Money, Credit and Identity

Your name, Social Security number and date of birth are enough for a thief to borrow money as you. A stranger who has them can try to open a credit card, take out a phone contract, file a tax return to collect your refund, or bill Medicare for care you never got. You do not have to see any of it happen. The first sign is often a letter, a collection call or a rejected tax return.

The numbers explain why this lesson matters. In 2025 the FBI's Internet Crime Complaint Center (IC3) received 31,675 identity theft complaints with about $185.8 million in reported losses, and 67,456 personal data breach complaints with about $1.31 billion in reported losses. Among people 60 and older, it logged 5,359 identity theft complaints and 5,200 check and credit card fraud complaints (IC3 2025 report, as of October 2026). Those are only the cases that were reported.

The good news is that the most useful protections are free, and you can set up most of them in one afternoon with a cup of coffee. This lesson goes in order of how much each step helps: lock your credit, check your reports, protect your tax and Social Security records, watch your accounts, pay the safe way, guard your mail, and protect the identity of someone who has died.

Your credit file, and why a thief wants it

A credit bureau is a company that keeps a file on how you borrow and pay. Three big ones cover nearly everyone in the country: Equifax, Experian and TransUnion. When you or a thief applies for a loan, a card, a phone plan or an apartment, the lender usually asks one of them for your credit report, the record of your accounts, balances and payment history. If the report looks fine, the lender says yes.

That is the weak spot. The lender has no way to tell you from a thief with your numbers, except by what the bureau says. A freeze changes what the bureau says.

Credit freeze: the strongest free lock

The FTC describes it this way: "While a credit freeze is in place, nobody can open a new credit account in your name, including you." It is free, it does not affect your credit score, anyone can place one for any reason, and it lasts until you lift it (FTC, as of October 2026). Federal law has made freezes free since 2018, and each bureau's page now says placing, lifting and removing one costs nothing.

Idaho has its own law on this too, the Credit Report Protection Act in Idaho Code Title 28, Chapter 52. It sets rules for placing and lifting a freeze, and it allows a small fee only for repeat placements and for reissuing a lost PIN. The bureaus now state they charge nothing, and the free federal rule is the one you will see in practice. If anyone ever asks you to pay for a freeze, stop and report it.

How to place a freeze

You must do it at each of the three bureaus. A freeze at one does not carry over to the others. Experian says so on its own page.

Bureau	Fastest way	By phone
Equifax	Make a free myEquifax account at equifax.com and choose to place a security freeze. You must be 18 to open an account.	1-888-298-0045
Experian	Make a free Experian account at experian.com/freeze. The freeze and unfreeze happen in real time.	1-888-397-3742
TransUnion	Make a free TransUnion Service Center account at transunion.com/credit-freeze.	1-800-916-8800

Phone numbers and web pages change, so confirm them on the bureau's own site or through the FTC's list at IdentityTheft.gov. Each bureau also takes a mailed request if you do not use the internet. Experian's page lists the address as Experian Security Freeze, P.O. Box 9554, Allen, TX 75013, and asks for your name, Social Security number, addresses from the past two years, birth date, a copy of a government ID and a copy of a utility bill or bank statement. TransUnion says mailed requests may take up to three business days after it receives them.

Keep these things in a safe place: the username and password for each bureau account (a password manager is a good home for them; see lesson 03), and the PIN if a bureau gives you one. Losing them makes lifting a freeze a chore.

How to lift it and put it back

Say you are buying a car, renting an apartment or applying for a new card. Ask the lender which bureau it checks. Log in to that bureau and lift the freeze. The FTC suggests lifting it only at the bureau the lender will check and then freezing it again afterward. If you lift it for a few days, you can usually choose the dates. It is easy to forget to put it back, so set a reminder on your phone.

What a freeze does not do

A freeze closes the door on new accounts. It does not touch accounts you already have, so a thief with your card number can still charge it. It does not stop someone filing a tax return in your name or billing Medicare. Those are the reasons for the other steps in this lesson. It also does not stop the credit card offers in your mailbox, which is a separate fix: OptOutPrescreen.com, the official site, stops Equifax, Experian, Innovis and TransUnion from using your file for those offers. You can opt out electronically for five years or mail in a form to opt out permanently (OptOutPrescreen.com, as of October 2026).

Freezes for children and for relatives who cannot manage their own affairs

A child's clean credit file is attractive to thieves because nobody looks at it for years. The FTC says that if your child is under 16 you can request a free freeze that stays in place until you tell the bureaus to remove it. The steps are different from an adult's, and each bureau has a page for minors. Equifax also lists mailed forms for incapacitated adults, which matters if you are looking after an aging parent. Lesson 11 covers helping a parent without taking over.

Fraud alerts: lighter, and sometimes the right choice

A fraud alert is a flag on your file. It tells lenders to verify your identity before they grant new credit. It does not lock the file, and it does not stop businesses from seeing your report (FTC, as of October 2026). Here is how the types compare.

Type	Who can place it	How long it lasts	How many bureaus to call
Initial fraud alert	Anyone who is, or suspects they may be, affected by identity theft	1 year, renewable	One. It must tell the other two.
Extended fraud alert	Identity theft victims with an FTC identity theft report or a police report	7 years	One. It must tell the other two.
Active duty alert	Active duty servicemembers	1 year, renewable during deployment	One. It must tell the other two.

A freeze gives more protection. A fraud alert is handy if you want a quick flag after a worrying phone call while you decide about a freeze, or if you need your credit open and active for a pending loan but want an extra check on it. If you are a confirmed victim, many people use both: the freeze to block new accounts and the extended alert for the seven-year paper trail.

Your free credit reports

You can read your own file at no charge. The FTC says all three bureaus permanently offer free weekly reports through AnnualCreditReport.com, and that you may also be entitled to an extra free report after an adverse action notice, if you have a fraud alert, or if your report is inaccurate because of fraud (FTC, as of October 2026). Use the official site only. You can also call 1-877-322-8228, and reports are mailed within 15 days. The FTC warns that imposter sites advertise "free" reports, scores or monitoring, and that the real site and the bureaus will not email you asking for your Social Security number.

What to look for

• Accounts you did not open: a card, a loan, a phone line, a store account.
• Addresses you never lived at, or a name spelled in a way you do not use.
• Late payments on bills you paid.
• "Hard inquiries" you do not recognize. A hard inquiry is a lender looking at your file because you applied for credit.
• Collection accounts for things you do not remember.

The three reports can differ, so read all three. If you find a mistake, contact the bureau and the business that supplied the information, and dispute it. For identity theft, go to IdentityTheft.gov. It gives you a free personal recovery plan with pre-filled letters and forms for the bureaus, businesses and debt collectors, and you can also call the FTC at 1-877-438-4338 (FTC).

Do you need paid credit monitoring?

Probably not. The FTC notes that monitoring services usually charge a fee, tell you about new accounts, late payments and credit checks, but typically will not alert you to bank withdrawals or to someone filing a tax return with your Social Security number to collect your refund. The FTC's advice is to check your free reports before paying for a service. A freeze plus weekly free reports plus bank alerts does most of what a paid service sells. If a company has given you free monitoring after a breach, taking it does no harm.

Your tax record: the IRS Identity Protection PIN

Tax identity theft works like this. A thief files a return in your name early in the year, claims a refund, and sends it to an account they control. You find out when your own return is rejected. An Identity Protection PIN (IP PIN) blocks that. It is a six-digit number the IRS gives you that must appear on your return. The IRS says an e-filed return with a missing or incorrect IP PIN is rejected, and a paper return is delayed until the IRS can verify it (IRS, as of October 2026).

Anyone with a Social Security number or an ITIN who can verify their identity can get one. You do not need to be a victim.

How to get one

1. Online (fastest). Create or sign in to your IRS online account at irs.gov, which requires verifying your identity, then open the IP PIN section of your profile and opt in.
2. By form. If you cannot set up an online account, the IRS lets you apply with Form 15227 if your adjusted gross income on your last filed return was below $84,000 (single) or $168,000 (married filing jointly). The IRS phones you to verify, then mails the PIN, usually in four to six weeks.
3. In person. Schedule an appointment at a Taxpayer Assistance Center and bring photo ID and a second form of identification. The PIN is usually mailed within about three weeks.

Good to know before you sign up. The PIN is good for one calendar year and a new one is created each year. If you enrolled online, you must retrieve the new one yourself each year; the IRS says no notice is mailed. Online, it is generally viewable from mid-January through mid-November. Your tax preparer or software will ask for it, so keep it with your tax papers. The IRS page does not describe a way to leave the program on your own, so think of enrolling as a standing choice. Anyone under 18 uses an alternative enrollment route, and parents or legal guardians can request one for a dependent.

Remember that the IRS opens most contact by letter. A caller who says you owe tax and must pay by gift card or wire today is not the IRS. Lesson 07 covers that scam by name.

Your Social Security record

Create your own my Social Security account at ssa.gov before a thief does it for you. The SSA publication says having your own account can "take away the risk of someone else trying to create one in your name." Inside you can check your earnings record, see your statement, and, if you collect benefits, handle direct deposit and address changes yourself. You prove who you are through Login.gov or ID.me. Login.gov needs an email address, a government photo ID and a phone number. ID.me needs an email address, a photo ID and a device with a camera (SSA, as of October 2026).

If your information has been exposed and you do not want anyone, including you, to use the online or automated phone services to reach your record, you can ask Social Security to block electronic access by calling 1-800-772-1213 (TTY 1-800-325-0778). Once the block is on, you cannot see or change your record that way either. To lift it later, you contact SSA and prove your identity (SSA publication, as of October 2026). Lines are open 8 a.m. to 7 p.m. on weekdays. Most people who have an account of their own do not need the block. People who plan never to use the online services may like it.

Two more habits are worth keeping. Do not carry your Social Security card in your wallet, and when someone asks for your number, ask why they need it, how it will be used and what happens if you say no. The SSA suggests exactly that. Call Social Security yourself, at a number from ssa.gov, if you are ever unsure about a message that claims to be from it. To report a Social Security scam, go to oig.ssa.gov/report.

Your bank and card accounts

Turn on alerts

Alerts are the easiest early warning you have. Open your bank's or card company's app (or website) and find the settings. The names move around, but you are looking for "Alerts," "Notifications" or "Security." Turn on these, if offered:

• A text or push alert for every purchase or for every purchase over a low amount such as $1.
• An alert for every transfer out, every new payee and every change of address, phone number or email.
• An alert when a new device signs in.
• A low-balance alert.

An alert that arrives while you are standing at your own kitchen counter, for a purchase you did not make, is a gift. It lets you call before the thief finishes.

Why a credit card protects you better than a debit card

A credit card spends the bank's money first. A debit card spends yours. The legal limits on what you can lose are different too. Here are the FTC's published limits (FTC, as of October 2026).

Situation	Credit card	Debit or ATM card
Reported before any unauthorized charges	$0	$0
Reported after charges, within 2 business days of learning of the loss	$50 at most	$50
Reported later than 2 business days, within 60 calendar days of the statement being sent	$50 at most	$500
Reported more than 60 calendar days after the statement was sent	$50 at most for unauthorized use. Send a written dispute within 60 days of the statement.	You could lose all of it, and possibly more, such as money in linked accounts
Only the account number was used, card still in your hand	Not responsible	Not responsible if you report within 60 calendar days of the statement being sent

Here is the arithmetic. A thief spends $1,200 on your debit card. You learn about it on a Monday and call on Friday, which is more than 2 business days later. The most you could owe is $500, and you wait for the bank to put the other $700 back while your rent check bounces. If you had called on Tuesday, the most you could owe is $50. With a credit card, the same $1,200 is the bank's money until it finishes the investigation, you owe at most $50, and your own cash stays in your account. That is a real reason to use a credit card for shopping online, at gas pumps and when traveling, and to keep the debit card for the ATM.

On disputes, the CFPB says you must send a written notice no later than 60 days after the statement where the error first appeared. The issuer must acknowledge it within 30 days and finish investigating within two more billing cycles. You do not have to pay the disputed amount or the finance charges on it while it is investigated, but you must pay the undisputed part on time (CFPB, as of October 2026). Call first, then mail the letter to the billing-dispute address, which may differ from the payment address, and keep a copy.

Pay attention to statements every month. Open the paper one or the online one, and read down the list. It takes five minutes and it is the best check there is.

Money you send: what can be taken back, and what cannot

There is a clear pattern in the FTC's guidance. When a bank or card company moves the money, you have rules on your side. When you push the money out yourself in a way that works like cash, you mostly do not. The FTC says: "Wiring money is like sending cash," gift card numbers once shared give control of the money to whoever has them, and cryptocurrency payments lack legal protections, so funds usually cannot be recovered unless the recipient returns them (FTC, as of October 2026).

How you paid	Can it be reversed?	What to do
Credit card	Often, through a dispute	Call the number on the card. Follow up in writing within 60 days of the statement.
Debit card	Sometimes, with a clock that runs against you	Call the bank within 2 business days of learning of the problem if you can.
Check	Sometimes, if it has not cleared	Ask your bank to stop payment, and ask about a closed account.
Zelle, bank transfer or payment app	Hard if you sent it yourself	Call the bank or app in minutes. Ask them to recall it.
Wire transfer	Rarely	Call the wire company and your bank the same hour.
Gift card	Rarely, and only if unspent	Call the card issuer on the back of the card. Keep the card and receipt.
Cryptocurrency	Almost never	Call the exchange or ATM operator. Report to ic3.gov.
Cash	No	If mailed, call the Postal Inspection Service at 1-877-876-2455 before it is delivered.

A word about Zelle and other fast transfers

Bank-to-bank apps are convenient for sending $40 to a niece. They are not made for paying strangers. The CFPB's Regulation E guidance draws a line. If a thief gets into your account, or a person posing as your bank talks you into giving up your login, and then sends money, that transfer is treated as unauthorized under the rule. If you knowingly send the payment yourself, even because you were lied to, banks often treat it as a payment you made, and they often decline to reverse it (CFPB, as of October 2026). So the habit is: use these apps only for people you know, in person or by a number you already had. Never move money because someone on the phone says your account is not safe. A real bank never needs you to move your money to protect it.

The rule that saves the most money

If anyone, for any reason, tells you to pay with gift cards, a wire, cryptocurrency or cash in the mail, it is a scam. No legitimate business, government agency or relative in trouble will insist on it. Hang up. IC3 reported 181,565 cryptocurrency-related complaints with about $11.37 billion in losses in 2025, and among people 60 and older, about $4.43 billion (IC3 2025 report, as of October 2026). Lesson 07 covers the stories behind those figures.

Medicare and health insurance statements

Medical identity theft means someone uses your name or Medicare number to get care, equipment or prescriptions, and bills for them. It is also how Medicare is billed for "free" braces and test kits that nobody needed. Medicare's fraud booklet says to treat your Medicare card like a credit card, share the number only with your doctor or other trusted Medicare providers, and never give it out in exchange for free equipment or free offers. If an uninvited caller asks for your number, hang up and call 1-800-MEDICARE (1-800-633-4227) (Medicare.gov, as of October 2026).

• With Original Medicare, read each Medicare Summary Notice. Compare it with your calendar and receipts. You can also log in at Medicare.gov, sign up for electronic notices or call 1-800-MEDICARE.
• With a Medicare Advantage or other plan, read the statements the plan sends.
• Report fraud to 1-800-MEDICARE, to the HHS Inspector General tip line at 1-800-447-8477 (tips.oig.hhs.gov), or for Advantage and drug plans to I-MEDIC at 1-877-772-3379.
• The Senior Medicare Patrol (SMP) helps people with Medicare spot and report fraud. Find your local program at smpresource.org or call 1-877-808-2468.
• If you gave personal information to the wrong person, call the FTC ID Theft Hotline at 1-877-438-4338.

Have the Medicare number, the provider's name and the claim details (dates, services, amounts) in hand when you call.

Mail: the old way thieves still use

Not every thief uses a computer. A full mailbox on a rural road is an easy target. Bank statements, new credit cards, tax forms and checks all arrive by mail, and they carry the numbers a thief wants. The FTC suggests taking mail out of the mailbox as soon as possible, especially statements that carry personal information, and shredding documents before they go in the trash (FTC).

What to do

• Collect mail daily, or ask a neighbor to when you travel. Hold your mail with USPS for trips (lesson 10 covers that).
• Sign up for Informed Delivery. USPS offers it free. It sends you a daily email or app view of grayscale images of the front of letter-size mail due that day, so you know if something is missing. Sign up at usps.com and verify your identity (USPS, as of October 2026).
• Mail checks at the post office or drop them inside, not in the flag-up box at your curb. A mailed check carries your name, account number and routing number, and thieves wash and rewrite them. Better still, pay bills online or by automatic payment from your bank.
• Go paperless for statements if you are comfortable with it, and protect that email account (lesson 03).
• Shred anything with an account number, a Social Security number, a birth date or a medical record number. A cross-cut home shredder is cheap. Check your town for a free community shred day.
• Report missing mail. If you suspect mail theft, report it to the U.S. Postal Inspection Service at report.uspis.gov or 1-877-876-2455. Call 911 if a crime is in progress (USPIS, as of October 2026). Tell the bank if a statement or card never came.

Protecting a loved one's identity after a death

A thief may use a dead person's name and number to open accounts, because for a time nobody is watching the file. It helps to act in the first weeks.

1. Social Security. A funeral home usually reports the death to Social Security. Confirm that with the funeral director, or check the SSA page on reporting a death, ssa.gov/personal-record/when-someone-dies, so benefit payments stop (SSA).
2. The three credit bureaus. Contact Equifax, Experian and TransUnion. Each has its own process for a spouse or the estate's personal representative to request a deceased flag or a report, and each will want proof such as a death certificate. The paperwork differs by bureau and changes, so check the current steps on each bureau's own site.
3. Banks, card companies and utilities. Tell each one. Ask what they need and request copies of the last few statements.
4. Mail. Collect it. Ask USPS how to forward mail for a deceased person, and shred what you do not need. Ask for several certified copies of the death certificate early, since nearly every company wants its own.
5. The IRS and the state tax office. The final return and any questions run through the personal representative. A thief could also use the number to file a tax return, so watch for IRS letters.
6. Watch the credit reports. The estate's representative can get reports and look for accounts opened after the date of death.

On debts, the FTC says debts generally do not end at death. They are owed by and paid from the deceased person's estate. Family members usually do not pay from their own money, with exceptions such as people who cosigned the debt, a spouse in a community property state, or a spouse in a state that requires payment of certain debts. A debt collector may discuss the debt only with certain people, such as the spouse, the executor or personal representative, and may contact other relatives once to find the estate's representative. If a collector pressures a relative, report the contact to the FTC at ReportFraud.ftc.gov or to the Idaho Attorney General (FTC, as of October 2026).

Watch out for imposters at this time too. People who have lost someone get calls claiming that the dead person owed money and that it must be paid by gift card or wire right away. Do not pay. Ask for the request in writing and speak to the estate's representative.

Where to report, and what to keep

Questions and answers

Do I need to freeze my credit if I never borrow money?

The need is even clearer if you never borrow. You are not using your credit, so a new account opened in your name could sit unnoticed for months. A freeze costs nothing and can be lifted in minutes if you do apply.

Does my spouse have to freeze too?

Yes. A credit file belongs to one person, so each of you needs to freeze your own at each bureau. You can sit side by side and do both.

How long does a freeze last?

Until you lift or remove it. The FTC says it lasts until you lift it, and the bureaus describe it the same way.

Will a freeze stop my credit card from being used?

No. A freeze affects new accounts. Your current cards and loans work as before. A thief who has your card number can still charge it, which is why alerts and reading statements matter too.

Can I still get a job, an apartment or utility service with a freeze?

Yes, though some employers, landlords and utilities check credit. Ask them which bureau they use, lift the freeze there for a few days and put it back. Some check none at all.

I got a letter saying my data was in a breach. What now?

Freeze all three bureaus, change the password for any account named in the letter, turn on two-step sign-in, and watch your statements. Take the free monitoring if the company offers it. Do not click links in the letter or call numbers in an email. Look up the company's phone number yourself. Fake breach letters exist.

Where do I keep the bureau logins and PINs?

In a password manager, or in a sealed envelope in a safe place at home that a trusted person knows about. Lesson 03 covers password managers, and lesson 11 covers how to leave this information for family.

Should I pay for a service that promises to restore my identity?

You do not need to. IdentityTheft.gov builds a free recovery plan with the letters filled in. A company that wants a fee to "clean up" your credit or to recover lost money is the type of company the FTC warns about.

How often should I check my credit reports?

Weekly free reports are available through AnnualCreditReport.com, but most people do fine with a look every month or two, and a look at once if a bill or a letter surprises them.

Hard questions

If a freeze is so good, why is it not automatic?

Because the credit system is built to approve loans quickly, and lenders and bureaus earn money when files are checked. The free freeze is a right, not a default. Anyone can use it, but you have to do it yourself. That is the honest reason this lesson exists.

Is Zelle safe to use?

It is as safe as sending cash to a person you know. The app does what it says. The risk is being talked into sending money. Use it only for people you know, confirm the phone number or email by a second route, and never use it to pay a stranger, a "bank" or a "government agent." Turn on bank alerts and set a lower limit for transfers if your bank offers one.

I cannot afford credit monitoring or identity theft insurance. Am I exposed?

No. The protections that matter most are free: freezes, weekly credit reports, an IP PIN, a my Social Security account, bank alerts and a shredder. A paid service adds convenience, not a stronger lock. The FTC itself says to check your free reports before paying for monitoring.

What if I forget the freeze when I need credit in a hurry?

Online lifting takes minutes at Experian and TransUnion, and Equifax lets you manage a freeze by logging in. The worst case is a short delay while you find your login. Keep logins in one place. If you cannot log in, call the bureau's number.

I already shared my Social Security number with a scammer. Is it too late?

No. It is the right time to do everything in this lesson, in this order: freeze at all three bureaus, report at IdentityTheft.gov, get an IP PIN, create your own my Social Security account, and watch your reports every week for a few months. If your credit has already been used, ask for an extended fraud alert once you have an FTC report. The recovery plan walks you through it. Lesson 09 has the first-hour steps.

Is it safe to keep my money in a bank at all, given all this?

Yes, for most people it is the safest place. Cash at home has no protection if it is lost or stolen. Bank accounts have rules that put the bank on the hook for unauthorized use if you report on time. The habits here simply make the rules work for you.