Breach Response — Freezes, Monitoring, Fraud Alerts, and Your Identity Recovery Plan

If your data shows up in a breach notice, the most expensive mistake is doing nothing. Companies often soothe with “free credit monitoring,” but monitoring only tells you after someone has tried to use your identity. The strongest move is to shut the front door on new credit entirely, then work a deliberate recovery plan that covers taxes, utilities, phones, mail, and medical records—the places thieves pivot when credit is locked tight. This guide is a field manual: what to do first, how to escalate, where the traps are, and how to build a recovery that lasts.

What “Breach Response” Really Means (and Why Freezes Beat Monitoring)

A breach is exposure, not necessarily fraud. Your goal is to convert exposure into minimal risk. Credit monitoring watches for changes and pings you with alerts; it doesn’t stop anyone from opening new accounts. A security freeze blocks most new-account abuse by preventing creditors from pulling your files, and federal law made freezes free in 2018. An initial fraud alert tells lenders to take extra steps to verify identity; it lasts a year and is also free. If you have an Identity Theft Report (more on that below), you can place an extended fraud alert for seven years. The FTC confirms all of this, including the one-year initial alert and seven-year extended alert, and that freezes are free and durable. (Consumer Advice)

The strongest first step after a breach is therefore: freeze first, monitor second. The FTC and USA.gov both underline that freezes are free, can be placed with each bureau online or by phone, and must be active within one business day if requested electronically; mail requests take up to three business days. (Consumer Advice, USAGov)

The First 24–48 Hours: Contain, Document, Decide

The clock starts when you learn your information may be exposed. If the breached company is offering identity services, accept them, but treat them as supplemental. The FTC’s breach guidance explicitly recommends considering a freeze or an alert and using IdentityTheft.gov to escalate if you find misuse. (Federal Trade Commission)

Start a case file immediately. IdentityTheft.gov builds a personalized plan and produces letters, affidavits, and instructions that satisfy banks, creditors, and the credit bureaus. It’s the federal one-stop hub for documenting identity theft and generating an Identity Theft Report—the legal key you’ll need for stronger protections like extended fraud alerts. (IdentityTheft.gov, bulkorder.ftc.gov)

If the breach involves health data, know that HIPAA requires covered entities to notify affected individuals “without unreasonable delay” and always within 60 days of discovery; large breaches (≥500 individuals) also trigger HHS notice and, in some cases, media notice. That timing matters because it frames when you can expect details to arrive—and when to push for them. (HHS.gov, Legal Information Institute)

Credit Freezes, Fraud Alerts, and “Locks”: How the Levers Differ

A security freeze at Equifax, Experian, and TransUnion prevents most new creditors from accessing your report. You can lift it temporarily when you need credit. It doesn’t affect your score or current accounts, and it’s free to place and lift. The FTC’s consumer advice and USA.gov’s explainer set the ground rules and timelines for activation and thawing. (Consumer Advice, USAGov)

A fraud alert is a signal on your file that tells creditors to verify more carefully before granting credit. An initial alert lasts one year and can be placed by contacting any one of the three major bureaus (they must relay it to the others). With a valid Identity Theft Report, you can set an extended alert for seven years by sending that report to each bureau. IdentityTheft.gov and the FTC detail both paths and the documentation. (Consumer Advice, IdentityTheft.gov)

A credit lock is a bureau-specific, app-based toggle marketed by bureaus. It can be convenient, but it’s a product, not a legal right, and usually bundled with paid services. The GAO and independent coverage emphasize that freezes are the legally backed, no-cost baseline; locks are optional conveniences. (U.S. GAO, Investopedia)

Regardless of what you choose, take advantage of the now-permanent right to get free weekly reports through AnnualCreditReport.com and scan for new accounts or inquiries. That “weekly forever” extension was announced in 2023 and remains in effect. (Consumer Advice, Annual Credit Report)

Beyond the Big Three: Where Thieves Go When Credit is Frozen

When credit files are locked down, fraudsters pivot. They open utility, telecom, or cable accounts; they try to port your mobile number; they open bank accounts to run checks and peer-to-peer payments. That’s why you widen the freeze perimeter to specialty databases and add telecom safeguards.

For telecom and utilities, freeze your file at the National Consumer Telecom & Utilities Exchange (NCTUE). The CFPB’s directory and NCTUE itself provide the freeze line and portal. (Consumer Financial Protection Bureau, NCTUE)

For bank account screening, request your file and consider a freeze with ChexSystems and review your record with Early Warning Services (EWS), the bank-owned risk consortium behind Zelle and many account-opening checks. ChexSystems publishes freeze instructions; the CFPB lists EWS’s consumer contact info and rights. (ChexSystems, Consumer Financial Protection Bureau)

For insurance/claims, public records, and identity analytics, freeze LexisNexis and Innovis. Both publish consumer freeze portals and timelines, and a LexisNexis freeze can also slow down some instant-approval flows that lean on its identity services. (LexisNexis Risk Solutions, Innovis)

For mobile phone account takeover and SIM-swap/port-out fraud, add or verify your account port-out PIN and enable the carrier’s account-takeover protection features. The FCC has adopted rules requiring stronger customer notifications when SIM changes or port-out requests occur, and it advises setting PINs/passwords with your carrier. (FCC, Federal Register)

Taxes, Government Benefits, and the IP PIN Advantage

Tax refund fraud is a favorite because it cashes out quickly. The IRS Identity Protection PIN (IP PIN) is a six-digit code the IRS requires on your return; without it, a fraudster can’t successfully e-file as you. The IRS now invites all taxpayers to opt in. You can request an IP PIN online after identity verification, and the IRS refreshes the PIN annually. The IRS has doubled down in 2025 urging broad enrollment before filing season. (IRS)

If your Social Security number is involved, add “Extra Security” to your my Social Security account and consider asking SSA to Block Electronic Access, which prevents online and automated telephone access to your record until you remove the block. The SSA explains the block process and when it’s appropriate. (Social Security)

Finally, monitor your mail because change-of-address fraud and stolen statements are still common. The U.S. Postal Inspection Service maintains reporting and guidance; sign up for USPS Informed Delivery to see images of incoming mail and report anything suspicious. (USPS, USPS FAQs)

What Credit Monitoring Is (and Isn’t)

It’s fine to redeem breach-offered monitoring, but treat it as detection, not prevention. The U.S. Government Accountability Office (GAO) reviewed identity theft services and concluded that credit monitoring helps detect new-account fraud but does little for existing-account misuse and doesn’t prevent new accounts like a freeze can. Identity monitoring and insurance have mixed value and uneven service levels. That’s why this guide puts freezes first. (U.S. GAO)

If you want additional signals, dark-web credential monitoring can be useful to trigger password changes when your email/password pairs surface. CISA recognizes credential monitoring as one tool among many, but it’s not a substitute for account hardening with multifactor authentication (MFA) and passkeys/security keys. (CISA)

Building a 90-Day Recovery Timeline You Can Stick To

In the first week, freeze the big three, NCTUE, ChexSystems, and (optionally) Innovis and LexisNexis; enable your carrier account lock and port-out PIN; enroll for an IRS IP PIN; and generate your Identity Theft Report at IdentityTheft.gov if you see misuse. The FTC and USA.gov detail how quickly freezes must be honored and how to lift them when needed. (USAGov, Consumer Advice)

Through week four, pull your free weekly reports from AnnualCreditReport.com and comb through inquiries and new tradelines. Because weekly access is now permanent, you can monitor aggressively without cost. (Consumer Advice)

By day 60, if the breach was medical, confirm you received proper HIPAA notifications or follow up with the provider; for any misuse, use the IdentityTheft.gov plan to send dispute letters and affidavits. (HHS.gov)

Across 90 days, tighten accounts with MFA, replace any reused passwords that were exposed, and document every letter, call, and upload; that paper trail is often what convinces a reluctant creditor to remove a fraudulent account or pause collections. IdentityTheft.gov is designed to centralize that documentation. (IdentityTheft.gov)

Children, Students, and Family Members: Special Cases

Kids are tempting targets because no one checks a minor’s credit for years. Federal law allows parents and guardians to freeze a child’s credit; in many cases the bureau will create a file and then freeze it. The FTC’s most recent guidance on protecting children’s identities and the CFPB’s instructions on checking whether a child has a file explain the process and required documentation. Many bureaus now allow teens 16–17 to request or remove freezes themselves. (Consumer Advice, Consumer Financial Protection Bureau)

If a dependent’s SSN was exposed, add freezes for them and consider IP PINs for the household once they are eligible. The Wall Street Journal and IRS emphasize the IP PIN’s value in blocking refund fraud at the source. (IRS, Wall Street Journal)

Telecom, SIM Swaps, and Number Port-Outs

Your phone number is the skeleton key for password resets. The FCC has pressed carriers to strengthen their SIM-swap and port-out defenses and to notify consumers on SIM changes or port requests. You should set a carrier account PIN, enable any “number lock” or “account takeover protection,” and watch for alerts. If your carrier was in the breach cohort, change that PIN immediately. (Federal Register, FCC)

Health Care and Medical Identity Theft

Medical identity theft can leave you with bills for someone else’s care and corrupt your medical history. HIPAA requires prompt notifications; if you get a notice, request an accounting of disclosures and ask the provider’s fraud unit how they’re securing your file. HHS’s Breach Notification Rule outlines timelines and reporting obligations; if those aren’t met, you can complain to HHS OCR. (HHS.gov)

Mail, Address Changes, and Government Records

Register your USPS Informed Delivery and monitor images of incoming mail; report identity theft or suspicious holds/forwarding to the Postal Inspection Service. If a driver’s license number was exposed, check your state DMV for replacement procedures. For employment identity theft, you can lock your SSN within E-Verify so it can’t be used in a new E-Verify check without your consent. (USPS, E-Verify)

What to Say When You Need a Human to Help

When you call a creditor, utility, or collector about a fraudulent account, use the Identity Theft Report number from IdentityTheft.gov as your anchor. Say you are “disputing an account opened due to identity theft, supported by an FTC Identity Theft Report,” and request the account be closed, all adverse information deleted, and any collection paused while they investigate. If a bureau or lender insists on a police report, you can file one locally, but under federal rules the FTC Identity Theft Report generally suffices for placing an extended fraud alert and for many disputes. (bulkorder.ftc.gov)

A Note on “Free Monitoring” in Breach Letters

Companies often offer 12–24 months of monitoring and “identity theft insurance.” The GAO’s review found these services can detect certain frauds and help with restoration steps, but they are not a replacement for freezes and strong account security. Take the freebie; just don’t mistake it for a locked door. (U.S. GAO)

Frequently Missed Protections That Matter

Many people never widen the freeze to NCTUE and ChexSystems, leaving utility, phone, and bank-account openings exposed. Others skip the IRS IP PIN and are surprised by a rejected tax return in February. Still others accept a credit lock in an app but never set a legal freeze at all three bureaus. The FTC, CFPB, IRS, and USA.gov sources cited throughout this guide are the definitive playbook for closing those gaps. (Consumer Financial Protection Bureau, ChexSystems, IRS, USAGov)

Glossary (Plain-English)

Security Freeze. A legal block on your credit files at a credit bureau that prevents most new lenders from viewing your report, cutting off many forms of new-account fraud. Free to place/lift; does not affect your score. (Consumer Advice)
Fraud Alert (Initial / Extended). A notation on your files telling lenders to verify identity before opening accounts. Initial lasts one year; extended lasts seven years when supported by an Identity Theft Report. (Consumer Advice)
Identity Theft Report. A report generated via IdentityTheft.gov documenting your case; unlocks stronger FCRA rights (like seven-year alerts) and comes with pre-filled dispute letters. (bulkorder.ftc.gov)
Credit Lock. A bureau’s proprietary, often paid, on/off control for access to your file. Convenient, but not a legal freeze. (Investopedia)
NCTUE. The National Consumer Telecom & Utilities Exchange, a reporting system utilities and telecoms use to vet new customers. You can obtain your report and freeze it. (Consumer Financial Protection Bureau)
ChexSystems / Early Warning Services. Banking risk databases used when you open a checking account. You can get your file; ChexSystems supports freezes; EWS provides consumer disclosures and scoring details. (ChexSystems, Consumer Financial Protection Bureau)
LexisNexis / Innovis. Specialty consumer reporting agencies powering identity, insurance, and risk decisions; both support freezes and consumer disclosures. (LexisNexis Risk Solutions, Innovis)
IP PIN. The IRS Identity Protection PIN required to file your return; blocks tax refund fraud by making your six-digit code mandatory on your return. Available to all taxpayers who verify identity. (IRS)
SIM-Swap / Port-Out. Fraud in which a criminal convinces your carrier to move your number to their SIM or a different carrier, intercepting MFA codes. The FCC requires stronger notifications and supports using PINs to guard against it. (Federal Register)
Informed Delivery. USPS service that emails you images of your incoming mail; helps spot unauthorized change-of-address or stolen mail patterns. Report issues to the Postal Inspection Service. (USPS)

Sources & Further Reading

Federal Trade Commission — Freezes, Alerts, and Breach Response: multiple Consumer Advice pages; IdentityTheft.gov; breach guidance; free weekly credit reports. (Consumer Advice, IdentityTheft.gov, Federal Trade Commission)
USA.gov & AnnualCreditReport — How to place/lift freezes; activation timelines; official portal for weekly reports. (USAGov, Annual Credit Report)
IRS & SSA — IP PIN opt-in and reminders; SSA Extra Security and Block Electronic Access. (IRS, Social Security)
Telecom & SIM-Swap — FCC consumer guide; Federal Register rule on SIM swap/port-out notifications. (FCC, Federal Register)
Specialty Reporting — NCTUE, ChexSystems, Innovis, LexisNexis; EWS via CFPB directory. (NCTUE, ChexSystems, Innovis, LexisNexis Risk Solutions, Consumer Financial Protection Bureau, Early Warning)
Kids & Families — FTC child identity theft guide; CFPB check-if-child-has-report. (Consumer Advice, Consumer Financial Protection Bureau)
Health Data — HHS HIPAA Breach Notification Rule. (HHS.gov)
Strategy & Limits — GAO reviews of identity theft/monitoring services; CISA #StopRansomware credential monitoring context. (U.S. GAO, CISA)
Postal & Mail Safety — U.S. Postal Inspection Service; USPS Informed Delivery. (USPS)