Identity theft: freezes, fraud alerts and recovery

Your Social Security Number (SSN) is one of the most valuable pieces of information in your life — it serves as the key that opens access to credit, employment, and government services. Unfortunately, it's also the top target for identity thieves. The good news is that the strongest protection is free and takes only minutes to set up: a credit freeze at all three major credit bureaus.

Understanding Your Social Security Number

Your Social Security Number is a nine-digit identifier issued by the Social Security Administration. While it was originally created only for Social Security benefits, it has become the de facto master key to your entire financial identity — used to verify who you are when opening bank accounts, applying for credit, getting a job, and filing taxes. This widespread use is why protecting your SSN is critical.

If you are an immigrant or international student without an SSN, you may have an ITIN (Individual Taxpayer Identification Number) issued by the IRS, which serves a similar function for tax purposes. Some banks and financial institutions will accept an ITIN as an alternative to an SSN.

The Credit Freeze: Your Strongest Free Defense

What Is a Credit Freeze?

A credit freeze — also called a security freeze — restricts access to your credit report at the three major credit bureaus: Equifax, Experian, and TransUnion. When your credit is frozen, lenders cannot pull your credit report to approve new accounts. This means that even if a thief has your SSN or personal information, they cannot open a credit card, car loan, mortgage, or other account in your name, because the lender will be blocked from viewing your credit file.

The freeze is powerful because most new-account identity theft depends on criminals being able to get an instant credit decision. Without access to your report, their application is almost always denied.

How to Place a Credit Freeze

Placing a credit freeze is completely free by federal law. You must contact each of the three bureaus separately — a freeze at one bureau does not automatically cover the others.

• Equifax: Visit equifax.com, call 1-888-298-0045, or mail Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348
• Experian: Visit experian.com, call 1-888-397-3742, or mail Experian Security Freeze, P.O. Box 9554, Allen, TX 75013
• TransUnion: Visit transunion.com, call 1-800-916-8800, or mail TransUnion LLC, P.O. Box 2000, Chester, PA 19016

The fastest method is online. You will need to verify your identity by providing personal information and answering security questions based on your credit file. Once placed, the freeze becomes permanent and lasts until you lift it — there is no expiration date.

By federal law, if you request a freeze online or by phone, the bureau must place it within one business day. If you request by mail, it must be placed within three business days. You will receive a written confirmation with instructions for lifting the freeze when needed.

How to Lift a Credit Freeze When You Need New Credit

When you want to apply for a mortgage, car loan, credit card, apartment rental, cell phone contract, or any service that requires a credit check, you will need to temporarily lift your freeze. You can lift a freeze online, by phone, or by mail at whichever bureau the lender uses.

The easiest method is online. You can schedule a temporary lift for a specific time period — typically a few days is sufficient for a lender to complete a credit pull. You can also permanently remove the freeze if you plan to apply for credit frequently. If you requested the freeze by phone or online, the bureau must lift it within one hour. If you requested by mail, it takes up to three business days.

You will have received a PIN or password when you placed the freeze. Keep this information safe; you will need it each time you want to modify your freeze status.

Fraud Alerts: A Lighter Alternative

A fraud alert is a less restrictive option than a credit freeze. Instead of blocking access to your credit report entirely, a fraud alert instructs lenders to verify your identity before approving new credit — typically by calling the phone number on file. This can slow down a fraud application without preventing you from opening your own accounts.

There are two types of fraud alerts: an initial alert (which lasts one year and is free to place) and an extended alert (which lasts seven years and requires proof that you are an identity theft victim). Both are free. When you place an alert at any one of the three bureaus, that bureau must automatically notify the other two.

Freeze vs. Alert: Which Should You Use?

The key difference: a freeze prevents all access to your credit report for new accounts; an alert allows access but requires the lender to verify your identity. A freeze is stronger protection but requires you to lift it when you want to apply for credit yourself. An alert is more convenient if you plan to apply for credit frequently, but offers less protection — a determined fraudster might trick a lender's verification process.

If you are not applying for new credit in the near future, a freeze is the stronger choice. If you need to maintain access for frequent applications (such as shopping for a mortgage or car loan), a fraud alert is more practical. You can also use both tools together for additional protection.

Protect Your SSN: When to Give It and When to Refuse

The best defense against identity theft is controlling who has your SSN in the first place. Many organizations ask for it out of habit, not necessity. Before providing your number, ask yourself: Is this really required?

When Your SSN Is Truly Required

Your SSN is legally required in these situations:

• Employment: Your employer needs your SSN to report your wages to the IRS and Social Security Administration, and to file your W-2 form
• Banking and credit: Opening a bank account, applying for a credit card, mortgage, auto loan, or other line of credit
• Government agencies: Applying for Social Security benefits, Medicare, federal student loans, or state benefits like Medicaid or unemployment insurance
• Tax filing: Filing federal and state income tax returns
• Government-issued ID: Some states require an SSN when applying for a driver's license or state ID card (this varies by state)

When You Can (and Should) Refuse

Just because an organization asks for your SSN does not mean you must provide it. Common situations where SSN requests are not mandatory include retail store loyalty cards, gym memberships, doctor or dental offices, restaurants, hotels, travel bookings, and nonprofits. In these cases, ask why they need it and whether another form of ID — such as your driver's license number — will work instead.

Keep in mind: a business can legally refuse to serve you if you decline to provide your SSN. However, you have the right to ask why it's needed and to push back if the request seems unnecessary. Private businesses cannot require an SSN just because they want to — there must be a legitimate business or legal reason.

What to Do If Your Identity Is Stolen

If you discover that your identity has been stolen or you suspect it — perhaps after learning your SSN was exposed in a data breach — act quickly. The faster you respond, the easier recovery will be.

Report to the FTC

The Federal Trade Commission (FTC) provides an official online tool to report identity theft and create a recovery plan. Visit IdentityTheft.gov (or RobodeIdentidad.gov for Spanish) and file a report. You can also call 1-877-438-4338.

When you file an Identity Theft Report with the FTC, you gain important legal rights. The report and your recovery plan walk you through each step: closing fraudulent accounts, removing bogus charges, correcting your credit reports, and reporting the theft to police if needed. If you create an account, the FTC system will update your plan as you progress and pre-fill forms and letters for you. Save and print your Identity Theft Report immediately — it is your proof to creditors and credit bureaus that fraud occurred.

Place a Fraud Alert

Once you have reported the theft to the FTC, place a fraud alert at one of the three credit bureaus (they will notify the others). An initial fraud alert is free and lasts one year. If your identity theft is confirmed, you can request an extended fraud alert, which lasts seven years and requires you to submit proof of the theft (your Identity Theft Report or a police report).

When you place a fraud alert, you are also entitled to a free copy of your credit reports from all three bureaus. Check these carefully for any accounts or charges you do not recognize.

Review Your Credit Reports

Get your free credit reports from all three bureaus by going to AnnualCreditReport.com. (This is the official source; do not use other websites claiming to offer free reports.) Review each report carefully for accounts you did not open, inquiries you did not authorize, or charges you do not recognize. Make a detailed note of any fraudulent activity.

Close Fraudulent Accounts and Dispute Charges

Contact the fraud department of any company where an unauthorized account was opened in your name. Explain that someone stole your identity and opened a fraudulent account. Ask them to close the account and confirm in writing that you are not liable for the charges. Keep copies of all correspondence.

For fraudulent charges on existing accounts, contact your bank or credit card company. Report the unauthorized transactions. Under federal law, your liability for credit card fraud is limited to $50 per card, and if you report the fraud before the card is used, you typically have zero liability. Under most state laws, you are not responsible for debt on fraudulent new accounts opened in your name without your permission.

Tax Identity Theft

If someone filed a tax return using your SSN, the IRS has a specific process. File IRS Form 14039 (Identity Theft Affidavit) online through IdentityTheft.gov, or download and mail the form to the IRS. Attach a copy of your Identity Theft Report from the FTC. The IRS will investigate and contact you.

Additional Protection Measures

While a credit freeze is your strongest shield against new-account fraud, identity theft can take other forms — fraudsters might commit fraud on your existing accounts, medical identity theft, employment fraud, or tax fraud. Complement your freeze with these practices:

• Monitor your credit: Check your credit reports regularly (at least annually, free through AnnualCreditReport.com). Many credit card companies and banks now offer free credit monitoring.
• Use strong, unique passwords: Protect your bank and credit card accounts with passwords that are at least 12 characters and include letters, numbers, and symbols. Do not reuse passwords across different accounts.
• Enable two-factor authentication: Require a second verification step (usually a code sent to your phone) when logging into sensitive accounts.
• Check your financial accounts regularly: Review bank and credit card statements monthly for any unauthorized transactions.
• Be cautious with personal information online: Avoid posting your SSN, date of birth, or mother's maiden name on social media or unsecured websites.

Special Considerations for Immigrants and International Students

If you do not yet have an SSN but are working or building credit in the United States, you may have an ITIN. An ITIN is vulnerable to identity theft just like an SSN. All the advice in this article applies: protect your ITIN closely, place a credit freeze if possible, and report any suspected misuse to the FTC immediately.

Some banks and lenders will accept an ITIN in place of an SSN for opening accounts or getting a loan. When asked for an SSN, offer your ITIN and ask whether it will be accepted. You can apply for an ITIN yourself using IRS Form 7 if you do not already have one.

If your visa or immigration status changes, contact U.S. Citizenship and Immigration Services (USCIS) to update your information. Notify your bank and any employers of any changes to your legal name or address. These steps reduce the risk that someone else will be able to assume your identity.