Credit Freezes, Fraud Alerts and Monitoring

The most damaging kind of identity theft is not a stolen card, which the bank usually refunds. It is a new loan, card or phone contract opened in your name, which can sit unnoticed until a collector calls or a mortgage is declined. This chapter explains the one free step that blocks most of it, a credit freeze, how it differs from a fraud alert, what monitoring can and cannot do, and how to get errors removed from your file.

Why your credit file is the target

Your credit file is the record that lenders, card issuers, landlords, phone companies and some insurers check before they deal with you. Three national bureaus keep one each: Equifax, Experian and TransUnion. When someone applies for credit in your name, the lender pulls one of those files to decide. If the file is open to any lender who asks, a thief with your name, date of birth and Social Security number, all of which have leaked in large data breaches, can often get approved.

There are two broad kinds of fraud to guard against:

• New-account fraud: credit opened in your name. A freeze stops most of it.
• Account takeover: a criminal gets into an account you already have. A freeze does nothing here; the account security in chapter 2 is the defence.

The credit freeze: free, and the strongest single step

A credit freeze (also called a security freeze) locks your file so that a new lender cannot see it. Since most lenders will not approve credit without a report, applications in your name fail.

What you should know about it:

• It is free by federal law, to place and to lift, at all three bureaus. You do not need to be a fraud victim.
• You need to freeze at each bureau separately. A lender may check any one of them, and you do not control which.
• It does not hurt your credit score, and your existing lenders, your card issuers and you yourself can still see your file. Prescreened offers, employment checks with your consent and some insurance uses are also unaffected.
• Lifting it is quick. When you ask online or by phone, the law requires a bureau to place a freeze within one business day and to lift it within one hour. You can lift it for a set period, such as the week you apply for a mortgage, and it refreezes on its own.
• Children can be frozen too. Parents and guardians can place a freeze for a child under 16, which prevents a clean file from being used for years before anyone notices.

The main cost is friction. You need to keep the bureau logins or PINs safe and remember to lift the freeze before applying for credit, a new phone contract or sometimes a rental. For most people that is a few minutes a year.

Beyond the big three. Some specialty agencies keep files that matter for particular kinds of fraud. ChexSystems is used by banks deciding whether to open checking accounts, and the National Consumer Telecom and Utilities Exchange is used by phone and utility companies. Innovis is a smaller fourth credit bureau. Each offers its own freeze. Freezing them as well closes routes that a big-three freeze leaves open.

Fraud alerts: a warning label, not a lock

A fraud alert tells lenders who check your file to take extra steps to confirm it is really you, usually by calling you, before opening credit. Unlike a freeze, you place it with one bureau, and that bureau must tell the other two.

• Initial fraud alert: lasts one year and can be renewed. Anyone who believes they are at risk can place one, for example after a lost wallet or a data breach notice.
• Extended fraud alert: lasts seven years. It requires an identity theft report, such as the one you can create at IdentityTheft.gov (chapter 4). It also takes you off prescreened credit offer lists for five years.
• Active duty alert: for service members away on duty, lasting one year.

An alert is weaker than a freeze because it depends on each lender actually following up. Its advantage is that you never need to lift it. Some people use both: a freeze as the lock and an alert as a second layer.

Monitoring: detection, not prevention

Monitoring tells you after something has happened. It cannot stop an application; a freeze can. That makes monitoring a supplement, not a substitute.

The free options already cover most needs:

• Your full reports, weekly and free, from all three bureaus at AnnualCreditReport.com, the only site authorized by federal law for this. Read them for accounts, addresses and hard inquiries you do not recognise.
• Free alerts from the bureaus themselves, from many banks and card issuers, and from free credit-score services. Most will notify you of new accounts and inquiries.
• Your own statements and transaction alerts, which catch account takeover faster than any credit monitor.

Paid identity protection plans add monitoring of more data sources (dark web listings, change-of-address requests, payday loan applications), help from a recovery specialist, and an insurance benefit for recovery costs. Whether that is worth it depends on how much your time is worth and whether you would act on the alerts. Over years, the cost adds up.

At $25 a month, a plan costs $3,000 over 10 years, or $3,667 if the same money had been kept in savings earning 4.0%. Set that against what the free freeze, free reports and free alerts already do, and against the recovery help the plan would provide. For many households the free combination is enough. Someone who has already been a victim, or who lacks the time to deal with recovery paperwork, may value the service more.

Disputing errors on your report

Errors are common, and fraud creates them on purpose. Under the Fair Credit Reporting Act you can dispute anything inaccurate or incomplete, and the bureau must generally investigate within 30 days, forward your evidence to the company that reported the item, and fix or delete what cannot be verified.

1. Get the report from AnnualCreditReport.com and mark every item that is wrong: accounts that are not yours, wrong balances, late payments you did not make, addresses where you never lived.
2. Dispute with each bureau that shows the error, online or by mail. Explain what is wrong in plain words, say what you want corrected, and attach copies (never originals) of proof.
3. Dispute with the company that supplied the information as well. It has its own duty to investigate.
4. Keep records: confirmation numbers, dates, copies of letters, names of people you spoke with.
5. Escalate if needed. If an error is not fixed, you can add a short statement to your file and file a complaint with the Consumer Financial Protection Bureau, which forwards it to the company and tracks the response.

For accounts opened by an identity thief, the faster route is the identity theft block in chapter 4.