Protecting What You Have Built

A credit file takes years to build and can be damaged in a week by somebody who is not you. This last lesson is about defending it, and the honest headline is that the strongest available protection is free, permanent, and used by far fewer people than use the paid alternatives.

A credit file takes years to build and can be wrecked in a week by somebody who isn't you. This lesson is about defending it — and the honest headline is that the strongest protection available is free, and far fewer people use it than pay for weaker things.

The story about you takes years to write and somebody else can spoil it in a week by pretending to be you.

This part is about protecting it. The best protection is free — and most people don't know about it.

The freeze

Locking the notebook

A credit freeze stops the bureaus from releasing your file to new lenders. Since almost no lender will open an account without pulling a report, a freeze blocks the mechanism new-account fraud depends on. It does nothing about someone taking over a card you already hold, or stealing a card number, and it only covers the three nationwide bureaus — some lenders and utilities pull from smaller specialty agencies too. It is free to place and free to lift, at every bureau, by law.

What it does not do is inconvenience you much. It does not affect your existing accounts, your score, or your ability to use the cards you already have. When you genuinely need new credit, you lift it — temporarily, or for one bureau — and place it again after.

You have to do it at each bureau separately, which is the only friction involved and the reason most people who intend to never finish. It is an afternoon, once.

A credit freeze stops the bureaus giving your file to new lenders. Since almost nobody will open an account without checking a report first, a freeze blocks the thing new-account fraud depends on. It doesn’t stop someone misusing a card you already have, and it covers the three big bureaus rather than every company that keeps records on you. It's free to turn on and free to turn off, at every bureau, by law.

It also barely inconveniences you. It doesn't affect accounts you already have, your score, or the cards in your pocket. When you actually need new credit, you lift it, then put it back.

You do have to do it at each bureau separately, which is the only annoying part and the reason most people who mean to never get around to it. It's one afternoon.

You're allowed to put a lock on your notebook so nobody new can read it.

Since nobody lends without reading first, that lock stops a pretend-you from borrowing in your name.

It's free. It doesn't stop you using things you already have. And you can unlock it whenever you actually need to.

Monitoring tells you after something has happened. A freeze prevents it. That ordering should decide how much you are willing to pay for the first one — which is usually nothing, because free versions are widely available and the paid tiers mostly add insurance and hand-holding rather than earlier detection.

What genuinely helps costs nothing: you can pull each of the three far more often than once a year now, so read them on a schedule you will actually keep rather than saving them all for one afternoon. Turn on transaction alerts from your own bank and card issuers, which are faster than any bureau product because they do not wait for a monthly report.

Monitoring tells you after something happened. A freeze stops it happening. That ordering should tell you how much a monitoring service is worth paying for — usually nothing, since free versions are everywhere.

What actually helps costs nothing. You can pull all three far more often than once a year, so read them on a schedule you’ll actually keep. And turn on alerts from your own bank and card, which are faster than anything a bureau sells because they don't wait for a monthly report.

Watching tells you after something bad happened. Locking stops it happening at all. Locking is better.

Two free things that help: read your own notebook regularly, not just once, and ask your bank to tell you every time money moves.

The mechanism is duller than the word "hacking" suggests. Somebody obtains enough identifying information about you to apply for credit as you. They apply. A lender pulls your report, sees an ordinary file, and opens the account. The first you hear of it is a bill, a collection notice, or an inquiry you did not make.

Two consequences follow. First, the damage lands on your file rather than theirs, which is why prevention matters more than vigilance. Second, an unfamiliar hard inquiry is an early warning worth taking seriously — it means somebody applied for something in your name and was checked out for it.

It's less dramatic than it sounds. Somebody learns enough about you to pretend to be you, asks to borrow, and the lender reads your good notebook and says yes.

Then the broken promise gets written in your notebook, not theirs.

That's why stopping it beforehand matters so much more than noticing afterward.

Prevention is most of this lesson, but the course would be dishonest to stop there — so, briefly, the order of operations.

Freeze all three files. It stops the next account being opened while you deal with the ones already open.

Place a fraud alert. Free, and you only have to contact one bureau: the law requires it to tell the other two. It obliges lenders to take extra steps to verify identity before opening credit. An extended alert lasting considerably longer is available once you have filed an identity theft report.

Report it. The federal identity-theft site walks you through a recovery plan and generates the report that unlocks the stronger protections, including the extended alert and the right to have fraudulent entries blocked.

Then dispute the entries as inaccurate, because they are — the accounts are not yours.

Do it in that order. The freeze stops the bleeding, the alert and the report unlock what you need, and the disputes clean up what already landed.

Prevention is most of this lesson, but here's the order if it has already happened.

Freeze all three files, so nothing new can be opened while you sort out what already was.

Place a fraud alert. It's free, and you only have to tell one bureau — the law makes it tell the other two. It requires lenders to take extra steps to check who they're dealing with.

Report it on the federal identity-theft site, which builds you a recovery plan and produces the report that unlocks the stronger protections.

Then dispute the entries, because they aren't yours.

Most of this lesson is about stopping it. But if it already happened, here's the order.

Lock the notebook, so nothing else can be added.

Tell one of the three companies to put a warning on it — they have to tell the other two, and it's free.

Ask a grown-up to help you report it to the people whose job this is.

Then say which parts aren't yours, so they can come out.

Freeze your files at all three bureaus, and lift them only when you are actually applying for something.

Automate at least the minimum payment on every account, so a busy week cannot become a delinquency.

Read your own reports across the year, and dispute anything wrong in writing.

Keep your oldest account open, even unused, if it costs nothing to keep.

Do not apply for credit you do not need, and do not apply for several things at once.

Treat every one of these as a habit rather than a project. The file is a record of ordinary months, and that is what makes it hard to fake and worth protecting.

Lock the notebook, and only unlock it when you really need to.

Make paying happen automatically, so a busy week can't break a promise.

Read your own notebook a few times a year, and speak up if something's wrong.

Keep your oldest account, even if you never use it.

Don't ask to borrow things you don't need.

None of these are big dramatic things. That's the point — the whole story is made of ordinary months.