Chapter 11: Protect it
The strongest defense in this guide costs $0, takes about ten minutes per bureau, and blocks the most common kind of new-account identity theft outright. Ten chapters of careful work can be undone by one stranger holding your Social Security number, and the people most likely to be targeted are the people already under financial stress. This chapter is the lock on the door.
Frozen is the default
A credit freeze (also called a security freeze) blocks lenders from pulling your file, and a file no one can read is a file no one can open credit against. It is free at all three bureaus, guaranteed by federal law. You set up one account at each bureau, about ten minutes apiece, online or by phone. Your existing cards keep working, your score does not move, and you can still pull your own reports. When you apply for something real, you thaw the file online in minutes, for a chosen window or a specific lender, and it refreezes on schedule.
Treat the freeze the way Chapter 5 of the Finvest Personal Finance Guide treats autopay: on by default, lifted only for a reason. Identity thieves do not send a save-the-date. Everyone in this guide's cast froze all three bureaus during their first cleanup week, and the rest of this chapter assumes you will too.
Freeze, lock, or paid monitoring
Three products claim to protect your credit. They are not equals.
Free at all three bureaus, by federal law. It prevents the fraudulent account from ever being opened, which makes it the only one of the three that stops the harm instead of describing it. The cost is a few minutes of thawing before each real application.
The same blocking function, wrapped in each bureau's app with an on-off toggle. The difference is legal: a freeze is a right written into federal law, while a lock runs on the bureau's own terms of service, and some bureaus have bundled locks into paid plans. A free lock is fine for convenience. Read the terms, and know that the freeze is the version the law stands behind.
A monthly fee to be told what already happened. Monitoring does not prevent a single account from being opened. Free weekly reports, free issuer alerts, and a freeze cover almost everything it sells. The honest exception: after a confirmed theft or a big breach, monitoring helps you watch the aftermath, and the breached company usually offers it free. Take the free version.
Fraud alerts, the lighter lock
A fraud alert is the freeze's lighter cousin: free, placed with one bureau, and that bureau must notify the other two. Lenders can still pull your file, but they must take reasonable steps to verify it is really you, usually a phone call, before opening anything. An initial alert lasts one year and renews free. An extended alert lasts seven years and becomes available once you have an identity theft report from the FTC. Use an alert during a season when you need to keep applying for credit. Use the freeze the rest of the time.
If your identity is stolen
The federal government built one front door for recovery, and it works: IdentityTheft.gov. Report what happened and the site generates a personal recovery plan plus an FTC identity theft report, the document that unlocks everything downstream.
- Report the theft at IdentityTheft.gov and save your FTC identity theft report.
- Call the fraud department of each company where an account was opened, close the account, and ask for written confirmation.
- Place a fraud alert with one bureau, then freeze your file at all three.
- Dispute every fraudulent account and inquiry with each bureau in writing, attaching the FTC report. Bureaus must investigate within about 30 days.
- File a police report when a creditor requires one or when you know who did it.
- Keep a dated log of every call and letter until the last fraudulent item is gone.
Lena's last knot
One account on Lena's report never made sense: a retail card opened in a city she has never lived in, six months after her divorce, now sitting in collections. She had assumed it was one more piece of the divorce wreckage. The validation letter she sent in Chapter 3 came back with an application in handwriting that was not hers.
Lena ran the sequence in order. She filed at IdentityTheft.gov on a Tuesday night and printed the FTC report. She called the retailer's fraud department, closed the account, and got the confirmation in writing. She placed a fraud alert, froze all three bureaus, and mailed written disputes with the FTC report attached. Five weeks later the account and its collection were gone from all three files, and her score moved from 548 to 581 without a single dollar paid. Her real history, the charge-off and the two collections, is still hers, aging toward the seven-year clock from Chapter 3. The difference matters: accurate items fade slowly, but fraudulent ones come off as soon as you push.
The scam gallery
People working through debt are a target market, and the pitches arrive by phone, text, and ad. The broader catalog lives in Chapter 25 of the Finvest Personal Finance Guide; these three are the credit-specific regulars.
No company, at any price, can remove accurate and current information from your report. Under CROA, the federal Credit Repair Organizations Act, repair companies cannot charge you before performing services, must give you a written contract, and must allow three days to cancel. A company that promises a specific score jump or a clean slate is describing something illegal. Everything they can legally do, the Chapter 3 dispute process does free.
Real collectors must identify the debt, send validation information, and follow the FDCPA: no threats of arrest, no calls before 8 a.m. or after 9 p.m., no harassment. Scammers skip all of that and push urgency, secrecy, and odd payment rails like gift cards or wire transfers. Demand a validation letter in writing before paying anyone a dollar, exactly as Chapter 3 taught. A collector who vanishes when you ask for validation was never a collector.
A text says your buy-now-pay-later payment failed, with a link to fix it. Now that BNPL plans feed FICO's new scores (Chapter 2), the threat of a damaged score makes the bait work better than it used to. Never tap the link. Open the app directly, check the payment there, and report the text. The same rule handles the debt-relief robocalls promising to cut your balance in half, which are settlement ads wearing a costume (Chapter 8).
Co-signing means it is your debt
Gloria and Hank learned about their nephew's loan from a score alert, not a phone call. That is the standard way co-signers find out: the first 30-day late lands on the bureaus, and the co-signer's score drops alongside the borrower's. Co-signing is full legal liability. The account sits on your report, its payment history becomes your payment history, it counts in your DTI (their Chapter 10 table carries the $230), and the lender can come to you without exhausting the borrower first.
Three tools get you out, or most of the way out.
First, the conversation, held early and without blame. Their nephew had lost shifts at work and skipped the call out of embarrassment, which is how a tight month became a reported late.
"We are not angry, and we want to fix this together. The late payment sits on our credit too, so silence hurts all three of us. Set up autopay today while we are on the phone. We will check in once a month, and after twelve clean payments you refinance the loan into your own name. If a month ever looks tight, call us before the due date, not after."
Second, the co-signer release: some loans release the co-signer after a run of on-time payments, often 12 to 48, plus a credit check on the borrower. Read the loan agreement to see if yours has one, and know that a 30-day late usually restarts the count.
Third, the refinance-out: once the borrower's credit can stand alone, they refinance into a solo loan and your name comes off entirely. Besides paying the loan off, this is the only true exit.
Their resolution followed the script. The nephew brought the loan current, autopay went on during the call, payment alerts now copy Gloria's email, and the target is a solo refinance after twelve clean months. The late payment stays on their reports for up to seven years, with its weight fading the whole time. Their policy also changed for good: future family help comes as an authorized-user spot or as cash, never as a signature.
Authorized user, the safer yes
The distinction matters enough to state plainly. Adding someone as an authorized user lends them your payment history and keeps you in control: you can set spending limits with many issuers and remove them in one phone call. Co-signing hands them your legal liability with no exit except payoff, release, or refinance. When family asks for help, the authorized-user spot on an old, clean, low-utilization card (Chapter 9) is the generous answer that cannot sink you. Co-sign only an amount you could pay off yourself without resentment, because the law says you may have to.
Freeze the kids
A child's Social Security number is a thief's favorite kind: clean, unmonitored, and unlikely to be checked until a first apartment or student loan application years from now. Parents and guardians can ask each bureau to create a credit file for a minor and freeze it on the spot, free. Do it once, store the PINs with your other vital documents, and thaw at 18 so they can start their own Chapter 9 climb on a file nobody else has used.
Run your defense on defaults: all three bureaus frozen, for you and your kids, thawed only for real applications. Verify every collector in writing before paying anything. Help family with an authorized-user spot or with cash, and co-sign nothing you could not pay yourself.
Key takeaways
- Freeze your credit at all three bureaus as the default state. It is free by federal law, takes minutes to thaw, and prevents fraud instead of reporting it.
- Paid monitoring tells you what already happened; a freeze stops it from happening. Locks block too, but on the bureau's terms rather than the law's.
- If your identity is stolen, IdentityTheft.gov builds the plan: FTC report, close accounts, alert and freeze, written disputes, police report when required.
- No one can remove accurate items from your report, and CROA makes the promise itself a violation. Disputes are free to file yourself.
- Co-signing puts the loan, its history, and its DTI weight on you, and you find out about trouble at 30 days late. Prefer authorized-user help, and know your release and refinance-out options.
Sources: IdentityTheft.gov · CFPB, debt collection · CFPB, credit reports and scores · AnnualCreditReport.com · Finvest Personal Finance Guide