A push from Experian, Equifax, TransUnion, Credit Karma, or a bank app that says “new inquiry” or “address change” is not automatically identity theft. Many alerts are expected (you applied somewhere) or are marketing wrapped as security. A few deserve same-day action. This guide sorts signal from noise and gives a calm order of checks.
If the message arrives as a short link in SMS, treat it as hostile until the official app agrees: Fake bank and brokerage alerts.
Alert types and what to do
| Alert | Often means | First move |
|---|---|---|
| New hard inquiry | You (or someone) applied for credit | Confirm you applied; if not, freeze and dispute |
| New account / tradeline | Card, loan, or collection opened | Same-day freeze if unexpected; pull free reports |
| Address or phone change | Move, typo, or fraudster updating contact | Verify with the creditor; correct via bureau dispute if wrong |
| Soft inquiry / score change | Preapproval marketing, account review, or utilization shift | Usually no emergency; log it. Soft prequalification does not explain away a hard inquiry alert |
| Dark-web / SSN exposure | Credential dump mention | Change passwords, MFA, consider freeze |
| Balance / utilization jump | You spent or a limit dropped | Budget check; not always fraud |
Freezes and fraud alerts are the durable tools when something is wrong: Credit freezes and fraud alerts. Pull the underlying files at AnnualCreditReport.com: Free credit reports.
Calm triage in ten minutes
- Do not tap a link in the alert email or text. Open the monitoring app or bureau site from your home screen / bookmark.
- Read the exact change: inquiry creditor name, account type, date, bureau.
- Ask: did I apply, move, or authorize this in the last 30–60 days?
- If yes and expected, archive the alert. If no, place freezes at Equifax, Experian, and TransUnion, then dispute and contact the creditor’s fraud line from their official site.
- After a known breach, harden email and banking first: Account takeover after a data breach.
Worked example
Jordan gets a Credit Karma push: “New hard inquiry, Capital One.” Jordan did soft-prequalify on Capital One’s site last night, but soft prequalification is a soft pull and cannot justify dismissing a hard inquiry alert. Jordan opens the Capital One app (not the email link). If the app shows Jordan completed a full application that triggered a hard pull, Jordan archives the alert. If Jordan only soft-prequalified and never hard-applied, Jordan treats the hard inquiry as unexpected: freeze if needed, dispute, and call Capital One fraud using capitalone.com.
Two days later a second alert says “New account, Synchrony Bank.” Jordan never applied. Jordan freezes all three bureaus, pulls reports, disputes the Synchrony tradeline, and calls Synchrony fraud using the number on synchrony.com. Cost of the correct path: about 30 minutes. Cost of ignoring a true new-account alert: a funded account in someone else’s shopping cart.
When a freeze is the right default
- Any new account you did not open
- Hard inquiries from lenders you do not recognize (cleanup: Removing a hard inquiry mistake)
- Address changes tied to accounts you still use
- After you already know a wallet, tax transcript, or mailbox was compromised
A freeze does not close existing accounts or stop you from using cards you already have. Thaw briefly before a planned application, then freeze again.
A “available credit dropped” alert can be a real issuer limit cut, not always fraud: Sudden credit limit decrease.
Checklist
- Verify the alert inside the official app or site, never via the message link.
- Match creditor name and date to applications you remember.
- Freeze all three bureaus for unexpected accounts or inquiries.
- Dispute errors in writing and keep confirmation numbers (Report disputes).
- Report clear identity theft through IdentityTheft.gov when accounts were opened in your name (Report credit report fraud).
- Turn off duplicate “score drop” marketing pushes that train you to ignore real alerts.
Educational only. Not legal, fraud-recovery, or credit advice. Monitoring products and bureau notices vary; confirm freezes and disputes with Equifax, Experian, TransUnion, and the creditor named on the alert.