Tips for Safeguarding your Personal Information

What to carry with you, and what to leave at home

It is not recommended to routinely carry your social security card or birth certificate in your wallet or purse. We also suggest that consumers carry only those credit cards they use regularly and cancel all credit cards they do not use.   At home, keep an accurate list of all credit cards and bank accounts including the name, mailing address and telephone number of the creditor, the account number, and expiration date. Update the list regularly and keep it in a secure place. Also, review closely all credit card and bank statements each month to detect unusual activity or unauthorized charges.  These strategies can make it much easier to resolve lost or stolen information.

What information you give out

Don't give out any personal information (SSN, Bank or Account Number) on the telephone, through the mail, or over the Internet, unless you've initiated the contact or are sure you know with whom you are dealing. Disclose your social security number and financial account information only when absolutely necessary. Social Security numbers were implemented as a method to account for your taxable earnings, not as a universal identifier.  When you pay by check, the seller can only record your name, address, driver's license or Massachusetts ID number, and your choice of a home or daytime telephone number (M.G.L. c. 93, s. 105). If you have a random license number, you avoid disclosing your Social Security number every time you pay by check.  Keeping your information safe online is just as important, and we suggest consumers understand the technology  to make them safer when using Social Media and these tips to Safeguard Your Computer from ID Theft.

Managing Credit Reports and Specialty Consumer Reports

Many consumers don’t regularly fact-check what is in their credit and consumers reports.  Today, it is now much more common for an individual’s personal information to be compromised through a data breach, making them vulnerable to Identity Theft fraud.  Consumer records can also become inaccurate when a company makes an error in reporting your account or payment history to Credit Reporting Agencies.  Proactively managing their Identity is an effective way for consumers to make sure that their  Credit and Consumer Report information is working for them instead of against them  

Know Your Rights

Under state and federal law, you are entitled to one free copy of your credit report per calendar year from nationwide Credit Reporting Agencies (CRA).  Requesting a copy every year to ensure your report is without errors is worthwhile and recommended. If you ever apply for and are denied credit, you should immediately obtain a copy of your report to verify that all the information is correct. You have the right to know which credit or consumer reporting agency prepared the report that was used in the denial of your application. Under state law ( M.G.L. c. 93, s. 56 ), you have the right to a free copy of your credit report within 60 days of being denied credit.

Most consumers don’t realize there are more than 3 companies that maintain information about them, but should understand that they have the same right to obtain and correct inaccurate information in these reports from other companies as well.  Specialty Consumer Reporting Agencies (SCRA) may have a file with your information.  Utility companies, insurance companies, employers, landlords, or other non-lenders may not work exclusively with the 3 largest CRAs (Experian, Equifax, Trans Union) and may look at the information in specialty consumer reports available from SCRAs when making decision about you. 

Requesting your Credit and Consumer Report

Visit to receive your free annual credit report from Equifax, Trans Union, and Experian.  For those with concerns about sending their sensitive information over the internet, you can go “low-tech” with this single form which can be printed, completed, and sent by US Mail or Fax to request your credit report from all 3 companies at the same time.

Many SCRAs collect only certain information on consumers and may not maintain a file on you.  For example, If you’ve never had a electric or gas bill in your name, the National Consumer Telecom & Utilities Exchange may not have anything on file about you.  The only way to be 100% sure is to ask.  The Consumer Financial Protection Bureau has put together this helpful list with contact information for nearly 50 CRA and SCRA companies and details how you can make a request for a copy of your report from each of them.

TIP: Experian, Trans Union, and Equifax credit reports usually contain the same information about you., and you are not required to request all your credit reports at the same time.  If you spread out your requests over a year (one every four months), you will be able to monitor your refree credit report  

Correcting Errors in Your Credit and Consumer Report

If, after you are done fact-checking the information you receive, you find there is incorrect information in your credit or consumer report, you may ask the CRA or SCRA to investigate. You must do so in writing and it is recommended you do so by certified mail to ensure that it is received. A CRA must investigate your claim within 30 business days by asking the “Information Furnisher” (the company responsible for supplying the disputed information to the CRA) to review its records, unless the CRA believes that the dispute is "frivolous or irrelevant." The CRA is required under state and federal law to correct, complete, or delete any information that is erroneous, incomplete, or unverified. ( M.G.L. c. 93, s. 58 )

Additionally, negative information that is more than seven years old may not be included in your credit report. There are several exceptions to this rule; the primary one is bankruptcy, which may be reported for up to 10 years. ( M.G.L. c. 93, s. 52 )

Credit reporting agencies are generally not permitted to include in a credit report adverse information which is more than seven years old on the date of the report, although bankruptcy information may stay on a report for 10 years. These rules do not apply if the credit transaction at issue is for $50,000 or more, or if the report is being provided in connection with employment in a job that involves an annual salary of $20,000 or more.

If you disagree with the results of the credit reporting agency's investigation of the accuracy of an item on your credit report, you have the right to prepare a brief statement that explains your version of the dispute. The credit reporting agency is then required to include this statement with your credit report each time it sends out the report. ( M.G.L. c. 93, s. 58 )

If the consumer disputes the completeness or accuracy of any item of information in his or her credit report file, the general rule is that the credit reporting agency must investigate the dispute within 30 days, beginning on the date it receives the consumer's request for a correction. The credit reporting agency may require that consumers' requests for corrections be in writing. Within five business days of its receipt of a consumer's request, a credit reporting agency must notify the creditor that the consumer is disputing the information.

An agency may refuse to investigate a dispute if it has reasonable grounds to believe that the dispute is frivolous or irrelevant, including failure of the consumer to provide sufficient information, as requested by the agency, to resolve the dispute. An agency must notify the consumer by mail within five business days after it makes its determination that the dispute is frivolous or irrelevant, stating specific reasons for the finding.

If after investigation, a credit reporting agency determines that certain information about a consumer is inaccurate or can no longer be verified, it must delete that information within three business days. If an investigation fails to resolve the dispute, the consumer may submit a statement of no more than 100 words describing the dispute. The credit reporting agency must include a copy of that statement with any credit report it issues on that consumer.

If information is deleted from the consumer's credit report file because it is inaccurate or can not be verified, it may not be reinserted unless the consumer's creditor subsequently verifies that the information is accurate. If deleted information is subsequently reinserted in a credit report, the credit reporting agency must give the consumer a toll-free number to call to request the name, address, and telephone number of the person who directed the agency to reinsert previously deleted information. Within 15 days of receiving such a request, the agency must provide the consumer with that information.

Identity Theft Corrections

If the error you are correcting in your Credit or Consumer Report was caused by Identity Theft fraud, there is a specific process to follow that starts with making an Identity Theft Report with your local Police.  Check out the Identity Theft section of the AGO website for additional information on developing your own action plan for fixing errors caused by Identity Theft fraud. 

Credit Freezes

You do not have to be a victim of Identity Theft to place a Freeze on your Credit or Consumer Reports.  Some consideration should be made when placing a Freeze on your report as it can delay or prevent applications you are making for credit; however, they can always be lifted and replaced at your request.  Check out this information on Credit Freezes and Fraud Alerts, which are both effective ways to restrict the disclosure of your information.

Opt-Out of prescreened offers

A consumer may elect to have his or her name and address excluded from any list provided by a credit reporting agency to parties who wish to extend a "firm offer of credit" to consumers, such as "pre-screened" credit card offers that are often sent to consumers. The consumer may contact the credit reporting agency at 1 (888) 5-OPT-OUT (1-888-567-8688), or visit the website at or at the address provided for this purpose.

Links to Printable Identity Management/Identity Theft Materials

Identity Theft: A Recovery Plan (FTC) English | Spanish

Identity Theft Victim’s Complaint and Affidavit (FTC) English

FTC Memo to Law Enforcement: RE Identity Theft Report (FTC) English

Tri-bureau credit report request form (

Data Breaches: What to know, What to do (FTC) English | Spanish

Identity Theft: What to do right away (FTC) English | Spanish

Identity Theft: What to Know, What to do (FTC) English | Spanish | Tagalog | Chinese | Korean | Vietnamese

Identity Theft: Military Personnel & Families What to Know, What to do (FTC) English        

Child Identity Theft: What to Know, What to do (FTC) English | Spanish

Consumer Reporting Agencies List (CFPB) English