What this answers
On this page
Anyone who suspects fraud can place a one year initial fraud alert, no documentation required. A victim who has filed an identity theft report qualifies for something considerably stronger: an extended alert that lasts seven years and changes what a creditor has to do before opening an account in your name.
What Makes an Extended Alert Different
An initial alert asks a creditor to take reasonable steps to verify identity before extending credit. In practice that is a low bar, and it is satisfied by procedures a creditor already runs.
An extended alert replaces that with a specific obligation. The creditor has to make actual contact with you, in person or at the telephone number you supplied, before opening a new account or increasing a credit line. Reviewing documents is not enough. Running an automated identity check is not enough. Someone has to reach you.
That is the whole point of the escalation. The attack it defends against is a thief who has enough of your information to pass an automated check, which, after a breach, is most thieves.
Seven Years, Not One
An extended alert stays on file for seven years. An initial alert expires after one and has to be renewed, which is how most initial alerts quietly lapse: the victim places one during the worst week, and nobody remembers it twelve months later.
Seven years is also a realistic match for how this crime behaves. Stolen identifying information does not expire. A Social Security number cannot be reissued the way a card number can, and data that surfaced in a breach can be used years after it was taken.
What Else Comes With It
Placing an extended alert entitles you to two free credit reports from each bureau within the following twelve months, on top of the free weekly reports everyone can get at AnnualCreditReport.com.
It also removes your name from prescreened credit offer lists for five years. That one is more useful than it sounds. Prescreened offers arrive in the mail as live invitations to open credit, and a thief with access to your mailbox does not need to forge anything to use one.
What You Need
- An identity theft report. An FTC report from IdentityTheft.gov qualifies, and so does a police report.
- Proof of identity, comparable to what you provide to access your own reports.
- A telephone number, or other contact method, that creditors will use to reach you.
How to Place One
Contact any one of the three nationwide bureaus. That bureau is required to notify the other two, so a single request places the alert at all three. You do not need to repeat the process three times.
Give a number you will actually answer. This is the part people get wrong. The entire value of an extended alert is that a creditor must reach you before opening an account, which means an unanswered number converts your strongest protection into a dead end, and it can also hold up credit you genuinely want.
Alert or Freeze
A fraud alert and a security freeze are different tools and are not substitutes.
An alert is a warning attached to your file. It tells creditors to verify, and with an extended alert, to contact you. It does not stop a creditor who ignores it.
A freeze blocks access to your file for new credit entirely. It is free to place, lift, and remove at all three bureaus, and it is the only measure that actually prevents a new account rather than discouraging one.
Most victims should have both. The freeze stops the common case. The alert covers the situation where a file is accessed anyway, and it creates a record that the creditor was told.
After You Place It
- Confirm the alert actually appears at all three bureaus rather than assuming the notification happened
- Keep your contact number current across the full seven years, and update it with the bureaus when it changes
- Use the extra free reports on a schedule instead of all at once
- Keep the confirmation. If a creditor opens an account without contacting you while an extended alert was on file, the alert's presence and date are the first thing you will need to prove
That last scenario is the one worth watching for. An account opened in your name while an extended alert was on your file is not only fraud by the thief. It is a creditor that was told to call you and did not.
What Creditors Actually Do With It
Understanding how the alert is seen on the other side explains both its value and its limits.
When a creditor pulls a file carrying an extended alert, the alert appears with the contact number you supplied. The obligation is to make reasonable contact with you at that number before opening the account or increasing a line.
What that looks like in practice varies. A large issuer with an automated underwriting flow has to break out of it and route the application to a human. A small lender may call while the applicant is standing there. Some will decline rather than bother.
That last outcome is worth anticipating. An extended alert can slow down credit you actually want, which is the price of the protection, and it is a reason to warn the lender in advance when you are the one applying.
Keeping It Working for Seven Years
Seven years is long enough that the thing most likely to break the alert is you changing your phone number.
An alert pointing at a disconnected number is worse than no alert. The creditor attempts contact, cannot reach anyone, and either declines a legitimate application or proceeds on the basis that it tried.
Set a reminder to confirm the alert and the number annually. It is a five minute call to one bureau, and it is the difference between a protection that works and one that is technically on file.
Common Questions
How long does an extended fraud alert last?
Seven years, compared with one year for an initial alert.
What do I need to place one?
An identity theft report, such as an FTC report from IdentityTheft.gov or a police report, proof of identity, and a contact number creditors can use.
Do I have to contact all three bureaus?
No. Contact one, and it must notify the other two. Confirm afterwards that the alert actually appears at all three.
What is the difference between an initial and an extended alert?
An initial alert asks creditors to take reasonable steps to verify identity. An extended alert requires the creditor to actually contact you at the number you provided before opening an account, and it lasts seven years instead of one.
Does an extended alert stop new accounts?
No. It obliges a creditor to contact you first. A security freeze is what actually blocks access to your file, and most victims should have both.
What else comes with it?
Two additional free reports from each bureau within the following twelve months, and removal from prescreened credit offer lists for five years.
Can I remove an extended alert early?
Yes. You can ask the bureaus to remove it before the seven years are up, which is worth knowing if the contact requirement is interfering with credit you need.
Does it cover my spouse or family?
No. An alert attaches to one person's file. If more than one household member is affected, each has to place their own.
Will the alert show up to lenders as negative?
No. An alert is an instruction, not derogatory information, and it has no effect on your score.
What if a creditor opens an account without contacting me?
That is the situation the extended alert exists to prevent, and the alert's presence and date are the first evidence you will need. Keep the confirmation from the bureau and the report showing the alert was on file.