About the Credit Freeze & Post-Breach Action Plan
Your data has leaked. Most advice you will find says “freeze your credit at the three bureaus” and stops. That advice is incomplete in a way that matters: a credit freeze does not stop somebody opening a mobile phone contract in your name, because carriers check NCTUE. It does not stop them opening a chequing account, because banks check ChexSystems. Both are free to freeze and neither appears on most lists.
The other thing routinely got wrong is freeze versus lock. A freeze is a right under the Fair Credit Reporting Act — free for everyone by law, with a statutory one-hour turnaround for online requests. A lock is a product, governed by the bureau’s own terms, which they can change or charge for. The bureaus advertise locks hard because a lock keeps you in their app. When you want what the law guarantees, ask for the freeze.
Every URL, phone number and postal address below was read off the operator’s own page on 2026-08-29 rather than recalled, and each entry says where it came from. One correction that fell out of doing that: SageStream and LexisNexis are the same freeze, not two, which several widely-copied checklists still get wrong.
- A right under the Fair Credit Reporting Act
- Free for everyone, by federal law, permanently
- Statutory turnaround: one hour to apply or lift online or by phone
- Cannot be conditioned on buying anything or accepting marketing
- Enforceable — a bureau that fails to honour it has broken the law
- A product, governed by that company’s terms of service
- Free today, at the company’s discretion; often bundled with a paid tier
- No statutory turnaround — the terms decide
- Usually requires their app, an account, and agreement to their terms
- If it fails you, your remedy is the contract, not the statute
The two are marketed almost interchangeably, and the lock is pushed far harder, because a lock keeps you inside the bureau’s app where other products can be sold to you. A lock is not useless — it is genuinely more convenient to toggle. But it is not the thing the law guarantees you, and if you are only going to do one, do the freeze.
The whole plan with every phone number and postal address written out, for working through away from a screen — or for handing to a relative who would rather do this on paper and by telephone.
How to Use the Post-Breach Action Plan
Tick what was exposed and work down the list. It is ordered by urgency rather than by which organisation is best known, and every entry carries the real web address, the real telephone number and the real postal address, so you never have to search for a bureau’s freeze page and risk landing on somebody’s paid lookalike. Your ticks are stored in this browser, because this is a job most people do across several evenings rather than in one sitting.
Three Freezes Is Not Enough, and This Is the Gap
Nearly every published guide names Equifax, Experian and TransUnion and stops there. Those three cover credit — loans, cards, mortgages. They do not cover the two things a fraudster with your Social Security number is most likely to do next.
- NCTUE, the National Consumer Telecom & Utilities Exchange, is the file a mobile carrier or an energy supplier checks. Opening a phone contract in somebody else’s name is one of the most common downstream frauds after a breach, partly because it gives the fraudster control of a phone number — and a phone number is a second factor for a great many accounts. A credit freeze does not touch this file.
- ChexSystems is the file banks check before opening a chequing account. An account opened in your name becomes a landing pad for other fraud and a mess to unwind. Again, a credit freeze does nothing here.
- Innovis is a fourth credit bureau, smaller than the big three but genuinely used. Freezing it takes a few minutes and costs nothing.
- LexisNexis Risk Solutions underpins insurance and identity verification. Worth noting: it also operates SageStream, and several widely-copied checklists list them as two separate freezes. They are one.
Freeze Versus Lock: One Is a Law, the Other Is a Product
This distinction decides whether the protection you have is enforceable, and the marketing is designed to blur it. A security freeze is a right written into the Fair Credit Reporting Act. It is free for everyone, permanently, by federal statute; the bureaus must apply or lift it within one hour of an online or telephone request; and they cannot make it conditional on buying anything.
A credit lock is a feature in a bureau’s app, governed by that company’s terms of service. It may be free now. It comes with no statutory turnaround, and if it fails to work your remedy is a contract dispute rather than a statutory violation. Locks are advertised far harder than freezes for a straightforward reason: a lock keeps you inside an app where other products can be sold to you. Locks are not useless — toggling one is genuinely easier. But if you do only one thing, do the freeze.
The Two Doors a Credit Freeze Leaves Open
Even with all seven bureaus frozen, two significant routes remain, and both are closed by free government services that take minutes.
- Tax-refund fraud. Somebody files a return in your name early in the season and collects the refund; you discover it when your own return is rejected as a duplicate. An IRS Identity Protection PIN is a six-digit number that must appear on your return, and without it a filing in your name is rejected outright. It is free and open to anyone who can verify their identity.
- Your Social Security account. If you have never created a my Social Security account, somebody with your details can create it for you and then view your earnings record or redirect benefits. Claiming it yourself is the entire defence, and it is the step missing from almost every post-breach checklist.
The Freeze Worth More Than Your Own
If there are children in the household with Social Security numbers, freezing their files is the highest-value action on this page. A child’s credit file is blank, attached to a number nobody will check for fifteen years, and therefore close to ideal for a fraudster: the damage compounds undiscovered until the child applies for a student loan or a first car and finds a decade of accounts they have never heard of. Freezing a minor’s file is a federal right, but the process is more paperwork-heavy than an adult freeze — the bureaus require identity documents for both you and the child, usually by post, which is why it is worth starting before you need it.
A Freeze Is Meant To Be Lifted
The commonest reason people leave themselves unprotected is the belief that a freeze is a one-way door. It is not. Every bureau supports a temporary thaw — for a date range, or for one named creditor — it is free, and the law requires an online or telephone lift to take effect within an hour. When you apply for anything, ask the lender which bureau they pull; most check only one or two, and you can lift only those and leave the rest closed.
While you are here: the Breach Directory will tell you which breaches an address has actually appeared in, the Two-Factor Auth Coverage Planner covers what to do about the accounts themselves, and the Password Strength Estimator is worth a minute if a password was among what leaked. Browse every Security & Privacy tool for more.
This is general information about publicly documented consumer rights and processes, not legal or financial advice, and it describes United States federal law and US bureaus specifically. Directory entries were verified at source on 2026-08-29; operators do change their pages and telephone numbers, so if something here does not match what you find, trust the bureau.
Frequently Asked Questions
What is the difference between a credit freeze and a credit lock?
A freeze is a right. It is written into the Fair Credit Reporting Act, it is free for everyone by federal law, and the bureaus must apply and lift it within statutory time limits — one hour for an online or telephone request. A lock is a product: a feature governed by that company's own terms, which they can change, bundle with a paid subscription, or attach conditions to. The bureaus market locks heavily because a lock keeps you inside their app, and the two words are used almost interchangeably in their advertising. When you want the protection that the law guarantees, ask for the freeze.
Does freezing my credit hurt my credit score?
No. A freeze restricts who can open your credit file; it changes nothing inside it. Your score is unaffected, your existing accounts continue to work normally, and you can still use your cards, pay your mortgage and receive your statements. The only thing it stops is a new creditor pulling your file — which is precisely the thing you want stopped.
Why freeze anything besides the big three?
Because the big three only cover credit. Somebody opening a mobile phone contract in your name is checked against NCTUE, the telecoms and utilities exchange. Somebody opening a chequing account is checked against ChexSystems. Neither is touched by a credit freeze, both are free to freeze, and both are omitted from almost every article on the subject. This is the gap that makes most published checklists incomplete rather than merely brief.
Should I freeze my children's credit?
If they have a Social Security number, yes, and it is the most valuable freeze in the household. A child's credit file is a blank one attached to a number nobody will check for fifteen years, which makes it the ideal target — the fraud is typically discovered when the child applies for their first student loan or car finance and finds a decade of history. Freezing a minor's file is a right under federal law, though the process is more paperwork-heavy: the bureaus require proof of identity for both you and the child, usually by post.
How do I apply for a mortgage or a card with everything frozen?
You lift the freeze temporarily, then put it back. Every bureau supports a temporary thaw for a date range or for a specific creditor, it is free, and the law requires an online or telephone lift to take effect within one hour. Ask the lender which bureau they pull — most check only one or two — and lift only those. A freeze is meant to be lifted and reapplied; it is not a one-way door, and treating it as one is why people leave themselves unprotected.
