How do I freeze my credit, and how do I know if my email was in a breach?

Three pages in this library answer this, and one Resource Bank entry covers the case where the breach has already been used against you. Freeze it at all three is the credit freeze. Check your email against the breach list is how you find out what has leaked and what to change. Turn on every alert covers the card you already have, which a freeze does not.

If you are in the US, place a free credit freeze at all three nationwide credit bureaus, not one. Freeze it at all three says many people say a freeze at one bureau is not enough. The three are separate companies, some people say, and a lender chooses which one to check, so a thief’s application goes through wherever the file is open. The federal consumer-protection agency’s page on credit freezes and fraud alerts lists the three and how to reach each, and one person says the whole job takes ten to twenty minutes for all three. One person points out there is a fourth bureau that can be frozen too.

It costs nothing. Since September 2018 federal law has made placing and lifting a freeze free at every bureau, and the agency’s page, dated August 2025, says so in one sentence. Older discussions describe a fee that varied by state: the page says that was true when people wrote it and is no longer. Some people say, and one person points out as a correction, that the paid “lock” a bureau advertises is the same door as the free freeze with fewer clicks and a subscription attached, and the page’s try-it step says to use the free freeze.

What a freeze does, and what it does not. A freeze stops a lender who does not already have you as a customer from seeing your file, so a new account cannot be opened in your name, including by you, until you lift it. Each of these is one person’s warning on the page: it does not touch cards you already have, does not stop a company you already deal with from seeing the file, does not stop a collector reporting to it, and does not stop the bureaus selling your data. Some people say a fraud alert is a different tool: it asks lenders to verify it is you before opening an account. The agency’s page says an initial alert lasts one year and can be renewed, and the extended alert for people who have been through identity theft lasts seven. In one discussion some people prefer the alert as lower friction; one person says years of renewing alerts hurt their access to credit and the freeze was better.

Then read your reports. Many people say there is one website the law set up for free reports, annualcreditreport.com, and that the sites that look like it trap you into a paid subscription. Some people say freezing is not enough on its own: pull all three reports and read them for an address you did not live at, an inquiry you did not make or an account you did not open. Some people say checking your own report is a soft inquiry and does not lower your score. One person says to set up any free monitoring account you want before you freeze, because afterwards you would have to lift the freeze to set it up.

The honest friction. Some people say a freeze adds steps to every legitimate application, a loan, a card or a utility, and one person adds phone and internet providers; some say that when you apply for something yourself you lift it at all three, because some lenders check only one and a frozen file reads as no history at all, which one person warns can mean a worse rate rather than a refusal. Some people warn that some jobs require a credit check and some contract services will not sign you up frozen. Lifting takes minutes online, some people say, sometimes immediately, sometimes after a quarter of an hour. If you are in the middle of a mortgage, some people say do not open a dispute, because an open dispute makes the score unstable and lenders stop. One person goes further: ask your mortgage agent before any action on your file, new accounts and closed ones included.

Can a thief just lift it? The page says one discussion did not fully settle this, and it carries the argument as people’s experience. One person warns that one bureau lifts a freeze on personal details alone, the kind that leaks carry; one person says a thief took over their bureau account and lifted the freeze. Some people say a bureau sends a text or email when a freeze is lifted, so you would see an unauthorized thaw and reverse it, and that a strong, unique password on each bureau account is the defence. The page says what to do when you get a thaw notice you did not ask for is not covered there. Today the freeze lives behind an online account at each bureau; the PIN that people who froze years ago describe is not in the agency’s current page. One person warns that being unable to verify your identity with a bureau can leave you unable to lift your own freeze when you need to.

To find out whether your email was in a breach, type your email address, and only the address, into a breach-checking site. Check your email against the breach list says many people say a breach-checking service will tell you which known leaks your address appears in, and often which password went with it. The page does not name a site, because people argue about the safety of typing an address into any such site. Some people say the widely known breach-checking service is a genuine tool; others say submitting your address to a site you cannot vouch for can feed a marketing list or a phishing page dressed as a checker. What both sides name as the decider is the site’s standing: an established, widely known service is one people treat as safe, an unknown one is not. The page’s own line is to type an address into a checker, never a password. One person searches paste sites for their address as a second check, and one person warns that searching your own username can bring up the dumps themselves, passwords and all. Some people add a check that costs nothing: your mail account’s own recent-activity page, which lists where and when it was opened; one person says a sign-in from a place you were not is your answer.

If it shows a leak, the leak is not the danger; the reuse is. Some people say a leaked address-and-password pair is tried against every other site, and the page gives an order of work. First the email account, because one person says whoever holds your mail can reset everything else, and one says a changed password is the one immediate action that stops whoever is inside. Then every account where you used the password that leaked, each given its own, in a password manager if you will not remember them. Then the second step of verification on the email account, which some people call the defence a stolen password cannot get past. The United Kingdom’s national cyber-security centre’s advice, read for the page, says the same three things in the same order: the email account is the route to identity theft, a password manager helps you keep the passwords apart, and two-step verification is recommended. One person points out that a text telling you someone has signed in is not two-step verification, because the second step has to be required to finish the login, and one person warns that a code by app beats a code by text. One person warns not to tie the second step to a phone alone without printing the backup codes. The page does not cover how to recover an account that is already taken: the provider’s recovery page is the place, and the sooner the better.

A freeze is not the tool for a card you already hold. Turn on a notification for every transaction on it. Freeze it at all three says that if the fraud you fear is on a card you already hold, the issuer is the tool, not the freeze. Turn on every alert says the best defence against both card fraud and the subscription you forgot about is a free setting: notifications for every transaction, with the threshold as low as your bank allows, not amounts over fifty. An unexplained charge of a dollar or two is frequently not an error: it is a test of whether a stolen card number is still live before anything larger is attempted with it, so any sensible-sounding threshold sits above it. The page’s own block at the top: if credit is something you struggle with, skip its credit-card paragraphs, because the move that does the most is the free setting on any account you already have.

If someone has already used your details, IdentityTheft.gov is where you tell them what happened and get a personal recovery plan with the steps to take, and the site has sample letters and contact details for the credit bureaus. If you make an account, it walks you through each step and fills in forms and letters for you. It is in the Resource Bank and cited below. The freeze page does not cover legal recourse after identity theft, and neither does this answer.

Who this is not for. The freeze page is US only: one person points out the freeze as described does not exist in most of Canada, and the pages do not cover other countries. If you apply for credit, flats or jobs several times a year, the page says the friction is real and the fraud-alert route is the lower-friction alternative people use. If your name is common, or you share it with someone famous, the breach page’s alert-on-your-name advice is not for you, though the breach check still is, because it works on an address, not a name. If what worries you is a partner reading your email, the breach page does not carry that; it is about strangers and leaks. And if you are hoping for anonymity against a state or a determined investigator, some people warn plainly that none of this is that.