A push from Experian, Equifax, TransUnion, Credit Karma, or a bank app that says “new inquiry” or “address change” is not automatically identity theft. Many alerts are expected (you applied somewhere) or are marketing wrapped as security. A few deserve same-day action. This guide sorts signal from noise and gives a calm order of checks.
If the message arrives as a short link in SMS, treat it as hostile until the official app agrees: Fake bank and brokerage alerts.
Alert types and what to do
| Alert | Often means | First move |
|---|---|---|
| New hard inquiry | You (or someone) applied for credit | Confirm you applied; if not, freeze and dispute |
| New account / tradeline | Card, loan, or collection opened | Same-day freeze if unexpected; pull free reports |
| Address or phone change | Move, typo, or fraudster updating contact | Verify with the creditor; correct via bureau dispute if wrong |
| Soft inquiry / score change | Preapproval marketing or utilization shift | Usually no emergency; log it |
| Dark-web / SSN exposure | Credential dump mention | Change passwords, MFA, consider freeze |
| Balance / utilization jump | You spent or a limit dropped | Budget check; not always fraud |
Freezes and fraud alerts are the durable tools when something is wrong: Credit freezes and fraud alerts. Pull the underlying files at AnnualCreditReport.com: Free credit reports.
Calm triage in ten minutes
- Do not tap a link in the alert email or text. Open the monitoring app or bureau site from your home screen / bookmark.
- Read the exact change: inquiry creditor name, account type, date, bureau.
- Ask: did I apply, move, or authorize this in the last 30–60 days?
- If yes and expected, archive the alert. If no, place freezes at Equifax, Experian, and TransUnion, then dispute and contact the creditor’s fraud line from their official site.
- After a known breach, harden email and banking first: Account takeover after a data breach.
Worked example
Jordan gets a Credit Karma push: “New inquiry — Capital One.” Jordan soft-prequalified for a card last night and remembers the submit. Jordan opens the Capital One app (not the email link), sees the application pending, and archives the alert. No freeze.
Two days later a second alert says “New account — Synchrony Bank.” Jordan never applied. Jordan freezes all three bureaus, pulls reports, disputes the Synchrony tradeline, and calls Synchrony fraud using the number on synchrony.com. Cost of the correct path: about 30 minutes. Cost of ignoring it: a funded account in someone else’s shopping cart.
When a freeze is the right default
- Any new account you did not open
- Hard inquiries from lenders you do not recognize (cleanup: Removing a hard inquiry mistake)
- Address changes tied to accounts you still use
- After you already know a wallet, tax transcript, or mailbox was compromised
A freeze does not close existing accounts or stop you from using cards you already have. Thaw briefly before a planned application, then freeze again.
A “available credit dropped” alert can be a real issuer limit cut—not always fraud: Sudden credit limit decrease.
Checklist
- Verify the alert inside the official app or site, never via the message link.
- Match creditor name and date to applications you remember.
- Freeze all three bureaus for unexpected accounts or inquiries.
- Dispute errors in writing and keep confirmation numbers (Report disputes).
- Report clear identity theft through IdentityTheft.gov when accounts were opened in your name (Report credit report fraud).
- Turn off duplicate “score drop” marketing pushes that train you to ignore real alerts.
Educational only. Not legal, fraud-recovery, or credit advice. Monitoring products and bureau notices vary; confirm freezes and disputes with Equifax, Experian, TransUnion, and the creditor named on the alert.