The hour-by-hour recovery playbook, what it costs, and the freeze that prevents it free
| Step | Where | Cost |
|---|
Identity theft's costs are mostly time, not money — federal law zeroes out your liability for card fraud and (with the right paperwork) fraudulent accounts, but extracting that protection takes 20–60 documented hours for a new-account case. This tool gives each theft type its specific playbook — the order matters — and makes the prevention case bluntly: the free credit freeze at all three bureaus outperforms every paid monitoring subscription, because freezes prevent what monitoring merely reports.
| Fraud type | Your legal exposure |
|---|---|
| Credit card charges | $0 (network zero-liability; statute caps at $50 regardless) |
| Debit card | $50 if reported in 2 days; $500 within 60; unlimited after — the credit-over-debit argument |
| New accounts in your name | $0 with the FTC-report process; the cost is your hours |
| Wire/payment-app scams you were tricked into sending | Usually YOUR loss — authorization defeats fraud protection; prevention is everything here |
Freeze at three bureaus (15 min) + IP PIN (10) + two-factor on email and banking (15 — email is the master key that resets everything else) + the report-checking rotation (one free bureau report every four months). Add the kids: child SSNs are the premium product on fraud markets precisely because nobody checks a 7-year-old's credit for a decade — freezing a minor's file takes a mail form and is worth it. This stack costs $0/month and beats the $25/month service on prevention; what subscriptions genuinely add is insurance-funded recovery help, a convenience, not a shield.
The FREEZE: statutory, free, blocks new accounts until you thaw. Alerts merely ask creditors to verify (1-year, renewable). 'Locks' are the bureaus' app-based freeze-alikes under contract law, sometimes bundled with paid products — functionally similar, legally weaker. When in doubt: freeze, all three bureaus.
Neither: freezes don't touch scores, existing accounts, or your own access to your reports. The only friction is thawing (minutes, online, free) before applying for new credit — a feature, since fraudsters can't thaw as you.
For prevention, no — they cannot freeze for you (law requires you), and monitoring reports fraud after the fact. Their real products are the recovery concierge and reimbursement insurance. The free stack (freeze + IP PIN + 2FA + IdentityTheft.gov) covers a careful person; the subscription buys convenience for someone who won't do the 45 minutes.
Assume the DATA is (breach lists make SSN+DOB combos a commodity) — what matters is use. Detectors: free weekly reports at annualcreditreport.com (accounts you don't recognize), your SSA earnings record (wages that aren't yours), EOBs from your insurer (care you didn't get), and mail that stops arriving (address-change fraud).
Delayed, not gone: file Form 14039 with a paper return, and the IRS eventually adjudicates to the rightful filer (months, unfortunately). Then get the IP PIN so it can never recur. Employers' W-2s make you provable; be patient and documented.
Breach-alert theater, mostly: your data being FINDABLE is the baseline condition of the modern internet, not an emergency. The freeze makes the found data unusable for credit; 2FA makes it unusable for takeovers. Act on the alerts by checking the stack, not by subscribing to more alerts.
Yes — this tool is a static playbook; nothing you select is transmitted anywhere.
Freeze the bureaus, PIN the IRS, two-factor the email, and know that IdentityTheft.gov turns the worst week into a checklist. Identity theft is a paperwork siege — the side with the FTC report and the certified-mail receipts wins.