Got the Breach Letter? Comparing Monitoring, a Freeze and Doing Nothing Over Five Years

The envelope arrives months after the incident it describes, and it offers you something free: a year or two of credit monitoring, an enrollment code, a deadline. The offer looks like the point of the letter. It is not. The decision worth making has almost nothing to do with the vendor named in the second paragraph, and everything to do with which of your identifiers were in the file, and how much of your next five years involves applying for credit. Those two facts determine what the breach costs you. The enrollment code determines very little.

What changed is that the expensive option became free

For years, the reason companies handed out credit monitoring was that the stronger protection cost money. Placing a security freeze at each of the three nationwide credit bureaus carried a fee in most states, and lifting it carried another, so a household that froze and then bought a car paid twice for the privilege. Federal law removed those fees nationwide, and freezes and lifts are now free, at every bureau, for everyone, with online and telephone requests answered quickly rather than by mail. That single change inverted the comparison. The paid protection became free, and the free protection stayed worth roughly what it costs.

The second change is quieter and sits at the IRS. The Identity Protection PIN, once limited to confirmed victims and residents of a few pilot states, is now open to any taxpayer who can verify their identity. A breach that exposed a Social Security number used to leave you waiting to be defrauded before you could get the strongest available protection against a fraudulent return filed in your name. Now you can get it in advance, before anyone tries. That is a genuinely different position to be in, and most breach letters do not mention it.

Monitoring, a freeze, and inaction, priced honestly

Credit monitoring tells you after the fact. It watches for new accounts and inquiries and sends an alert, which means its value is entirely in how fast you notice and how well you handle a dispute. It costs you nothing in dollars if you use the code, perhaps twenty minutes to enroll, and then a slow tax of notifications you learn to ignore. When the free term ends, the vendor would like to keep billing you, and the renewal price is where the arrangement stops being a favor.

A freeze prevents rather than reports. A lender who cannot pull your file will not open the account, which stops the most common form of new-account fraud at the door. The cost is three separate setups, roughly an hour in total including the two specialty bureaus most people forget, and then friction every time you legitimately want credit: a lift before the mortgage application, before the auto loan, before the store card at the register that you will now decline. If you borrow rarely, the friction is close to zero. If you refinance, move, or run a business that opens vendor accounts, it is real and recurring.

Doing nothing is not irrational, and it is worth pricing rather than dismissing. For a breach that exposed an email address and a hashed password, the correct response is a password change and nothing else, and the letter has cost you four minutes. For a breach that exposed a Social Security number, date of birth and address together, inaction defers the cost rather than avoiding it, and the deferred version arrives as disputed accounts, a delayed refund, or a mortgage underwriter asking about a debt you have never heard of.

What actually drives the number

Four things move the cost of a breach notification more than anything else. The first is the field list: name and email is an inconvenience, while Social Security number, driver's license number and date of birth in one record is a durable exposure, because you cannot rotate any of them the way you rotate a password. The second is how many people in the household are affected, since a minor's frozen file is a one-time hour that pays off for a decade, and an elderly parent's is often the one that gets skipped. The third is your borrowing calendar. The fourth is credential reuse, which is the only part of this you control completely and the only part where an afternoon of work permanently removes a category of risk.

The Federal Trade Commission is responsible for the federal identity theft recovery process, and its role matters here for a practical reason rather than a symbolic one: an official report is what turns your account of events into something a creditor, a bureau or a police department will act on. Filing one early, before anything has gone wrong, is not possible. Knowing where it lives, and what a recovery plan requires, is what keeps a bad week from becoming a bad quarter.

Which parts are reversible, and which are not

A freeze is fully reversible, in both directions, at no cost, in minutes. Monitoring enrollment is reversible, though you have handed a vendor a fuller record of yourself than the breached company ever held, and that transfer does not undo. A password change is reversible in the sense that nothing is lost by making it. The Social Security number in the file is not reversible at all, which is the whole reason the field list drives the decision.

One irreversible step hides in the mail that follows the notification. Class settlements ask you to choose between a cash payment, a longer monitoring term, or documented out-of-pocket reimbursement, and accepting any of them releases your claims. If your exposure later turns into a five-figure problem, the release is what you signed. Read the claim form as a five-year document, because that is what it is.

Five years out, the household that spent an hour freezing four files and an afternoon on unique passwords has a boring story: a lift request before the car loan, and nothing else. The household that enrolled, ignored the alerts, and let the term lapse has the same exposure it started with and a subscription invoice. The hour is the cheap part. It is also the part that keeps working after the free term ends.