A credit freeze can restrict access to a credit report for many new-credit applications, but it does not lock an existing bank or card account. A thief with a password, email access, phone control, or a stolen session may still change contact details or send money. Secure the identity channels and each existing financial account separately.
A 2026 identity-theft post described a thief changing the email and phone on an existing TransUnion profile despite earlier protective steps. The recurring surprise is that report access and account authentication are different systems.
Start here: a practical action plan
- Open the cited agency page and use only the official site or phone number.
- Save dated screenshots, confirmation numbers, letters, statements, and a short call log.
- Replace every hypothetical amount and date with the facts from the affected account.
- Recheck the report or account after the stated processing period and escalate any unresolved error.
- Assuming one freeze, alert, dispute, or report protects every financial system.
- Giving a caller, text sender, or paid recovery service credentials, codes, money, or sensitive documents.
- Waiting for a complete explanation before stopping new losses and preserving evidence.
Map the four paths a thief can use
Separate new-credit fraud, existing financial-account takeover, email takeover, and mobile-number takeover. A credit freeze mainly targets the first path. The other three depend on passwords, sessions, recovery channels, device access, call-center authentication, and institution controls.
List the email, phone number, bank login, card login, payment apps, password manager, and credit-bureau accounts that can reset one another. Secure the most powerful recovery accounts first. A new bank password is weak protection if the thief still controls the email used to reset it.
Contain access from a trusted device
Call the institution using the number on a statement, card, or official website. Ask it to restrict online access, stop pending transfers when possible, invalidate active sessions, replace compromised cards, and preserve the fraud case. Change the email password and enable strong multifactor authentication before resetting linked financial accounts.
Ask the mobile carrier about an account PIN and protections against SIM changes or number transfers. Remove unfamiliar forwarding rules, devices, recovery emails, and authorized users. Do not share one-time codes with an incoming caller, even if the caller knows account details.
Worked example: protect $2,400 before changing ten passwords
Example: an alert shows a $2,400 bank transfer requested at 8:12 a.m. The customer calls the bank at 8:18 using the number in the app, and the bank marks the transfer pending review. At 8:32 the customer changes the email password and removes an unknown recovery address, then resets the bank login and carrier PIN.
The sequence takes 20 minutes from the first bank call through the email change in this example. It prioritizes the active loss and the reset channel. It does not guarantee the transfer will be stopped, and the institution determines the investigation and any credit.
| Time | Action | Reason |
|---|---|---|
| 8:12 | Fraud alert received | Start incident record |
| 8:18 | Bank called | Try to stop active loss |
| 8:32 | Email secured | Protect reset channel |
| 8:40 | Bank and carrier credentials reset | Close access paths |
Build the recovery file after access is contained
Record transaction IDs, alerts, profile changes, devices, calls, and case numbers. Report identity theft at IdentityTheft.gov when personal information was misused. Review credit reports and consider freezes for possible new-account fraud, but keep the existing-account case moving independently.
Watch for the second attack: someone claiming to recover the money for a fee or asking for a code. Real institutions may need identity verification, but use a verified outbound channel. A freeze confirmation does not mean the bank session, email, or phone account is safe.
- Stop active transfers through the institution.
- Secure email and phone recovery channels.
- Invalidate sessions and replace compromised credentials.
- Document and monitor each affected account.
Frequently asked questions
What does a credit freeze actually block?
It restricts access to a credit report, which can interfere with many new-credit applications.
Can a thief still use my existing credit card?
Yes. Report and replace a compromised card or account directly with the issuer.
Which password should I change first?
Secure the email or password manager that can reset the other affected accounts, while immediately reporting active financial loss.
Should I change my phone carrier PIN?
Yes if phone takeover is possible. Ask the carrier about protections against SIM changes and number transfers.
Does changing a password sign out every device?
Not always. Use the account’s session or device controls and ask the institution to invalidate access.
Should I pay a recovery specialist who contacts me?
No. Contact institutions and agencies through verified channels and treat unsolicited recovery offers as a likely scam.
Sources and review notes
The calculations and scenarios in this guide are original BreadWinnr worked examples. We recalculated each example and checked that its parts match the stated total. Official sources support the financial concepts. Forum links document the reader problem that prompted the guide and are not treated as financial authority.
- CFPB, what to do after identity theft
- CFPB, credit freeze and fraud alert guide
- Reddit: credit profile takeover after a freeze
Read our research, testing, corrections, and source policy.
This guide provides general financial education. It does not account for your complete financial, tax, legal, or contractual situation.
Make the example yours.
Use the safe-to-spend calculator to try a different starting point.