Gave a scammer your information? Freeze your credit and lock down your accounts
A checklist for the hour, the day, and the week after sharing a password, a code, your Social Security number, or access to your device, including how credit freezes and fraud alerts work.
Key takeaways
- What you do depends on what was shared: a password, a one-time code, card details, a Social Security number, or remote access each need different steps.
- A credit freeze is free, does not affect your credit score, and stops most new accounts being opened in your name. You place it with each of the three bureaus.
- Secure your email first. Whoever controls your email can reset almost every other password.
- Turn on two-factor sign-in, preferably with an authenticator app or security key.
- IdentityTheft.gov builds a free, personal recovery plan if your identity has been used.
Start with what was shared
| You shared | Main risk | Do this first |
|---|---|---|
| A password | Account takeover | Change it on the real site, then everywhere it was reused |
| A one-time code | A login or payment approved right now | Contact the real company immediately |
| Card number | Fraudulent charges | Call the issuer, get a new card |
| Bank account and routing number | Unauthorized debits | Tell the bank, ask about a new account number |
| Social Security number | New accounts in your name, tax fraud | Freeze credit, use IdentityTheft.gov |
| Remote access to a device | Everything on it | Disconnect from the internet |
| A photo of your ID | Identity fraud | Freeze credit, fraud alert, watch for new accounts |
In the first hour
If you gave remote access: disconnect the device from wifi and unplug any cable. Do not use it for banking. From a different device, change your email and banking passwords. Later, remove the remote access program, update the system, and run a security scan. If you are not confident, ask a local repair shop you choose yourself. Never call a number from a pop-up.
If you shared a code or banking login: contact the bank through its app or the number on your card. Ask them to check for new payees, new devices, changed contact details, and pending transfers.
Secure your email before anything else. Change the password, sign out all other sessions, and check three things scammers change quietly: the recovery phone and email, forwarding rules, and filters that hide messages from your bank.
In the first day
Change passwords the right way
- Start with email, then banking, then anything that holds a payment method.
- Use a different password for each. A password manager makes that realistic. If you prefer paper, keep the notebook at home and out of sight.
- Long beats clever. Three or four unrelated words is strong and typeable.
Turn on two-factor sign-in
With two-factor sign-in, a stolen password is not enough. In order of strength:
- A physical security key
- An authenticator app
- A code by text message, which is weaker but far better than nothing
Save the backup codes somewhere safe. And remember the one rule that matters: a code is only ever typed into the real app or site by you. Nobody calls to ask for it.
Place a credit freeze
A freeze stops lenders from seeing your credit file, which blocks most attempts to open credit in your name. It is free, does not affect your score, and lasts until you lift it. You must do it with each bureau:
- Equifax
- Experian
- TransUnion
Use each bureau's official website or phone line, and keep the PIN or account login they give you. When you apply for credit yourself, you lift the freeze for a few days. Parents and guardians can also freeze a child's file.
Or add a fraud alert
If you do not want a freeze, a fraud alert asks lenders to verify your identity first. You only need to contact one bureau, which must tell the others. It lasts one year and can be renewed.
In the first week
- Check your credit reports. They are free at AnnualCreditReport.com, the only site authorized by federal law. Look for accounts, addresses, or inquiries you do not recognize.
- Make a plan at IdentityTheft.gov if anything has been opened or used in your name. It produces an official identity theft report and letters to send.
- Ask the IRS about an Identity Protection PIN, a six digit number that stops someone else filing a tax return with your Social Security number.
- Watch your mail. Missing statements, or letters about accounts you did not open, are early signs.
- Turn on alerts for transactions on every card and bank account.
- Tell your mobile carrier if you shared personal details, and ask about a port-out PIN, which stops someone moving your number to their phone.
What a freeze does not do
A freeze does not stop charges on cards you already have, does not stop someone using an existing bank login, and does not block tax, medical, or benefits fraud. That is why the account steps above matter as much as the freeze.
If your email or social account has already been taken over
Use the provider's official account recovery page, not a link from a message. Once you are back in, change the password, remove unknown devices and apps, check forwarding and recovery settings, and warn your contacts that messages from you may have been fake. Scammers often use a hijacked account to ask friends for money.
Keep a record
Note the date of each call, who you spoke to, and any reference number. If problems surface months later, that log is what makes them quick to resolve. Then report what happened: see how to report a scam.
Common questions
Is a credit freeze free?
Yes. Federal law has made placing and lifting a credit freeze free since 2018. You need to contact Equifax, Experian, and TransUnion separately. A freeze stays in place until you lift it.
Does freezing my credit hurt my credit score?
No. A freeze does not affect your score, your existing accounts, or your ability to use your cards. It only stops new lenders from checking your file, which blocks most new accounts. You lift it temporarily when you apply for credit yourself.
What is the difference between a credit freeze and a fraud alert?
A freeze blocks access to your credit file. A fraud alert leaves the file open but tells lenders to verify your identity before opening an account. An initial fraud alert lasts one year and you only need to ask one bureau, which must tell the other two. People with an identity theft report can get an extended alert lasting seven years.
I gave someone a verification code. What now?
Act immediately. A code can approve a login, a payment, or a new device within seconds. Contact the real company through its app or the number on your card, say a code was shared with a scammer, and ask them to check for new devices, payees, or transfers. Then change the password.
Official sources and further reading
- FTC: What To Do if You Were Scammed
- FTC: Use Two-Factor Authentication To Protect Your Accounts
- FTC: How To Recover Your Hacked Email or Social Media Account
- IdentityTheft.gov
- AnnualCreditReport.com: free credit reports
Published September 21, 2026, last updated September 21, 2026. This guide is general education for people in the United States. It is not legal or financial advice, and it cannot tell you whether a particular message or person is genuine. Spot an error? Tell us.