Protect Yourself from Credit Identity Theft
A few free, federally guaranteed tools will stop almost all new-account credit identity theft. The credit-monitoring industry — much of which is owned by the credit bureaus themselves — would prefer you didn't know how powerful these are.
1. Freeze your credit at all three bureaus
A credit freeze (also called a security freeze) blocks lenders from pulling your credit report unless you lift the freeze first. No new report pulled = no new account opened. Freezes are free, last indefinitely, and can be lifted in minutes when you actually need credit.
- Equifax — equifax.com/credit-freeze · 1-888-298-0045
- Experian — experian.com/freeze · 1-888-397-3742
- TransUnion — transunion.com/credit-freeze · 1-800-916-8800
You must freeze at all three separately — a freeze at one bureau does not freeze the others.
The freeze and thaw clocks the bureaus don't advertise
Under the FCRA, the nationwide CRA must place a freeze within one business day if you request by phone or electronic means, three business days if by mail. To thaw(temporarily lift) or remove the freeze, the CRA has one hour by phone or electronic means, three business days by mail. If a CRA blows these deadlines, document it — that is itself an FCRA violation.
2. Freeze the specialty bureaus too
Banks, landlords, employers, and insurers pull from specialty CRAs. Freezing only the Big 3 leaves those doors open.
| Bureau | Freeze contact |
|---|---|
| ChexSystems (checking/deposit accounts) | chexsystems.com or 1-800-428-9623 |
| NCTUE (utility/telecom) | nctue.com or 1-866-349-5355 |
| LexisNexis Risk Solutions | consumer.risk.lexisnexis.com |
| Innovis | innovis.com/securityFreeze or 1-800-540-2505 |
| SageStream / ID Analytics | sagestreamllc.com/security-freeze |
3. Place a fraud alert (in addition to the freeze, if you choose)
A fraud alert tells lenders to take extra steps to verify identity before opening new credit in your name. It does not block reports the way a freeze does — so a freeze is generally stronger. But fraud alerts have one advantage: you only need to contact one bureau and the law requires it to notify the other two.
- Initial fraud alert — 1 year, free, no Identity Theft Report required (FCRA § 605A(a)).
- Extended fraud alert — 7 years, free, requires an Identity Theft Report (§ 605A(b)).
- Active-duty alert — 1 year for deployed servicemembers (§ 605A(c)).
4. Get an IRS Identity Protection PIN
The IRS now allows any taxpayer to request an IP PIN — a six-digit number you include with your federal tax return. Without the PIN, fraudulent returns in your name get rejected. Request one at irs.gov/ippin.
5. Opt out of prescreened credit offers
Pre-approved credit offers are a low-effort vector for new-account fraud. Opt out for five years (or permanently in writing) at optoutprescreen.com or 1-888-5-OPT-OUT (1-888-567-8688).
6. Freeze your kids' credit too
Federal law requires the nationwide CRAs to freeze the file of a "protected consumer" — a minor under 16 or anyone under the protection of a guardian or conservator — on request and for free. If the bureau has no file on the protected consumer, the law requires it to create a record and freeze it. If a minor under 16 already has a credit file, that file is almost certainly fraudulent.
7. Lock down your Social Security number
Create a my Social Security account at ssa.gov/myaccount and enable a self-lock if you don't need credit checks or new-employer verifications. Review your Social Security Earnings Statement at least yearly to catch employment identity theft.
8. Boring digital hygiene that actually matters
- •Use a password manager and unique passwords for every financial account.
- •Turn on multi-factor authentication everywhere — ideally an authenticator app rather than SMS.
- •Don't click on links in unsolicited e-mails or text messages.
- •Shred mail with account numbers, statements, prescription bottles, and pre-approved credit offers.
- •Don't carry your Social Security card. Memorize the number.
The 30-minute version
Freeze at Equifax, Experian, TransUnion, Innovis, NCTUE, LexisNexis, ChexSystems. Opt out of prescreened offers. Get an IRS IP PIN. Turn on MFA everywhere. Pull all three credit reports next week. You will have done more to protect yourself than 95% of consumers.