A breach notice shows up. It says your information may have been exposed. It offers a phone number and maybe some monitoring. Then comes the real question: freeze or alert? And which one first?

Short answer: the sources behind this piece do not settle the order. A lot of breach advice sounds more certain than it is, so this guide says what is known, what is not, and how to decide without guessing.

Close-up of a folded paper letter on a wooden kitchen table beside the edge of a laptop, lit by soft morning light.
A breach notice letter on a kitchen table next to a laptop, the usual starting point for deciding what to do next.

What the sources do and do not tell us

The FTC publishes pages on this topic. Three were reviewed: the FTC page on credit freezes and fraud alerts, the FTC fraud alert and credit freeze PDF, and the 2018 alert Free credit freezes are here. The text we could extract was mostly site menus and unrelated alerts. The PDF came through as garbled code. The 2018 alert cut off before any details.

That means no fees, time limits, or step-by-step instructions are stated here as fact. The title of the 2018 alert hints that freezes became free that year, but the readable text did not confirm the terms. Check the live FTC pages for the current rules before you act.

How the two tools differ in general terms

A common way to picture it: a freeze is a locked door, and an alert is a note taped to the door asking visitors to show ID. That comparison is a general description, not a quote from the pages above.

A credit freeze generally limits access to your credit report. A lender that cannot see your report is less likely to approve a new account in your name. Freezes are typically placed with each nationwide credit bureau separately, and you would normally need to lift one before applying for credit yourself.

A fraud alert generally asks businesses to take extra steps to confirm who you are before opening credit. It is typically placed with one bureau, which is expected to pass the request along to the others. Standard and extended alerts are often described as different, with the extended kind tied to confirmed identity theft. Confirm the details, including how long each lasts, with the FTC or the CFPB.

Which step comes first

No source here gives a required order. Anyone who says "freeze first" or "alert first" as a rule is going beyond this material. What can be said is that the two tools do different jobs, and they are not mutually exclusive in principle.

A sensible sequence looks like this:

  1. Read the breach notice. Note what was exposed. A Social Security number is a bigger concern than an email address.
  2. Confirm the notice is real by looking up the company's contact details yourself.
  3. Read the FTC's current guidance on freezes and alerts.
  4. Pick the tool that fits your situation, then act.

If a Social Security number was exposed, the case for acting quickly is stronger. If only an email address leaked, the urgency is lower. Either way, read first. Scammers count on people skipping that part.

Scam red flags after a breach

Breach news is bait. The FTC page we reviewed carried warnings about impersonation scams, including callers claiming a charity sweepstakes prize and calls about missed jury duty. Those are not breach-specific, but the pattern carries over.

  • An unexpected call, text, or email claiming to be the breached company, a credit bureau, or a government agency.
  • Pressure to act right now.
  • A request for your Social Security number or a payment to "secure" your account.
  • A link or number supplied by the sender, not one you looked up.

If any of those show up, stop. Hang up. Find the organization's number on your own and call that instead. A real credit bureau will not mind the extra step.

What to confirm before you rely on this

Several details remain unconfirmed here: how a freeze is placed and lifted, whether it costs money, how long an alert lasts, and which federal rules govern both. Also open are how to review your credit reports after a breach and how to report identity theft to the FTC.

Each has an answer on a regulator's page. Write down what you find and the date you placed any freeze or alert. This article is educational only. It is not personal financial, legal, or tax advice, and no tool here promises any particular credit outcome.