment code for free credit monitoring near the bottom. A lot of people sign up for the monitoring, file the letter and consider the matter closed.

Monitoring covers one risk, and it covers it late: it tells you after a new account shows up. The most useful sentence in the letter is the one listing what was taken, because a stolen password and a stolen Social Security number are different problems. The fix for one does nothing for the other.

Start with the line that says what was taken

Most notices describe the categories of information involved: names, Social Security numbers, dates of birth, driver’s license numbers, card or account numbers, usernames and passwords, sometimes health insurance details. Write down every category that applies to you. That list drives everything below.

If the notice is vague, or arrived by email or text from an address you can’t confirm, go to the company’s website by typing the address yourself and look for its breach page or support number there. Scammers ride on real breaches with look-alike notices, and a link in an unverified message is the last place to enter your SSN.

The checklist, one row per type of data

The “do now” column comes from the FTC’s data breach guidance and its identity theft recovery plan. The “this week” column is the follow-through.

If you can’t log in to an account whose password leaked, the FTC says to contact the company and ask how to recover or shut down the account.

If your Social Security number was in it

An SSN is the hardest item on the list to replace, and it’s what new-account fraud runs on. The FTC’s sequence is short: take the free monitoring if the company offers it, get your free credit reports and look for accounts or charges you don’t recognize, consider a freeze, and if you skip the freeze, “at least consider placing a fraud alert.” It also suggests filing your taxes early, before a scammer can.

A freeze is the stronger choice for a stolen SSN because the number doesn’t expire. An initial fraud alert lasts one year (renewable) and lets lenders see your report as long as they verify your identity. A freeze keeps new lenders from seeing your report at all until you lift it, and federal law makes it free, requires an online or phone freeze to be in place within one business day, and requires an online or phone lift within one hour (15 U.S.C. 1681c-1(i)). The trade-offs are laid out in credit freeze vs. fraud alert vs. lock.

Each bureau needs its own request:

A fraud alert only needs one call, because the bureau you contact must pass it to the other two. Freezes don’t travel that way. Banks, phone carriers and insurers also check companies like ChexSystems, NCTUE, Innovis and LexisNexis, each with its own freeze; their contacts are in freezing every bureau.

Freezing doesn’t conflict with the free monitoring. The freeze statute exempts a credit monitoring service you’ve subscribed to, so the monitoring keeps working on a frozen file.

Then lock down your tax account. The IRS Identity Protection PIN is a six-digit number that “prevents someone else from filing a tax return using your Social Security number.” Anyone with an SSN or ITIN who can verify their identity can get one, it’s voluntary, and the fastest route is your IRS online account. It’s good for one calendar year, and the IRS generates a new one each year. Parents can get one for dependents, but for a child under 18 the IRS requires one of its slower enrollment options instead of the online tool.

If a card or bank number was in it

Card numbers stolen in a breach are the easiest loss to contain, because federal law caps what you owe, and the card in your wallet wasn’t taken. Per the FTC, when only the number is used and the physical card isn’t lost or stolen, you aren’t responsible for unauthorized credit card charges. For a debit card, you aren’t responsible if you report the unauthorized charges within 60 calendar days after the statement showing them is sent.

Example: say your debit card number was in a retailer’s breach, you didn’t replace the card, and a $400 charge you didn’t make shows up on a statement sent October 5. Sixty calendar days from October 5 is December 4. Report it on or before December 4 and, under the rule the FTC describes, the $400 isn’t yours to cover. Debit card money comes out of your checking account immediately, so even a covered charge can leave you short on rent while the bank investigates. That’s why the FTC’s advice is to cancel and replace the card as soon as you learn it was exposed, not after a charge appears.

For a bank account number, the FTC’s advice is to close the account and open a new one. Budget an afternoon for moving direct deposit and every automatic payment, and ask the bank how it will handle checks and payments still in flight on the old account.

The calls that follow a breach

Leaked data makes scam calls sound legitimate. Someone who has your name, address and the last four digits of your SSN can sound a lot like your bank or a government agency. The FTC warns specifically about callers who threaten arrest unless you pay, even when they know part of your SSN or say they’re from the IRS.

A few rules hold up well. Don’t confirm personal information to anyone who contacted you first. Hang up and call the company at a number from its website or the back of your card. And be wary of anyone selling paid “breach protection”: the core tools here (freezes, fraud alerts, credit reports, the IP PIN and the FTC’s recovery site) are all free.

When the breach turns into fraud

A breach is exposure. Identity theft is when someone uses what was exposed. The signs are usually concrete: an account or hard inquiry you don’t recognize on your credit report, an IRS notice about a return you didn’t file, a collection letter for a debt that isn’t yours, or bills that stop arriving.

At that point you’ve moved from prevention to recovery. Report it at IdentityTheft.gov or 1-877-438-4338 to get an Identity Theft Report, then follow identity theft recovery, step by step. If the first sign is a strange line on your report, start with fraudulent accounts and inquiries on your report to rule out an innocent explanation before you dispute it.

Your first week, in order

1. List every type of data the notice says was exposed, and confirm the notice through the company’s own website.
2. If a card or bank account number leaked, call the bank today and get a new number.
3. If a password leaked, change it on that site and on every site where you reused it.
4. If your SSN leaked, freeze Equifax, Experian and TransUnion, and save each PIN or login in a password manager.
5. Request an IRS Identity Protection PIN through your IRS online account.
6. Enroll in any free monitoring the company offers, using the official site.
7. Pull your reports free at AnnualCreditReport.com, where all three bureaus offer free weekly reports, and look for accounts, inquiries and addresses you don’t recognize. Check again every few months.
8. Freeze the specialty agencies when you have another half hour.