The two kinds, and why the distinction drives everything
Existing-account fraud is someone using an account you already have: a card number lifted from a breach, a takeover of a login, a fraudulent charge. You notice it because the account is yours and you look at it. The institution has a fraud process, the card gets reissued, and the matter usually closes in weeks.
New-account fraud is someone using your identifying information — name, date of birth, Social Security number, address history — to open something new. A credit card, a phone contract, a loan, a utility account, a rental application, sometimes a tax filing or a benefits claim. You do not notice, because you are not looking at accounts you do not know about. The discovery event is typically a collections letter, a denied application, a card arriving that you did not order, or a filing rejected because one was already submitted.
Almost everything on this page is about the second kind, because the first kind mostly handles itself and the second does not. The mechanism that fuels it is data that has already leaked — see the data breach page for why your Social Security number is probably in someone's file and what that does and does not mean.
The freeze
A security freeze at the consumer reporting agencies is the strongest single thing an ordinary person can do about new-account fraud, and it is free. The mechanism is simple: when a lender receives an application in your name, they pull a credit report to decide. If your file is frozen, they cannot pull it, so in the ordinary course the application does not proceed. The fraudster does not have to be caught or identified — the transaction just fails.
You place it separately with each of the three nationwide bureaus, Equifax, Experian and TransUnion, through each one's own site or phone line. You get a PIN or an online login to manage it, and you can lift it — for a set window, or for a specific creditor — when you actually want credit. Lifting and replacing is free as well. Doing it online is generally quick; how quick depends on the bureau and on how you request it, so plan a day or two of margin before a mortgage application rather than relying on an instant lift.
Be clear about what a freeze does not do. It does not touch your existing accounts, so cards, bank accounts and logins you already have can still be misused. It does not stop tax filings, benefits claims, medical services, or employment applications, none of which necessarily involve a credit pull. It does not prevent a breach. And it will inconvenience you at the moment you apply for something, which is the point — the inconvenience is the mechanism.
There is also a separate freeze available at specialty consumer reporting agencies used for things like check acceptance and telecom, and a separate process for a child's file. Most people never need those; the three main bureaus are where the leverage is.
Freeze, alert, lock — what the words mean
| Tool | What it does | Where it falls short |
|---|---|---|
| Security freeze | Blocks access to your credit file, so most new-credit applications cannot be processed. Free at each nationwide bureau, and reversible whenever you want. | You must do it at each bureau separately, and remember to lift it before applying for credit. No effect on existing accounts. |
| Fraud alert | A flag asking lenders to take extra steps to verify identity before extending credit. Free, and placing one with a single bureau generally results in it being communicated to the others. | It is a request for care, not a block. It expires, and extended versions generally require documentation of actual identity theft. |
| Credit lock | A bureau product, often app-based, that turns file access on and off quickly | A commercial service governed by that company's terms rather than the statutory freeze, and sometimes bundled with a paid subscription. If you want the durable version, ask specifically for a security freeze. |
| Credit monitoring | Alerts you when something appears on your file | Detection after the fact, not prevention. Useful alongside a freeze, not instead of it. |
| Identity theft insurance and restoration services | Reimbursement for certain out-of-pocket costs, and help managing the paperwork | Coverage is narrow and defined by the policy. Read what it actually pays for before assuming it covers a loss. |
If you are choosing one thing and stopping: freeze all three. It costs nothing and it is the only item on the list that prevents rather than reports.
The first week, in order
| Step | Detail |
|---|---|
| 1. Start a log | One document or notebook. Date, who you spoke to, what was said, reference numbers, and what they said would happen next. You will make the same explanation a dozen times, and the log is what makes the twelfth one easy. |
| 2. Freeze all three bureaus | Equifax, Experian, TransUnion. Save the PINs and confirmations somewhere you will still have them. |
| 3. Report at identitytheft.gov | The FTC's site walks through what happened and produces a report plus a step-by-step recovery plan. Many institutions ask for that report, so getting it early saves repetition later. |
| 4. Contact each affected institution's fraud department | Not general customer service. Say the words "identity theft" and ask them to note the account, close or reissue what is compromised, and tell you what documentation they need. |
| 5. Pull your credit reports | The official free source is annualcreditreport.com. Read all three, since accounts do not always appear on every one, and note anything you do not recognize — including addresses and employers, which are often the first sign. |
| 6. Dispute the fraudulent items | In writing, with each bureau and with the furnisher of the information. Keep copies of what you send and how you sent it. |
| 7. Secure the accounts underneath | New unique passwords, starting with your primary email, and multi-factor authentication everywhere it is offered. The phishing page explains why email comes first and why text-message codes are the weakest option. |
| 8. Consider a police report | Some creditors ask for one. Practice varies enormously by department, so treat this as something to do if asked rather than a universal step. |
Order note: freeze before you spend a day on phone calls. It is the step that stops the bleeding while you deal with everything else.
Tax, benefits and medical versions
These sit outside the credit system, which is why a freeze does not cover them and why they are often found late.
The tax pattern is a return filed in your name before yours, claiming a refund. You discover it when your own filing is rejected as a duplicate, or when a notice arrives about wages from an employer you never had. The response runs through the tax authority's own identity theft procedure, and it changes from year to year — get it from the agency directly rather than from a summary, and be aware that letters claiming to be about this are themselves a common phishing theme.
The benefits pattern is a claim for unemployment or another program filed using your details, usually surfacing as a notice or a tax form for benefits you never received. Report it to the state agency that administers the program, and expect the process to be state-specific.
Medical identity theft is the hardest to unwind because the record is not just financial. Someone receives care under your name and their information ends up in your file, which can affect later treatment. Signs include an explanation of benefits for care you did not receive, a collections notice from a provider you have never seen, or a plan telling you a benefit limit is exhausted. Request your records from each provider involved and from the insurer, and correct them in writing.
Two categories worth checking even without a trigger. A child normally has no credit file at all, so the existence of one is itself the finding — and children are attractive targets precisely because nobody looks for eighteen years. And after a death in the family, the deceased person's identity is exploited often enough that notifying the bureaus and the relevant agencies is a standard part of settling affairs.
What actually happens over the following months
The honest version: this is administrative work spread over a longer period than anyone expects, and the frustration is that you have to prove a negative repeatedly to organizations that each have their own process. Items get removed and reappear when another furnisher reports them again. A collections agency that bought the debt may not have the fraud notation. Something surfaces two years later on a report you had stopped checking.
Three habits make it manageable. Keep everything in one place, including the dates. Follow up in writing after any phone call that produced a promise, even one line by email — a written record changes the conversation later. And check all three reports periodically for the next couple of years rather than assuming it is finished, since the free official reports cost nothing to pull.
What this page cannot tell you is what you are entitled to, how long any specific dispute must take, or what any institution owes you. Those depend on the type of account, the state, the agreement you signed, and rules that change. When it matters — a large debt, a mortgage denied, a court or collections notice — that is the point to get advice from someone who can look at your actual documents, and many areas have legal aid or a state consumer protection office that will talk to you at no cost.
The part people do not prepare for is not the paperwork. It is discovering that a stranger has been living inside your name for months, and the low-grade unease afterward every time an unfamiliar envelope arrives. That fades, and the freeze is the thing that lets it fade — because after it is in place, the next attempt fails without needing your attention at all.
Questions people ask
Does a credit freeze cost anything, and can I undo it?
Freezing and unfreezing your file at the nationwide credit bureaus is free, and it is fully reversible. You place it separately with Equifax, Experian and TransUnion through each one's own site or phone line, and you get a PIN or login to manage it. When you want to apply for credit, you lift it — either for a set period or for a specific creditor — and put it back afterward. Requests made online are usually handled quickly, but how quickly depends on the bureau and the method, so leave yourself a day or two of margin before a mortgage or car loan application rather than counting on an instant lift.
If I freeze my credit, am I protected?
Against new-account fraud, largely — a lender who cannot pull your file generally cannot approve an application in your name, which is why the freeze is the highest-value single step. But it does nothing about the accounts you already have. Card numbers, bank logins and account takeovers are unaffected, and so are tax filings, benefits claims, medical treatment under your name and most employment checks, because none of those necessarily involve a credit pull. Treat the freeze as one strong lock on one specific door, and keep watching statements and your credit reports for the rest.
What is the difference between a fraud alert and a freeze?
A freeze blocks access to your credit file, so most applications for new credit cannot proceed at all. A fraud alert leaves the file open but flags it, asking lenders to take extra steps to verify that the applicant is really you. The alert is a request for care rather than a block, it expires after a period, and the longer version generally requires documentation that you have actually been a victim. Both are free. If you are choosing, the freeze is stronger; there is no reason you cannot have both.
How do I know if someone has opened accounts in my name?
Read your credit reports from all three bureaus — the official free source is annualcreditreport.com, and accounts do not always show up on every bureau, so one report is not enough. Look past the account list at the addresses, employers and inquiries sections, because an address you have never lived at is often the earliest visible sign. Outside the credit system, watch for a tax filing rejected as a duplicate, a notice about benefits you never claimed, an explanation of benefits for care you did not receive, or collections letters for anything unfamiliar. For a child, the finding is simply that a credit file exists at all.
Is paid identity theft protection worth buying?
It depends on what the specific product does, and the marketing tends to blur two very different things. Monitoring tells you after something appears on your file, which is useful but is detection, not prevention — the freeze is the part that prevents, and it is free. The restoration help some services include has genuine value if you would struggle with weeks of phone calls and letters, and that is a reasonable thing to pay for. The insurance component is usually narrow and reimburses specified out-of-pocket costs rather than stolen funds, so read the policy rather than the advertisement. Freeze first, then decide whether the rest is worth a subscription to you.