Three Ways to Answer a Breach Letter, and What Each One Costs You Over the Following Year

The envelope arrives with a code, a toll-free number, and a deadline for enrollment that is usually ninety days out. What it does not contain is a cost estimate, because the costs land on you in two currencies that the letter never converts into each other: dollars, which are mostly small and occasionally not, and attention, which is where the real bill sits. The three responses people actually choose are worth comparing on both, and on how each one behaves in an ordinary week six months later, when the letter is in a drawer and the incident is no longer news.

The enrollment path, and the meter it starts

Signing up for the offered monitoring is the cheapest thing to do on the day, and the most expensive thing to do carelessly. The service itself is paid for by the company that lost your data, typically for twelve or twenty-four months, after which it converts to a paid subscription unless you cancel. That conversion is the line item people miss, because it arrives as a card charge in a month when nothing else is happening. Set a calendar reminder for two weeks before the term ends. The other cost is alert traffic: an address variation, a soft inquiry, an old account resurfacing in a new database, each one arriving as an email that wants a decision.

In practice, what happens to those alerts is that they get read carefully for a month, skimmed for two, and filtered into a folder by the fifth. That is not a discipline failure, it is what happens to any notification stream with a low hit rate, and it is worth planning around rather than promising yourself otherwise. Monitoring tells you after something has been opened. Its value is speed of discovery, not prevention, and speed of discovery only pays if someone is still reading.

Freezes, where the cost is front-loaded and then near zero

A security freeze at each of the three nationwide credit bureaus is free to place and free to lift, and it stops the most damaging outcome, a new account opened in your name, rather than reporting it afterward. The Federal Trade Commission oversees consumer protection in this area and maintains the government's identity theft reporting process, which is the reference point worth using instead of whatever the letter suggests. Budget an hour and a half for setup: three separate accounts, three identity verifications, three sets of credentials to store somewhere you will find them. Do it once, properly, in a single sitting.

The week-to-week cost after that is genuinely close to nothing, which is the whole argument for it. The exception is the month you apply for a mortgage, refinance, open a card for an airline promotion, or let a utility run a credit check on a new address, at which point you need to know which bureau the lender pulls and lift that freeze temporarily. Lifting takes minutes if you have the credentials and most of an afternoon if you do not. That is the honest trade: a small, predictable friction that arrives only when you initiate credit yourself.

The full response, and what actually leaves your bank account

Some letters describe exposure that warrants more: a Social Security number together with a date of birth, driver's license details, or tax and medical records. Here the spend becomes real, though rarely in the form of a subscription. Replacing a driver's license at the DMV, ordering a fresh copy of a birth certificate, filing a police report to support a dispute, and taking two hours of unpaid time to sit on the phone with a bank's fraud department are the recurring costs. If fraudulent tax filing is a risk, an identity protection PIN from the IRS becomes part of your filing routine every year, permanently.

The number that drives everything else is how long the exposure sits unnoticed. A new account caught in the first month is a dispute letter and a corrected credit file. The same account caught at eighteen months, after collections and a court filing, is where people start paying an attorney by the hour, and where the calculation stops being about monitoring fees at all.

Choosing by the week you actually have

If your credit activity is stable and you are not planning to borrow, freezes plus the free monitoring is the combination that costs the least attention per unit of protection, and the reminder to cancel before conversion is the only ongoing obligation. If you are mid-purchase or shop credit regularly, monitoring alone plus one deliberate quarterly review of your own credit reports fits a real week better than freezes you will resent lifting. If the exposure includes a Social Security number, treat the freeze as non-optional and the monitoring as a supplement rather than a substitute.

The letter asks for a decision on the day it arrives. The better move is to decide once, write down what you chose and when the term ends, and let a calendar carry the part of it that no one sustains by memory.