Last updated: September 2026
A data breach notification lands in your inbox: some company lost your name, email, Social Security number, or payment details. It's unsettling, but the situation is fixable if you act in the right order. The steps below are based on guidance from the Federal Trade Commission (FTC) and the three major credit bureaus. Do them in sequence — the first two matter most.
1. Freeze Your Credit With All Three Bureaus
A credit freeze (also called a security freeze) restricts access to your credit file, which makes it much harder for a criminal to open new accounts in your name. It is the single most effective thing you can do after a breach involving your Social Security number. Freezes are free under federal law, do not affect your credit score, and do not stop you from using your existing credit cards.
You must place a freeze with each bureau separately: Equifax, Experian, and TransUnion. Our step-by-step guide to how to freeze your credit walks through exactly how to contact each one, what information you'll need, and how to temporarily lift a freeze when you apply for credit yourself.
2. Set Up Fraud Alerts
A fraud alert tells creditors to take extra steps to verify your identity before opening new accounts. Place an initial fraud alert with just one bureau — it is required to notify the other two. An initial alert lasts one year and can be renewed. Unlike a freeze, a fraud alert doesn't block access to your file; it adds a verification step. Many people use both: a freeze as the lock, a fraud alert as the warning sign.
3. Change Passwords and Turn On Two-Factor Authentication
If the breach exposed login credentials, change those passwords immediately — and change them anywhere you reused the same one. Password reuse is how a single breach becomes five breached accounts. Use unique passwords for every account (a password manager such as NordPass makes this manageable) and turn on two-factor authentication wherever it's offered, starting with your email, bank, and primary social accounts. Your email account is the master key: if an attacker controls it, they can reset everything else.
4. Monitor Your Financial Accounts
Review every bank, credit card, and investment account for charges or transfers you don't recognize — including small ones, since thieves sometimes run tiny test transactions before larger fraud. Set up transaction alerts on your banking apps so you get notified of activity in real time. Check statements at least monthly going forward, and pull your free credit reports at AnnualCreditReport.com to look for accounts you didn't open.
5. File Your Taxes Early (or Get an IRS Identity Protection PIN)
Stolen Social Security numbers are frequently used for tax identity theft — filing a fraudulent return in your name to steal the refund. One of the best defenses is to file your taxes as early as you can each year, before a criminal files in your place. You can also request an IRS Identity Protection PIN (IP PIN), a six-digit number that prevents anyone else from filing with your SSN.
6. Report Identity Theft to the FTC
If you see evidence that your identity is actually being misused — not just exposed — use our signs of identity theft checklist, then report it at IdentityTheft.gov. The FTC will generate a personal recovery plan and an Identity Theft Report, which you'll need when disputing fraudulent accounts with creditors. File a police report as well if you know the thief or need documentation for a creditor. Keep copies of everything: letters, dispute confirmations, and reference numbers.
7. Consider Ongoing Monitoring
After the urgent steps are done, decide whether you want ongoing monitoring or would rather rely on the free tools above. A credit freeze does most of the heavy lifting for free. If you'd prefer alerts, insurance, and professional help with recovery handled for you, a paid identity protection service is the convenience option — our guide to whether you need identity theft protection breaks down the tradeoffs honestly. One option worth a look is Aura, which bundles three-bureau monitoring with a VPN and antivirus; see our full Aura review for details.
The Bottom Line
A breach notice is a warning, not a sentence. Freeze your credit, set fraud alerts, lock down your logins, and watch your accounts — those four steps neutralize the vast majority of follow-on fraud. Do them calmly and in order, and you'll be in far better shape than most breach victims.